diff --git a/scripts/public-repo-guard/body-policy.sh b/scripts/public-repo-guard/body-policy.sh
index a0b421f..66a4f28 100755
--- a/scripts/public-repo-guard/body-policy.sh
+++ b/scripts/public-repo-guard/body-policy.sh
@@ -49,10 +49,19 @@ check() {
   # Filter with rg, not grep: BSD/macOS grep has no -P, so a `grep -P` allowlist
   # silently errors out locally while working on GNU/CI — the gate would then
   # disagree with itself depending on where it ran. rg is already required above.
+  # Credential and private-key formats are never allowlisted: a real secret must
+  # still block even when it appears in a policy example or an exempt line.
   local matches
-  matches="$(printf '%s' "$raw" \
-    | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \
-    | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
+  case "$name" in
+    stripe-live-key|stripe-account|anthropic-key|github-pat|supabase-pat|aws-akid|private-key)
+      matches="$raw"
+      ;;
+    *)
+      matches="$(printf '%s' "$raw" \
+        | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \
+        | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
+      ;;
+  esac
   [[ -z "$matches" ]] && return 0
   local count; count="$(printf '%s\n' "$matches" | grep -c '')"
   # Print the LINE NUMBER only — never the matched text. This annotation is itself
diff --git a/scripts/public-repo-guard/tests/body-policy.test.sh b/scripts/public-repo-guard/tests/body-policy.test.sh
index 13cc9bf..0ab3945 100755
--- a/scripts/public-repo-guard/tests/body-policy.test.sh
+++ b/scripts/public-repo-guard/tests/body-policy.test.sh
@@ -57,6 +57,8 @@ expect 1 'internal-only marker' \
 AKID_FIXTURE="AKI""A1234567890ABCDEF"
 expect 1 'AWS access key id' \
   "The failing job had ${AKID_FIXTURE} configured."
+expect 1 'allowlisted AWS access key id still blocks' \
+  "Example key: ${AKID_FIXTURE} — guard:allow documented-example"
 expect 1 'internal tailscale IP' \
   'It resolves to 100.71.4.19 from inside the fleet.'