Deny Secrets in Memory

​

Policy JSON

{
  "memory": {
    "deny_secrets_in_memory": true,
    "deny_pii_in_memory": true,
    "redact_pii_on_write": false,
    "action_on_secret": "DENY_WRITE",
    "action_on_pii": "DENY_WRITE"
  }
}

policy = {
    "memory": {
        "deny_secrets_in_memory": True,
        "deny_pii_in_memory": True,
        "redact_pii_on_write": False,
        "action_on_secret": "DENY_WRITE",
        "action_on_pii": "DENY_WRITE",
    }
}

​

What It Does

• Scans memory writes for secrets (API keys, tokens, credentials) and PII (emails, SSNs, phone numbers)
• Denies the write if any secret or PII is detected — the data never reaches the memory store
• Does not redact — the write is blocked entirely rather than storing a redacted version
• Works across all memory scopes (request, session, user, shared, global)

​

Example

{
  "action": "DENY_WRITE",
  "risk_score": 0.9,
  "reasons": ["secret_in_memory_write"],
  "evidence": {
    "findings": [
      {
        "type": "openai_api_key",
        "category": "api_keys",
        "action": "DENY_WRITE"
      }
    ],
    "target_scope": "session",
    "redact_pii_on_write": false
  }
}

​

Install

# Install via CLI
tealtiger policy install deny-secrets-in-memory

# Or copy the JSON above into your tealtiger.config.json

​

Customize

​

Related

• API Key Detection — Detect secrets in agent I/O before they reach memory
• PII Redaction — Basic — Redact PII in requests and responses
• Session Scope Only — Limit memory persistence alongside secret denial
• TealMemory Documentation — Full API reference