# TraconContentProtectionOptions

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.traconcontentprotectionoptions/
> Summary: TraconContentProtectionOptions: Settings for at-rest content protection.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Core.dll</code></div>

Settings for at-rest content protection.

```csharp
public sealed class TraconContentProtectionOptions
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.traconcontentprotectionoptions/">TraconContentProtectionOptions</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

Always registered, but [TraconContentProtectionOptions.Enabled](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Enabled) defaults to
[false](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool): without `AddContentProtection(...)`,
nothing is encrypted and every store behaves exactly as it does today.

[TraconContentProtectionOptions.Keys](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Keys) never carries a key's raw material — it maps a key id
to the **name** of another configuration key the raw value
is read from at run time, the same indirection Tracon uses elsewhere
for provider credentials. The example below shows both: the
`ContentProtection` section names `ContentProtectionKeys:2026-08`,
and that key holds the actual value — set through
`dotnet user-secrets`, never committed to `appsettings.json`.

```json
"Tracon": { "ContentProtection": {
  "Enabled": true,
  "ActiveKeyId": "2026-08",
  "Keys": { "2026-08": "ContentProtectionKeys:2026-08" }
}},
"ContentProtectionKeys": { "2026-08": "<32-byte base64 key>" }
```

## Constructors

### <a id="Tracon_TraconContentProtectionOptions__ctor"></a> TraconContentProtectionOptions\(\)

```csharp
public TraconContentProtectionOptions()
```

## Fields

### <a id="Tracon_TraconContentProtectionOptions_SectionName"></a> SectionName

The configuration section this type binds to.

```csharp
public const string SectionName = "Tracon:ContentProtection"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

## Properties

### <a id="Tracon_TraconContentProtectionOptions_ActiveKeyId"></a> ActiveKeyId

Gets or sets the key id new writes are protected with.

```csharp
public string? ActiveKeyId { get; set; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)?

#### Remarks

Must be a key of [TraconContentProtectionOptions.Keys](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Keys) when [TraconContentProtectionOptions.Enabled](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Enabled) is [true](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool).

### <a id="Tracon_TraconContentProtectionOptions_Columns"></a> Columns

Gets the set of columns protection applies to. Defaults to all of them.

```csharp
public ISet<ProtectedColumn> Columns { get; }
```

#### Property Value

 [ISet](https://learn.microsoft.com/dotnet/api/system.collections.generic.iset\-1)<[ProtectedColumn](/api/tracon.protectedcolumn/)\>

#### Remarks

In configuration, a list of [ProtectedColumn](/api/tracon.protectedcolumn/) names
(`Columns:0 = "RunInput"`, matched case-insensitively). A list that is
present replaces the default.

An entry that is not a [ProtectedColumn](/api/tracon.protectedcolumn/) name — a misspelling, an
empty entry, an undefined number — stops the application at startup with an
`Options.OptionsValidationException` that
names the entry as written, whether [TraconContentProtectionOptions.Enabled](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Enabled) is on or off. Such
an entry used to be skipped, and the column the operator meant stayed in plain
text. An undefined value added in code stops the application too; code that
rewrites the set after binding replaces the configured entries.

### <a id="Tracon_TraconContentProtectionOptions_Enabled"></a> Enabled

Gets or sets a value indicating whether the content protection ring is added to the pipeline.

```csharp
public bool Enabled { get; set; }
```

#### Property Value

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)

### <a id="Tracon_TraconContentProtectionOptions_Keys"></a> Keys

Gets the map from a key id to the name of the configuration key its raw
material is read from.

```csharp
public IDictionary<string, string> Keys { get; }
```

#### Property Value

 [IDictionary](https://learn.microsoft.com/dotnet/api/system.collections.generic.idictionary\-2)<[string](https://learn.microsoft.com/dotnet/api/system.string), [string](https://learn.microsoft.com/dotnet/api/system.string)\>

#### Remarks

An entry stays here for as long as any stored value still carries its
key id — removing it makes those values unreadable
([TraconException](/api/tracon.traconexception/), naming the missing key id).

An entry with an empty name stops the application at startup with an
`Options.OptionsValidationException` that names
the key id, also while [TraconContentProtectionOptions.Enabled](/api/tracon.traconcontentprotectionoptions/#Tracon_TraconContentProtectionOptions_Enabled) is [false](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool): an old
row is still decrypted through this map after protection is turned off.