# `AshReplicant.Resource.Verifiers.ValidateSensitive`
[🔗](https://github.com/baselabs/ash_replicant/blob/v0.3.0/lib/ash_replicant/resource/verifiers/validate_sensitive.ex#L1)

Compile-verifier for `replicant do sensitive [...] end` (surfaced as a Spark
diagnostic; build-blocking under `--warnings-as-errors`).

Every name in `sensitive` must resolve to a real encrypted / binary write
target, or be excluded — otherwise the mirror writes the classified column as
plaintext. A name passes if it is any of:

- **(a)** an AshCloak cloak attribute (`name in AshCloak.Info.cloak_attributes!/1`),
  guarded to resources that actually use AshCloak;
- **(b)** a declared attribute whose storage type is `:binary`
  (`Ash.Type.storage_type(type, constraints) == :binary`); or
- **(d)** listed in `skip` (never written).

Otherwise it fails closed. This checks the TYPE SHAPE, not ciphertext —
encrypting is the host resource's (AshCloak's) job. Messages are value-free:
they name schema structure (column/attribute names), never a row value.

AshCloak is the single source of truth for encryption: a hand-rolled
`encrypted_<name>` attribute WITHOUT AshCloak is NOT accepted — there is no
encryptor the verifier can confirm, and `AshReplicant.Resolver` would mirror
the column as plaintext (it routes to `encrypted_<name>` only for real AshCloak
cloak attributes), so blessing that shape would leak plaintext.

---

*Consult [api-reference.md](api-reference.md) for complete listing*