Session-bound reversible mappings
Protect and shard operations may create placeholders and return a session_id plus reconstruction_token to the trusted caller. The MCP adapter removes both fields before returning tool results to an agent.
- 01
CREATE
A protect or shard operation creates a bounded session when reversible mappings are needed.
- 02
STORE
Mappings are encrypted at rest and associated with the session, placeholder, and entity type.
- 03
AUTHORIZE
Reconstruction requires both session id and reconstruction token; callers may additionally allowlist placeholders.
- 04
EXPIRE
The default lifetime is 24 hours and the production ceiling is seven days in the current deployment.
Separate keys and authenticated context
| CONTROL | CURRENT IMPLEMENTATION |
|---|---|
| Encryption | AES-256-GCM with a random 96-bit nonce |
| Derivation | HKDF-SHA-256 derives separate encryption, fingerprint, and receipt keys |
| Authenticated data | Session, placeholder, and entity type bind ciphertext to context |
| Key file | Mode 0600 inside a read-only-root container and dedicated volume |
| Database | SQLite WAL, foreign keys enabled, synchronous FULL |
Restore only after output inspection
- Never send reconstruction credentials to the upstream model, MCP host prompt, or autonomous agent.
- Run the output guard before resolving placeholders.
- Allowlist only the placeholders the current application view needs.
- Treat expired or unauthorized sessions as a hard failure, not a reason to infer missing values.
- Log receipt identifiers and decisions, never source values or decrypted mappings.