Protect your agent IP

How IP protection works

Augex defends your agent bundle with three layers. Each one covers a different threat; none of them is bulletproof on its own.

1. CONFIDENTIAL markers. You wrap proprietary sections of your bundle in <!-- CONFIDENTIAL --> ... <!-- /CONFIDENTIAL --> comments. The runtime fingerprints the marked text and redacts the agent's response whenever it would emit a verbatim or near-verbatim quote.
2. Canary tokens. Augex stamps two canaries per copy of your agent — one identifies the Agent, one identifies the specific user's installation. If a token surfaces in a chat reply, screenshot, blog post, or competitor product, Augex reverse-looks it up. A static leak alone resolves to BOTH the originating Agent and the originating user's workspace. (Installations that existed before the per-install canary launched, and have not been re-installed since, carry only the Agent-scope canary until their next container rebuild.) See Canary forensics below.
3. Tool-level guards. The runtime blocks direct file reads against bundle files (e.g. cat ~/.hermes/profiles/<agent>/SOUL.md) so a user cannot ask the agent to dump its own configuration.

Using CONFIDENTIAL markers

Markers are literal HTML comments. Place them on their own lines around the proprietary block. They are case-sensitive (use CONFIDENTIAL, not Confidential). Per-subagent files at agents/<key>/SOUL.md are scanned the same way as the root file.

Copy this snippet into your SOUL.md as a starting point:

## Your trading methodology

<!-- CONFIDENTIAL -->
Use the proprietary LFM model output combined with 3-day SMA crossover.
Open positions only when both signals align.
Risk: max 2% drawdown per position with 0.2% trailing stop.
<!-- /CONFIDENTIAL -->

You can discuss general trading concepts freely.

<!-- CONFIDENTIAL -->
1. Pull 1-year OHLCV for the requested ticker.
2. Apply 2.5-sigma Bollinger on the 20-day SMA.
3. Cross-check with our RSI(14) momentum filter.
4. Score against our internal factor weights.
<!-- /CONFIDENTIAL -->

I help traders evaluate equities.

<!-- CONFIDENTIAL -->
My ranking blends the creator's house alpha factors with a custom
volatility-adjusted Sharpe estimator tuned on 8 years of backtests.
<!-- /CONFIDENTIAL -->

I always cite my sources and never give financial advice.

<!-- CONFIDENTIAL -->
I am a friendly markets-research assistant who follows the creator's
house style and always answers in plain English.
<!-- /CONFIDENTIAL -->

<!-- CONFIDENTIAL -->
# SOUL.md
[...500 lines of personality, methodology, examples,
 disclaimers, capability descriptions, etc...]
<!-- /CONFIDENTIAL -->

What is NOT protected

We make extraction harder, not impossible. Being upfront about the limits is the only way to set the right expectations:

• Sophisticated extraction by motivated adversaries (multi-session social engineering, careful paraphrase chains).
• Paraphrased quotes — if your agent rephrases marked content without the original keywords, the fingerprint match may miss.
• Multi-turn extraction strung across many sessions, where each individual turn looks innocuous.
• Anything you put OUTSIDE CONFIDENTIAL markers. Unmarked text in SOUL.md, AGENTS.md, IDENTITY.md is visible to chat output.
• Real secrets — API keys, customer PII, signing keys. Never put these in a prompt at all.

Treat CONFIDENTIAL markers as deterrence against honest-curious users and obvious prompt-injection — not as a vault.

Canary forensics

Every copy of your agent is stamped with two canary tokens (AUGEX_CANARY_…) woven into the compiled system prompt: one identifies the Agent itself, one identifies the specific user's installation. If an installed agent ever quotes either token in a chat reply — even paraphrased text can sometimes echo it verbatim — the runtime catches it and writes a forensic row that Augex operators monitor.

What detection gives you:

• Direct identification of your Agent and the specific user's installation from a static leak — both canaries are reverse-lookup-able from the leaked text alone.
• Real-time workspace context at the moment the hit fired: which workspace, which session, which timestamp.
• An operator-facing audit feed Augex uses to spot patterns across installations.

What detection does not give you: a leak that is paraphrased thoroughly enough to drop both canary strings will still bypass reverse lookup — fingerprint redaction is your protection there, not canaries. Pre-B5 installs carry only the Agent-scope canary; for those, user attribution still falls back to correlating canary-hit events around the leak timestamp.

This is detection, not prevention: the leak has already happened by the time the canary fires. It is still useful — it shifts the user's incentive, because the cost of getting caught is now real.

If you suspect a leak

1. Email support@augex.ai with the evidence — a screenshot, the suspect quote, a URL if you have one, and an approximate date or time window.
2. Augex reverse-looks-up the canary token. If it matches a per-installation canary, the leaking user and workspace are identified directly. If it matches only the Agent-scope canary (pre-B5 installs, or a partially-redacted leak that lost the install footer), Augex falls back to correlating recent canary-hit events around the timestamp to narrow the candidate set.
3. Account action, payment reversal, and any legal follow-up proceed from there. You will be kept in the loop on the outcome. Turnaround is typically the same business day.