Policy demoKeep agents out of your secrets
Most machines have files with passwords and tokens that any agent can read. A single Qpoint policy stops agents from reading those files, whether they open the file directly, use a command, or write a script to do it. In the demo, the policy stops both Claude Code and Grok.
Gaurav Mahajan
October 29, 2026
About this demo
Agents can read anything on disk, including environment files full of passwords and tokens. In this demo, we enforce a simple company rule: agents don’t read secrets.
One Qpoint policy covers three paths: reading the .env file directly, naming it in a command, and writing a script that touches it. We ask Claude Code to grab the secrets from a project’s .env file and the read is blocked with a permission denied error. We send the same prompt to Grok and it’s blocked too.
See Qpoint in action in your environment
Request access and we'll get you set up.