Pentect replaces sensitive values with opaque handles before a request reaches the model. A handle looks like <<API_KEY_ab12...>>.

Rules

• Copy handles exactly. Do not edit, expand, guess, or explain them.
• Use a handle only in a local tool call that needs its value.
• Never print a secret or ask the user to reveal one.
• Do not bypass a Pentect block. Report the unsupported content or surface, and let the user choose a documented compatibility setting.
• Do not assume that a remote or cloud agent uses the local Pentect gateway.

Use pentect doctor to check the installation and pentect log --once --tail 100 for bounded diagnostics that do not contain secret values.

The same instructions are available in the repository's AGENTS.md.