{ "schema": "org-writing@v1", "slug": "unleakable-context", "kg": { "id": "org:writing:unleakable-context", "type": "brick", "graph": "/kg.json" }, "title": "The unleakable context", "subtitle": "What cannot be read cannot be leaked, subpoenaed, or socially engineered", "abstract": "Why the only private context that stays private is the context with no path out of its domain, with Signal's subpoena record as the existence proof. The canonical treatment of the domain lock.", "kind": "brick", "topics": [ "Safety", "Boundaries" ], "courseMemberships": [ { "course": "org:courses:safety", "topic": "Safety", "wall": "org:walls:engineering", "position": 7, "total": 11 }, { "course": "org:courses:boundary", "topic": "Boundaries", "wall": "org:walls:engineering", "position": 3, "total": 5 } ], "publishedAt": "2026-08-03T00:00:00.000Z", "version": 2, "guidelinesVersion": 15, "brief": { "problem": { "text": "Guarded access fails the way all behavioral safety fails, one bug or one persuaded actor at a time, and private context sits behind exactly such guards in nearly every multi-agent system shipping today.", "claims": [ "An explicit instruction not to blackmail" ] }, "mechanism": { "text": "A read path that does not exist has no failure rate; Signal under subpoena could produce only what it possessed, and a domain-locked architecture eliminates cross-domain reads rather than mitigating them.", "claims": [ "Signal's subpoena responses produced only account creation date", "A domain-locked agent architecture eliminates" ] }, "move": { "text": "Design the boundary as absence: scope every actor to its domain, and let shared spaces receive only what a person deliberately carried across.", "claims": [] } }, "sources": [ { "repo": "mnstry-org", "path": "src/content/writing/structural-not-behavioral.md" } ], "canonicalPath": "/writing/unleakable-context/", "body": "Every multi-agent product faces the same ordinary hard problem: keep a private thing private while shared collaboration happens around it. Two decades of web software trained one instinct for it. Give every actor access to the store, attach a permission check, and make sure the check is correct. Ask \"may this shared agent read the private domain?\" on every read, and answer no.\n\nThat is behavioral privacy, and it inherits behavioral safety's arithmetic. The check must be evaluated correctly on every query, forever, across every code path that reaches the data, by guards that include, increasingly, models that can be argued with. The stress-test literature has priced what instructions are worth under pressure, an explicit prohibition cutting a harmful behavior to a third rather than to zero, and a permission check is an instruction with better typography. One bug, one injection, one persuaded actor, and the private domain has been public all along.\n\nThe alternative inverts the design. Do not guard the read path; decline to build it. A person-scoped actor holds the access its owner's service requires, and actors outside that domain have no route to the context at all, not a forbidden route, no route. What cannot be read cannot be leaked, exfiltrated, or socially engineered, because there is nothing for the failure to use. The existence proof that this posture survives contact with adversaries is Signal's subpoena record. Asked by a grand jury for user data, Signal produced an account creation date and a last connection time, not because its lawyers were brave but because its architecture possessed nothing else to produce. The boundary held against legal compulsion for the same reason it holds against bugs: absence has no failure rate.\n\nIn our own architecture the same posture is the domain lock. A domain-locked design eliminates cross-domain read, projection, and egress paths rather than mitigating them, and sharing still happens, the one way it honestly can: a person deliberately carries a thing across the boundary, an act that is visible, attributable, and theirs. The guarded version of this system asks its checks to be perfect forever. The locked version asks its compiler to refuse a path once. Only one of those requests has ever been reliably granted. Grant it, and the guarantee compounds. Context that cannot leave its domain can finally be trusted with more, and trust extended to structure rather than to promises is the one kind that scales.", "apparatus": { "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.", "references": [ { "id": "org:references:unleakable-context:r01", "author": "Signal Foundation", "work": "Published grand jury subpoena responses (Eastern District of Virginia and subsequent)", "relevance": "The existence proof: an architecture that possessed only creation date and last connection time produced only that under compulsion." }, { "id": "org:references:unleakable-context:r02", "author": "Anthropic", "work": "Agentic misalignment stress tests (2025)", "year": 2025, "relevance": "What instructions are worth under pressure; the pricing of behavioral guards." } ], "claims": [ { "id": "org:claims:unleakable-context:c01", "claim": "An explicit instruction not to blackmail reduced blackmail from 96% to 37% of runs in Anthropic's 2025 agentic stress tests, not to zero.", "basis": "Anthropic's published agentic misalignment research; simulated settings, most-capable-model condition.", "confidence": "verified", "sources": [] }, { "id": "org:claims:unleakable-context:c02", "claim": "Signal's subpoena responses produced only account creation date and last connection time.", "basis": "Signal's published subpoena responses and transparency reporting.", "confidence": "verified", "sources": [] }, { "id": "org:claims:unleakable-context:c03", "claim": "A domain-locked agent architecture eliminates (rather than mitigates) cross-domain read paths.", "basis": "A property of the described architecture: the elimination is checkable in code, and the claim is scoped to read/projection/egress paths as designed.", "confidence": "verified", "sources": [] } ], "concepts": [ { "id": "org:concepts:domain-lock", "name": "Domain lock", "definition": "An agent's scope fixed at construction: a shared-domain agent has no read path into private domains, as an absence rather than a denial. Failure analysis becomes decidable by inspecting the agent's type.", "provenance": "canonical" } ], "researchContext": "Extracted from \"Structural, not behavioral\", which keeps the three-move arc.\nAll three claims are restated verbatim from the essay's apparatus. The\nabsence-has-no-failure-rate framing and the compiler-versus-forever contrast\nare the brick's contribution." }, "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json", "releaseHash": "8f543b0929dc7b59713d2805ba94ad2896b9a084b8ace4a1c1db911d6df7dd51", "versions": [ { "version": 2, "cutAt": "2026-08-03", "note": "Courses wave (operator-ratified): ending rewritten to ascend into the doors; the lift lands on the next threshold.", "visibility": "published", "path": "/writing/unleakable-context/", "contentHash": "sha256:03bf37e78035c8d6", "releaseHash": "8f543b0929dc7b59713d2805ba94ad2896b9a084b8ace4a1c1db911d6df7dd51" }, { "version": 1, "cutAt": "2026-08-03", "note": "Final brick wave: canonical treatment extracted under ontology v5 by operator instruction.", "visibility": "published", "path": "/writing/unleakable-context/v/1/", "contentHash": "sha256:009f08e18a13518d" } ] }