How does that prevent an agent from leaking it once it's read into context?