If it's not also running every tool response through this detection/masking, then it's not really "protecting" any agent use cases where they will be potentially reading files/data.