# TraconContentProtectionExtensions

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.traconcontentprotectionextensions/
> Summary: TraconContentProtectionExtensions: Chain extensions that turn on at-rest content protection.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Core.dll</code></div>

Chain extensions that turn on at-rest content protection.

```csharp
public static class TraconContentProtectionExtensions
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.traconcontentprotectionextensions/">TraconContentProtectionExtensions</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.memberwiseclone">object.MemberwiseClone()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

This is an extension method, not a member of [ITraconBuilder](/api/tracon.itraconbuilder/):
adding a member to the interface is a breaking change after release; adding
an extension method is not.

## Methods

### <a id="Tracon_TraconContentProtectionExtensions_AddContentProtection_Tracon_ITraconBuilder_System_Action_Tracon_TraconContentProtectionOptions__"></a> AddContentProtection\(ITraconBuilder, Action<TraconContentProtectionOptions\>?\)

Registers Tracon's built-in AES-256-GCM content protector.

```csharp
public static ITraconBuilder AddContentProtection(this ITraconBuilder builder, Action<TraconContentProtectionOptions>? configure = null)
```

#### Parameters

`builder` [ITraconBuilder](/api/tracon.itraconbuilder/)

The configuration chain.

`configure` [Action](https://learn.microsoft.com/dotnet/api/system.action\-1)<[TraconContentProtectionOptions](/api/tracon.traconcontentprotectionoptions/)\>?

Key and column settings.

#### Returns

 [ITraconBuilder](/api/tracon.itraconbuilder/)

The chain, for further configuration.

#### Remarks

**This call is the no-surprises rule's gate.** `AddTracon`
alone registers a no-op protector that writes plaintext unchanged; without
this call (or a matching `Tracon:ContentProtection:Enabled`
configuration section), nothing is encrypted.

Replaces the default registration rather than adding to it — a
consumer's explicit call always wins over Tracon's own default
(the same rule `UsePostgreSql` follows for its stores).

```csharp
builder.AddTracon()
       .AddContentProtection(options =>
       {
           options.ActiveKeyId = "2026-08";
           options.Keys["2026-08"] = "ContentProtectionKeys:2026-08";
       });
```

#### Exceptions

 [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception)

`builder` is [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null).

### <a id="Tracon_TraconContentProtectionExtensions_AddContentProtection__1_Tracon_ITraconBuilder_"></a> AddContentProtection<TProtector\>\(ITraconBuilder\)

Registers your own [IContentProtector](/api/tracon.icontentprotector/) implementation.

```csharp
public static ITraconBuilder AddContentProtection<TProtector>(this ITraconBuilder builder) where TProtector : class, IContentProtector
```

#### Parameters

`builder` [ITraconBuilder](/api/tracon.itraconbuilder/)

The configuration chain.

#### Returns

 [ITraconBuilder](/api/tracon.itraconbuilder/)

The chain, for further configuration.

#### Type Parameters

`TProtector` 

The protector type.

#### Remarks

[TraconContentProtectionOptions.Columns](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Columns) still governs
which columns are protected, whichever implementation is registered;
only the actual protect/unprotect logic is replaced.

#### Exceptions

 [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception)

`builder` is [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null).