Prompt Vault technical coverage

Prompt Vault is implemented as a central prompt-retention policy used by runtime hooks and OTLP ingest. The control governs raw user prompt text after detection and before normal event evidence is...

Prompt Vault is implemented as a central prompt-retention policy used by runtime hooks and OTLP ingest. The control governs raw user prompt text after detection and before normal event evidence is stored.

Data flow

Prompt source -> normalize event -> evaluate policy in memory -> apply Prompt Vault -> store governed evidence

For Visible Capture, raw prompt text can stay in normal event context.

For Sealed Evidence, raw prompt text is encrypted into prompt_evidence. Normal event rows keep prompt_privacy_mode, prompt_evidence_id, prompt length, prompt hash, source, and timing metadata. Raw text is removed from shield_events, otlp_events, summaries, search payloads, detector evidence material, exports, and normal APIs.

For Promptless, raw prompt text is not written to evidence storage. Normal event rows keep only non-content metadata such as mode, source, hash, and length when available.

Runtime Shield coverage

Prompt Vault applies to Runtime Shield prompt-submit events normalized as UserPrompt.

Source	Runtime prompt coverage	Notes
Claude Code	Covered through legacy Claude Code hooks and the unified runtime endpoint	`UserPromptSubmit` becomes `UserPrompt`.
Claude Cowork	Covered through the unified runtime endpoint	Cowork prompt payloads, including prompt-only payloads, become `UserPrompt`.
Cursor	Covered when Cursor emits an explicit prompt-submit event or wrapper payload	Prompt-like MCP parameters remain MCP calls, not prompt events.
Windsurf	Covered when Windsurf emits prompt-submit action or wrapper payload	Native action names and normalized wrapper payloads are both recognized.
GitHub Copilot	Covered when Copilot emits an explicit prompt-submit event or wrapper payload	Tool args can carry `prompt`, `message`, `content`, `text`, or `input`.
Codex	Covered when Codex emits an explicit prompt-submit event or wrapper payload	Existing shell, edit, read, web, and MCP tool calls keep their original classification.
Gemini CLI	Covered when Gemini emits an explicit prompt-submit event or wrapper payload	Function-call and tool-call payloads keep normal tool classification unless explicitly prompt-submit.
Google Antigravity	Covered when Antigravity emits explicit prompt-submit, invocation-context, or wrapper payloads	Tool calls keep normal command, file, URL, MCP, subagent, or schedule classification unless the emitted event is prompt-like.
Direct shield event uploads	Covered for explicit prompt events posted to `/api/v1/shield/events`	This protects older or batch collectors that bypass `/evaluate`.

The boundary is event-based. Prompt Vault protects prompt events. It does not automatically reclassify every arbitrary tool parameter named prompt, because many MCP tools and web tools use a prompt parameter as normal tool input.

OTLP and AgentKeeper Runtime coverage

Claude/Cowork OTLP logs are covered by the ingest pipeline. In Sealed Evidence and Promptless, AgentKeeper scrubs prompt content before inserting normal OTLP rows.

Covered OTLP fields include:

user_prompt event body,
prompt_preview,
prompt-like attributes,
prompt-like tool input fields,
prompt-like body text,
detector evidence material derived from prompt content,
search and export payloads built from OTLP rows.

Tool parameter logging is still controlled separately. Prompt Vault scrubs prompt-like fields even when tool details remain enabled, but non-prompt tool parameters follow the tenant's tool-detail setting.

AgentKeeper runtime/eBPF sensor events such as agentkeeper.runtime.os.exec and agentkeeper.runtime.os.connection share the OTLP transport and otlp_events table. They are presented as AgentKeeper Runtime in operator surfaces. Org-level Prompt Vault mode alone does not make those rows prompt evidence. Prompt Evidence UI appears only when the row has a real prompt carrier, such as event_name = user_prompt, a prompt_evidence_id, prompt_preview, or prompt metadata.

Runtime sensor metadata, including process, connection, host, rule, status, and error fields, remains visible unless a specific field is an explicit prompt field or the tenant disables tool details.

Storage tables

prompt_evidence stores sealed prompt bodies and metadata:

organization,
source table and source event ID,
prompt source,
encrypted prompt body,
prompt hash and length,
session, actor, host, and retention metadata.

prompt_evidence_access_log stores reveal audit records:

evidence ID and organization,
actor and role,
required reason,
user agent and IP metadata,
timestamp.

Normal event tables keep a reference:

shield_events.prompt_privacy_mode,
shield_events.prompt_evidence_id,
otlp_events.prompt_privacy_mode,
otlp_events.prompt_evidence_id.

Reveal endpoint

The governed reveal endpoint requires:

authenticated owner or admin role,
matching organization scope,
non-empty reason,
successful access-log insert before decrypting and returning the prompt.

Failed authorization returns 403. Missing or too-short reasons return 400. Successful responses are no-store.

Verification requirements

Before promotion, verify:

each supported runtime source normalizes explicit prompt-submit payloads to UserPrompt,
Sealed Evidence writes prompt_evidence and strips raw text from shield_events and otlp_events,
Promptless does not write raw prompt text,
normal Activity, Findings, Investigation, Workstation, export, and search APIs do not expose sealed or promptless prompt bodies,
runtime/eBPF rows are labeled AgentKeeper Runtime and do not show Prompt Evidence controls unless linked to prompt evidence,
reveal succeeds only for owner/admin users with a reason,
every successful reveal creates an access log row.

Normal raw JSON, export, preview, archive, and AI-analysis surfaces must use Prompt Vault-safe serialization as a second boundary after retention-time scrubbing. See the surface audit for the current matrix.

Related detail: showcase, admin guide, surface audit, and OTLP evidence.

Was this page helpful?