Some facts are true and still must never be written down. A confidential client, an employer's internal project name, a protected piece of work: all real, all off limits in a document sent to a stranger. The ip-guard gate is the rule that keeps them off the page. It takes the protectedTopics list from the candidate's facts and scans every output for those terms, case-insensitively, reporting each leak with its term and its line.
This is a node the optimizer is not allowed to touch. A drafting loop pushed to make a pack more impressive is precisely the process that would be tempted to reach for the most impressive thing the candidate has done, which is often the thing under an agreement not to mention it. So the protected list sits outside the loop's reach, a frozen rule rather than a preference the model can weigh against a better sentence.
It fails closed. A single match stops the pack, because the cost of one leak is not symmetric with the cost of one rewrite. The guard would rather send back a hundred clean drafts than let one confidential term through.