See what crosses the cloud boundary.
Open a ZIP locally, stop secret-bearing and build-output files before transfer, then package only the approved remainder.
File motion is computed from the archive result. Red packets stop locally; approved packets cross toward the cloud-tool boundary.