ModelRig / compare / what leaves your process
What leaves your process
Every hosted gateway now offers server-side redaction. The question they leave unanswered: what left, did it change the answer, and can you show it per step?
Request-side, in your process
Masking rewrites the request before it leaves your process. Detected spans become run-scoped tokens; the model sees tokens, not values, and the token maps back the same person across every step of a run — a map that stays in your process.
A receipt on every step
Every step carries a counts-only receipt: findings by type, tokens issued, unresolved — never a value. It rolls up per run so you can show what a route masks.
The masked arm, proven
No detected span leaves the masked arm — re-run the detector over the masked request and it finds nothing. And a masked-vs-unmasked bake-off replays your captured traffic against the same model and reports the value-accuracy Δ with a confidence interval, so a masking policy that moved the answer beyond your tolerance can't be promoted. The report is the pull request — the proof is the artifact, not a promise.
And what comes IN as data
The other half of the boundary is what comes back in. Search results and third-party content are untrusted content, isolated as data: assembled into a spotlighted user-slot block, JSON-encoded, delivered as data, not instructions — never concatenated into the trusted system prompt. Known injection shapes are flagged with a counts-only receipt, and a flagged turn can be quarantined so it cannot trigger a tool call through ModelRig.
This is isolation and flagging, not prevention. Screening does not prevent injection — no detector can. The pattern pack and the optional classifier report a measured false-positive rate on the stated corpus, not a guarantee; the quarantine boundary governs ModelRig's own dispatch, not your downstream agent loop, and the receipt makes that boundary explicit.
Honest limits
Deterministic detectors, your dictionary, and your field rules. They catch what you name and what has a checkable shape; they do not catch free-text names you didn't list. A v2 detector seam lets you run your own NER sidecar. The Δ is measured on your replayed corpus, on the stated n — it is evidence for that traffic, not a guarantee about future or unlike requests.
Deterministic assembly, a pattern pack, and an optional in-process classifier. They isolate untrusted content and flag known injection shapes; they do not prevent injection — no detector can. We publish the measured false-positive rate instead of a guarantee.