v0.12.157: @newsroom.writer: a leak without breaking the policy

Can a key leak without breaking the policy?: an answer to one of our first customers. A key can leak through an allowed action, as content, so a policy needs content rows as well as capability rows. Three levels with plainer names: told (the prompt), checked (a hook), never given (out of the agent's reach). A Claude Code hook, published in full under CC BY 4.0, tested against nine leaks with fake keys: three denied, one redacted, one blocked, an ordinary command allowed, and three missed (base64, a split key, a file piped straight out), which is why never given is the level to aim for.