@@ -8,11 +8,11 @@
 )
 from uipath.core.tracing import traced
 
-from uipath.platform.constants import HEADER_GUARDRAILS_SOURCE
+from uipath.platform.constants import HEADER_FOLDER_KEY, HEADER_GUARDRAILS_SOURCE
 
 from ..chat.llm_trace_context import build_trace_context_headers
 from ..common._base_service import BaseService
-from ..common._config import UiPathApiConfig
+from ..common._config import UiPathApiConfig, UiPathConfig
 from ..common._execution_context import UiPathExecutionContext
 from ..common._job_context import header_job_key
 from ..common._models import Endpoint, RequestSpec
@@ -28,25 +28,6 @@
 _ATTACHMENT_VALIDATE_TIMEOUT_SECONDS = 60.0
 
 
-def _redact_attachment_urls(inputs: dict[str, Any]) -> dict[str, Any]:
-    """Strip SAS urls from the traced inputs of ``evaluate_guardrail``.
-
-    ``@traced`` records a function's arguments on the span by default. An attachment
-    ``url`` is a short-lived SAS credential and must never reach telemetry, so replace
-    it and keep the rest (guardrail, input, attachment identity) intact.
-    """
-    attachments = inputs.get("attachments")
-    if not isinstance(attachments, list):
-        return inputs
-    redacted = []
-    for attachment in attachments:
-        if isinstance(attachment, dict) and "url" in attachment:
-            redacted.append({**attachment, "url": "<redacted>"})
-        else:
-            redacted.append(attachment)
-    return {**inputs, "attachments": redacted}
-
-
 # x-uipath-traceparent-id header format: {version}-{trace_id}-{span_id}[-{trace_flags}]
 # Based on W3C traceparent but allows 16- or 32-hex span IDs.
 _TRACEPARENT_PATTERN = re.compile(
@@ -125,9 +106,7 @@ def _parse_result(result_str: str) -> GuardrailValidationResultType:
                 # Fallback to validation_failed if unknown
                 return GuardrailValidationResultType.VALIDATION_FAILED
 
-    @traced(
-        "evaluate_guardrail", run_type="uipath", input_processor=_redact_attachment_urls
-    )
+    @traced("evaluate_guardrail", run_type="uipath")
     def evaluate_guardrail(
         self,
         input_data: str | dict[str, Any],
@@ -179,11 +158,18 @@ def evaluate_guardrail(
         execution_source = self._execution_context.execution_source
         if execution_source:
             source_headers[HEADER_GUARDRAILS_SOURCE] = execution_source
+        # When attachments are present, tell helix which folder the run executed in
+        # so it can resolve each attachment id through Orchestrator's folder-scoped
+        # API. Only sent alongside attachments: it is meaningless otherwise.
+        folder_headers: dict[str, str] = {}
+        if attachments and UiPathConfig.folder_key:
+            folder_headers[HEADER_FOLDER_KEY] = UiPathConfig.folder_key
         request_headers = {
             **(spec.headers or {}),
             **trace_headers,
             **source_headers,
             **header_job_key(),
+            **folder_headers,
         }
         # The default client timeout is 30s (common/_http_config.py). A validate call
         # carrying attachments waits for the backend to fetch and decode each one, so give
 
@@ -97,25 +97,28 @@ class BuiltInValidatorGuardrail(BaseGuardrail):
 
 
 class GuardrailAttachment(BaseModel):
-    """A file attached to the run that a guardrail may inspect.
+    """A reference to a file attached to the run that a guardrail may inspect.
 
     Passed to [`GuardrailsService.evaluate_guardrail`][uipath.platform.guardrails.GuardrailsService.evaluate_guardrail]
     so the guardrails backend can read the file's contents rather than only its metadata.
 
+    Only the Orchestrator attachment id crosses the wire: helix resolves it through
+    its own Orchestrator client (folder-scoped when the run's folder key is sent
+    alongside), so Orchestrator's access control is what decides whether the file can
+    be read — the runtime never resolves or forwards a signed URL itself.
+
     Attributes:
-        id: The job attachment id, as a string UUID. Used by the backend as an
-            extraction cache key and for trace correlation.
+        id: The Orchestrator attachment id, as a string UUID. Used by the backend to
+            resolve the file through Orchestrator, as an extraction cache key, and for
+            trace correlation.
         file_name: Original file name, shown to a judge model so it can name the
             offending file.
         mime_type: Original mime type. The backend decides what it can inspect.
-        url: A short-lived SAS URL resolved by the runtime. This is a **credential**:
-            never log it, never put it on a span.
     """
 
     id: str
     file_name: str = Field(alias="fileName")
     mime_type: str = Field(alias="mimeType")
-    url: str
 
     model_config = ConfigDict(populate_by_name=True)
 
 
@@ -922,7 +922,6 @@ def _attachment() -> GuardrailAttachment:
         id=_ATTACHMENT_ID,
         file_name="Tickets.csv",
         mime_type="text/csv",
-        url="https://acct.blob.core.windows.net/c/Tickets.csv?sig=x",
     )
 
 
@@ -953,7 +952,6 @@ def test_attachments_are_sent_with_camel_case_aliases(
                 "id": _ATTACHMENT_ID,
                 "fileName": "Tickets.csv",
                 "mimeType": "text/csv",
-                "url": "https://acct.blob.core.windows.net/c/Tickets.csv?sig=x",
             }
         ]
 
@@ -1000,7 +998,6 @@ def test_attachment_round_trips_the_wire_shape(self) -> None:
             "id": _ATTACHMENT_ID,
             "fileName": "a.csv",
             "mimeType": "text/csv",
-            "url": "https://x/a.csv",
         }
 
         parsed = GuardrailAttachment.model_validate(wire)
@@ -1010,48 +1007,77 @@ def test_attachment_round_trips_the_wire_shape(self) -> None:
         assert parsed.model_dump(by_alias=True) == wire
 
 
-class TestGuardrailAttachmentTracing:
-    """The traced span must never carry an attachment's SAS url."""
+class TestGuardrailAttachmentFolderHeader:
+    """evaluate_guardrail tells helix which folder the run executed in so it can
+    resolve each attachment id through Orchestrator's folder-scoped API."""
 
-    def test_input_processor_redacts_urls_and_keeps_identity(self) -> None:
-        from uipath.platform.guardrails._guardrails_service import (
-            _redact_attachment_urls,
+    def test_folder_header_sent_when_folder_key_configured(
+        self,
+        httpx_mock: HTTPXMock,
+        service: GuardrailsService,
+        base_url: str,
+        org: str,
+        tenant: str,
+        monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        monkeypatch.setenv("UIPATH_FOLDER_KEY", "folder-key-123")
+        httpx_mock.add_response(
+            url=f"{base_url}{org}{tenant}{_VALIDATE_PATH}",
+            status_code=200,
+            json={"result": "PASSED", "details": ""},
         )
 
-        inputs = {
-            "input_data": "see attached",
-            "guardrail": {"name": "Injection check"},
-            "attachments": [
-                {
-                    "id": _ATTACHMENT_ID,
-                    "fileName": "Tickets.csv",
-                    "mimeType": "text/csv",
-                    "url": "https://acct.blob.core.windows.net/c/Tickets.csv?sig=SECRET",
-                }
-            ],
-        }
+        service.evaluate_guardrail("x", _judge_guardrail(), attachments=[_attachment()])
 
-        processed = _redact_attachment_urls(inputs)
+        request = httpx_mock.get_requests()[0]
+        assert request.headers["x-uipath-folderkey"] == "folder-key-123"
 
-        assert "SECRET" not in json.dumps(processed)
-        assert processed["attachments"][0]["url"] == "<redacted>"
-        assert processed["attachments"][0]["fileName"] == "Tickets.csv"
-        assert processed["input_data"] == "see attached"
-        # Never mutates the caller's dict.
-        assert "SECRET" in json.dumps(inputs)
+    def test_folder_header_absent_when_no_folder_key_configured(
+        self,
+        httpx_mock: HTTPXMock,
+        service: GuardrailsService,
+        base_url: str,
+        org: str,
+        tenant: str,
+        monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        monkeypatch.delenv("UIPATH_FOLDER_KEY", raising=False)
+        httpx_mock.add_response(
+            url=f"{base_url}{org}{tenant}{_VALIDATE_PATH}",
+            status_code=200,
+            json={"result": "PASSED", "details": ""},
+        )
+
+        service.evaluate_guardrail("x", _judge_guardrail(), attachments=[_attachment()])
 
-    def test_input_processor_is_a_noop_without_attachments(self) -> None:
-        from uipath.platform.guardrails._guardrails_service import (
-            _redact_attachment_urls,
+        request = httpx_mock.get_requests()[0]
+        assert "x-uipath-folderkey" not in request.headers
+
+    def test_folder_header_absent_without_attachments_even_if_configured(
+        self,
+        httpx_mock: HTTPXMock,
+        service: GuardrailsService,
+        base_url: str,
+        org: str,
+        tenant: str,
+        monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        """The header is meaningless without attachments, so it is never sent."""
+        monkeypatch.setenv("UIPATH_FOLDER_KEY", "folder-key-123")
+        httpx_mock.add_response(
+            url=f"{base_url}{org}{tenant}{_VALIDATE_PATH}",
+            status_code=200,
+            json={"result": "PASSED", "details": ""},
         )
 
-        inputs = {"input_data": "x", "guardrail": {}}
+        service.evaluate_guardrail("x", _judge_guardrail())
 
-        assert _redact_attachment_urls(inputs) == inputs
-        assert _redact_attachment_urls({**inputs, "attachments": None}) == {
-            **inputs,
-            "attachments": None,
-        }
+        request = httpx_mock.get_requests()[0]
+        assert "x-uipath-folderkey" not in request.headers
+
+
+class TestGuardrailAttachmentTiming:
+    """Attachments still get the longer, file-fetching-aware timeout."""
 
     def test_evaluate_guardrail_forwards_a_longer_timeout_with_attachments(
         self,