Topic · DiggingBeagle record
Contextual disclosure boundary
An agent may be authorized to read information for a task but not to send each fact to every destination or participant in the workflow.
- Topic kind
- pattern
Definition & limits
A disclosure boundary governs information by origin, recipient, purpose and time, not simply by whether a string is marked secret. An employee-facing agent may be allowed to read a support ticket while prohibited from sending its private contents to an unrelated customer. The decisive evidence is the exact field that left, the destination and the authority that permitted that transfer. A correct final answer can still contain an unauthorized disclosure.
This concept spans different mechanisms that should not be collapsed. In the ChatGPT MathLive case, a public share was a route to script execution in an authenticated browser origin; the researcher demonstrated retrieval of an unrelated private conversation. In Chainalysis, successive first-party notices changed the scope of an observed breach from customer identifiers to password hashes and live tokens. That is a changing incident fact, not a finding that every exposed session was subsequently used. The precise exposure and the later use of the exposed capability require separate proof.
Google's Gemini API policy illustrates a third category, authorized collection with a distinct downstream use. Developer-owned logs from relevant paid projects have a 55-day default marking-for-deletion period; saved datasets may outlive it. Sharing a dataset for model training requires its own participation decision, which is different from an API call being stored for the developer's use. No breach is shown by this policy. The appropriate review maps collection, storage, viewer, secondary use, revocation and expiry separately, and verifies the actual destination service rather than relying on an agent's confidentiality promise.
Examples
- A scheduling assistant includes a confidential medical or hiring detail in an email to a colleague who only needed the meeting time.
- A workspace agent copies an internal customer preference into a third-party booking field even when that field is unnecessary for the task.