Why generated files need their own step#
Chat responses are restored as they stream; a generated file is different — it is an artifact the user will download, forward, and file. If tokens survived into that artifact, the user would receive a letter addressed to PERSON_81af. So the Workspace treats generation as a two-stage act: the external model composes the content (over tokens, the only thing it has), and Salus completes it (restoring approved values) inside your perimeter, before the file is rendered into its final format and handed over.
The same rules as everywhere else#
Restoration into a file is not a special privileged path. Each token is resolved through the same vault lookup, subject to the same per-class policy — a class marked never-restore stays tokenized in the generated document too, deliberately — and every restoration is an audited event. If a mapping cannot be resolved, the conservative default applies: the file is held rather than delivered half-restored.
What this enables#
Report drafting, customer correspondence, case summaries, document transformation — workflows where the output must contain the real names, numbers, and references to be useful. The external provider's contribution is structure and language; the sensitive substance enters the document only inside your environment. It is the tokenization round trip, extended one format further: not just answers about your data, but deliverables built from it — with the same boundary intact, on the same Salus Engine.