The storage-vs-egress split is where we landed after learning this the hard way. On the storage side we mask aggressively before anything is written (keys, intranet paths, phone numbers - better over-masked than leaky). On the egress side, raw bytes go upstream, and making egress masking opt-in per backend is the line we're moving to: untrusted upstreams get scrubbed, trusted paid backends get raw.

The reason egress masking isn't just "do it everywhere" is coding traffic. A phone number inside a test fixture, an intranet IP inside a config file being edited - mask those and the model faithfully produces wrong edits. So the egress pattern set has to be narrower than the storage set (identifiers yes, code-shaped content no), and the switch has to be per backend, because "how much do you trust this upstream" is not one answer across a pool.

Curious how you draw that line for coding agents - is sensitive-data traffic ever routed through coding workloads in your deployments, or do you treat those as separate compliance domains?