The Semantic Firewall is a local gateway that sits between your coding agent and the model API. On the way out it swaps your customer names, codenames, hostnames and secrets for realistic, deterministic surrogates. On the way back it reverses them, before your machine ever runs a command. The model reasons in a pseudonymous universe; your team works in the real one. The mapping key never leaves the building.
Frontier models are now good enough to live inside your codebase. The blocker is rarely capability — it is the gap between what a vendor promises and what your security team is willing to bet the crown jewels on.
Most enterprise secrets are referential, not structural. The model does not need to know that the customer is Northwind Trading or that the box is prod-db-07. It needs the grammar, the types, the control flow and the logic. Those it gets in full.
The bug is identical in both columns. The 401, the quota logic, the shape of the request, the relationship between the customer and the failing service — all preserved. Only the swappable names changed. This is PCI-style tokenisation, lifted from card numbers to the semantic layer.
Claude Code and every Anthropic SDK honour ANTHROPIC_BASE_URL. Point it at the gateway and you are done — no patches to the agent, no change to how your engineers work. The gateway transforms requests on the way out and reverses responses on the way in.
This is a verbatim round-trip from the build’s integration tests. The left column is exactly what left the machine for Anthropic’s servers — every accented token is a surrogate. The right is what the developer saw after the gateway reversed the response. Same bytes, swapped names.
Captured worst-case: the response was streamed one character per delta and the client still restored all ten entities byte-identically. The mapping never appeared in either payload — only on this machine.
Sources: npm run selftest · scripts/itest-transform.ts · scripts/itest-live.ts (Claude Haiku 4.5) · eval/ci.py
The surrogate scheme is engineered so the model never notices, the substitution never corrupts a payload, and nothing sensitive can slip out by accident.
A name maps to the same surrogate on turn 1 and turn 50. The model can reason about “Brightmere Supply” across a long session because the alias never drifts — and byte-stable prefixes keep prompt caching hitting.
Surrogates use only characters that survive JSON escaping, so substring replacement is safe even inside a split streaming fragment. No quotes, no backslashes, nothing that shifts under serialisation.
The bijective map lives in an AES-256-GCM encrypted store on your machine, keyed from a local keyfile generated on init. The mapping never travels with the request. Lose nothing to the network.
Surrogates carry a subtle signature, so a scanner can spot any that slip into your working tree — and collisions against your real vocabulary or known brands are checked and reseeded at generation time.
Every request appends a hash-chained, append-only record: timestamp, model, destination, bytes in and out, and a count of redactions by category — never the values themselves. A single command verifies the chain end to end. It is the artefact your CISO can take to the audit committee.
{ "ts": "2026-06-09T14:02:11Z",
"request_id": "req_8c1f…",
"model": "claude-opus-4-8",
"redactions": {
"company": 3,
"hostname": 2,
"secret": 1,
"email": 1
},
"bytes_in": 18422,
"bytes_out": 6190,
"destination": "api.anthropic.com",
"prev_hash": "a91b…7e",
"hash": "f30c…12" }We would rather tell you the limit up front than have your security team find it in review. The firewall protects nouns. It does not hide that work is happening, or what kind.
The structure is the point — it is what the model needs to be useful. So the model still learns that you run a multi-tenant billing system in TypeScript with a Postgres ledger and a quota bug. It just never learns whose. For the vast majority of agentic coding work, that is exactly the right trade: full capability, zero identifying IP on the wire.
When the architecture, the model weights, or the algorithm itself cannot be revealed even in shape, pseudonymising nouns is not enough. That work belongs in a hardware-attested enclave where the inference runs against memory the provider cannot read, with a remote-attestation proof you can verify. It is a heavier, more expensive lane — and we will tell you honestly which of the two your problem needs.
We are running early pilots of the Semantic Firewall with teams who want agentic coding on sensitive repositories. Most start with a 45-minute conversation: your threat model, what counts as a noun in your world, and whether Lane 1 is enough.