Thanks for your comments, concept is most of my concern.
I do tend to agree with you about the "allow" parameter, it fell in by accident while I was exploring some possibilities. I will take your comment as at least partial support for considering removal of that (mis)feature.
The "auto_get" option is a different kettle of fish though. That can allow you to pass a "Text::Hidden" object to a module that needs to actually use the data at some point (but may attempt to log its value at other points - I can restrict auto_get to a specific method or even a specific line of code). Using "auto_get" does break open the black box of the external module and may break things if the module reorganizes itself too much. On the one hand, it makes me a bit nervous to use such a feature, but on the other hand, I don't see how "Text::Hidden" could be useful if it did not allow passing usable instances into external code.
Update: On an additional reading, I do see that you had distinguished "allow" from "auto_get", but I still want to point out that access can be restricted more finely than by class name and that the only alternative to such an "auto_get" feature is passing the raw unmasked string to the external module. So, I guess my question for you (and others) is whether you would use the "auto_get" option at the method (or line number) level?