Begin at the data path
Before a prompt, retrieved context, or tool result reaches a model connection, detect configured sensitive classes and replace them with stable references. The model receives enough structure to perform the task without automatically receiving the source identifiers.
Rehydration is disclosure
Putting a sensitive value back into a response is not a formatting step. It is a disclosure decision. It should evaluate current role, purpose, consent, scope, and operational conditions, and it should be auditable whether the answer is permit or deny.
Manifest the session
A session manifest can link provider configuration, transformation events, governed disclosures, subject and purpose context, and evidence handles. This gives investigators a bounded account of the protected path.
Do not overclaim the boundary
A privacy gateway does not control an agent that sends traffic around it. It does not choose the model, sandbox tools, solve prompt injection, or shut down the orchestration runtime. Network egress, runtime permissions, and agent controls remain essential companion controls.