> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://rivet.chrisboulton.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://rivet.chrisboulton.com/_mcp/server.

# Metadata and sensitivity

> Common policy applies inside one meta block on every resource.

Metadata is separate from resource-specific fields. Use at most one unlabelled `meta` block:

```hcl
file "config" {
  path    = "/etc/app-config"
  content = "managed\n"

  meta {
    description = "Application configuration"
    tags        = ["application", "configuration"]
    sensitive   = true
    noop        = false
    timeout     = "30s"
  }
}
```

| Field         | Default          | Behavior                                                               |
| ------------- | ---------------- | ---------------------------------------------------------------------- |
| `depends_on`  | Empty            | List of prerequisite handles.                                          |
| `before`      | Empty            | List of handles ordered after this resource.                           |
| `notify`      | Empty            | Request target refresh after this resource verifies a change.          |
| `subscribe`   | Empty            | Request this resource's refresh after listed sources change.           |
| `description` | Omitted          | Optional string describing intent.                                     |
| `tags`        | Empty            | List of strings, normalized to a set; no CLI tag-filter option exists. |
| `noop`        | `false`          | Inspect/predict this resource without mutating it.                     |
| `sensitive`   | `false`          | Mark this resource and assets as sensitive.                            |
| `timeout`     | Resource default | Positive integer duration in `ms`, `s`, `m`, or `h`, at most 24 hours. |

Metadata booleans require booleans, not null or string equivalents. A resource's deadline includes inspection, guards, mutation, subprocesses, and verification. Refresh gets a separate deadline. Native operations check deadlines between steps; an uninterruptible kernel call cannot be forcibly cancelled.

Default budgets are 60 seconds for files/users/groups/group memberships/SSH keys, 300 seconds for packages/exec/mounts, and 120 seconds for services/timers.

[Module metadata](/guides/modules#ordering-boundaries) is a narrower contract: depends_on, before, noop, tags, literal description, and notify. Module noop and tags inherit; subscribe, timeout, and sensitive are rejected on modules.

## Sensitivity

Sensitivity propagates through variables, locals, interpolation, references, outputs, and assets. Deduplicated assets keep the strongest annotation. Password hashes are intrinsically sensitive even when `meta.sensitive = false`.

Sensitive command output is omitted. Diagnostics report safe categories and source locations, without source excerpts or evaluated values. Reports/journals expose changed property names and digests rather than file content or password hashes. Successful nonsensitive exec output is an explicit exception: it can appear in JSON and stored final reports.

Sensitivity is not encryption. Bundles can contain plaintext secrets and root output values. They are published with mode 0600; keep configuration, facts, bundles, and copies appropriately private.

Every resource handle exposes `meta.sensitive`; it reflects intrinsic sensitivity as well as declared policy. A false annotation cannot declassify a sensitive value. `sensitive`, `nonsensitive`, and `issensitive` provide [explicit value policies](/language/functions/conversion); `nonsensitive` removes value sensitivity recursively while retaining dependencies. Password-hash resource fields reassert their intrinsic sensitivity; RSA decryption initially marks its result sensitive. SOPS layers automatically mark supplied variables sensitive, even when later replaced by plaintext inputs.