diff --git a/app/models.py b/app/models.py
index 2924c39..c9b9661 100644
--- a/app/models.py
+++ b/app/models.py
@@ -112,6 +112,27 @@ async def get_all_rules() -> Dict[str, Any]:
             rows = await cursor.fetchall()
             return {row[0]: json.loads(row[1]) for row in rows}
 
+RESTRICTED_KEY = "_agent_only"
+
+def filter_content_for_agent(content: Optional[Dict[str, Any]], agent_name: str) -> Optional[Dict[str, Any]]:
+    """
+    Retire du contenu d'un scope les cles marquees reservees a une liste precise
+    d'agents (metadonnee "_agent_only": {cle: [AGENTS...]} dans le JSON stocke).
+    Sert a eviter le bruit non pertinent (ex: pieges mcp-nas, outil exclusif a
+    Claude, envoyes sans filtrage a Gemini/Hermes). Ne modifie jamais le contenu
+    stocke en base -- uniquement la copie renvoyee au consommateur. Sync (pas
+    d'IO), safe a appeler juste apres n'importe quel get_rule/get_all_rules.
+    """
+    if not content or RESTRICTED_KEY not in content:
+        return content
+    filtered = dict(content)
+    restrictions = filtered.pop(RESTRICTED_KEY, {}) or {}
+    agent_upper = (agent_name or "").upper()
+    for key, allowed_agents in restrictions.items():
+        if key in filtered and agent_upper not in [a.upper() for a in allowed_agents]:
+            filtered.pop(key, None)
+    return filtered
+
 async def get_all_ports() -> List[Dict[str, Any]]:
     async with aiosqlite.connect(DB_PATH) as db:
         db.row_factory = aiosqlite.Row