Enum SensitiveContentEgressPoint

Namespace

MailFathom.Application.SensitiveContent.Egress

Assembly

MailFathom.Application.dll

Names a point at which text crosses out of this deployment and is therefore scanned before it does.

public enum SensitiveContentEgressPoint

Fields

ChatPrompt = 0

Text composed into a request to a chat provider, including a retrieved extract and a tool result.

HostedEmbeddingInput = 1

Text sent to an embedding provider, which is a configured endpoint whether or not it is inside the deployment.

McpEmailContent = 3

The message an MCP client asked for by identity: its body representations, its subject, and the display names its headers wrote.

Apart from the snippets above because it is the one point that publishes a whole body rather than an extract of one, and therefore the one whose latency an operator reads as the cost of scanning a read. Sharing a tag with the listing would average the two into a number describing neither.

McpSnippet = 2

Text an MCP tool returns: a search snippet, a subject a listing publishes, and an answer a run produced.

Remarks

This enumeration is the register of guarded egress. A prompt is the point everybody thinks of and the least likely to be the leak: a credential reaches a third party just as completely through an embedding request or a tool result, and those paths are written by people who are not thinking about redaction at the time. A path that hands text to somebody else and is not a member here is unguarded, so adding one is part of adding the path rather than a follow-up to it.

Three paths the design names carry no member, and each absence is a fact about this deployment rather than an omission. Logs and audit events carry no message text at all — every event of both is composed from identifiers, this deployment's own configured aliases, counts, and outcomes, which is a rule the whole repository is written under and the reason a finding is recorded here by category and rule rather than by value. Recording what was found, where, and in which message would recreate the leak inside the record written to prevent it. Webhook payloads have no member because MailFathom sends no webhook; the day it does, the payload is composed from mail and the member arrives with it.

A member is a metric tag rather than a stored value, so the numbers are free to be reassigned only in the sense every enum here is: allocated once, in declaration order, and never reordered or reused.