Access control usually has two answers: you may, or you may not. For keeping parts of a codebase from the people who work in it, two is not enough, for two reasons.
Why "denied" leaks
Ask an ordinary filesystem for a file you cannot read and you get permission denied. The answer is honest, and it leaks: it confirms the file is there. In a payments monorepo, src/lib/billing/fraudRules.ts answering permission denied tells a contractor there is a fraud-rules module, where it lives, and what it is called.
Occlude answers a probe of a file the person may not read the way it answers a file that does not exist: ENOENT, No such file or directory. The listing does not show it. A folder holding nothing but such files does not exist either. The lookup even takes as long as a lookup of a missing file.
Why code and credentials need different answers
The compiler needs the billing engine. It never needs the production database password. Give both the same treatment and one of them is wrong: either the password is in the build's memory, or the billing engine is not and the build fails.
The four
| State | The person | The build |
|---|---|---|
| Visible | Reads and writes | Reads and writes |
| Read-only | Reads, cannot write | Reads |
| Occluded | Nothing: ENOENT, and a declaration stub where their code imports it | Reads the real file |
| Absent | Nothing | Nothing: never mounted, never in memory |
Occluded is the reason Occlude exists: the file is there for the build and not for the person. Absent is the answer for material no build should hold: .env files, credentials, customer data seeds.
Silent and held
The two states that say no behave differently on purpose.
Occluded is silent. The process gets ENOENT, the attempt goes on the record, and nobody is interrupted, because the file must not be known to exist.
Absent is held. When a session reaches for a credential, someone should decide. The request appears where it came from, an agent run pauses, and a named approver is asked. Approve, and the grant is amended and the path mounted for that session. Refuse, and nothing changes. Either way it is on the record.
Each rule can change its default. An export-controlled compartment can be Absent and silent; a sensitive configuration file can be Occluded and held.
Why the alerts are worth reading
An Occluded path was never visible to the process that asked for it, so a request for one is almost never an accident. Language servers do probe paths while resolving imports, and those bursts are recognised and recorded without an alert. Everything else is an attempt, and it alerts. Two kinds of "no" give a security team alerts worth reading.
Sources
- Our docs: The four states and The ledger.
Want to go through this for your codebase?
Or write to contact@occludehq.com