The unleakable context

Every multi-agent product faces the same ordinary hard problem: keep a private thing private while shared collaboration happens around it. Two decades of web software trained one instinct for it. Give every actor access to the store, attach a permission check, and make sure the check is correct. Ask “may this shared agent read the private domain?” on every read, and answer no.

That is behavioral privacy, and it inherits behavioral safety’s arithmetic. The check must be evaluated correctly on every query, forever, across every code path that reaches the data, by guards that include, increasingly, models that can be argued with. The stress-test literature has priced what instructions are worth under pressure, an explicit prohibition cutting a harmful behavior to a third rather than to zero, and a permission check is an instruction with better typography. One bug, one injection, one persuaded actor, and the private domain has been public all along.

The alternative inverts the design. Do not guard the read path; decline to build it. A person-scoped actor holds the access its owner’s service requires, and actors outside that domain have no route to the context at all, not a forbidden route, no route. What cannot be read cannot be leaked, exfiltrated, or socially engineered, because there is nothing for the failure to use. The existence proof that this posture survives contact with adversaries is Signal’s subpoena record. Asked by a grand jury for user data, Signal produced an account creation date and a last connection time, not because its lawyers were brave but because its architecture possessed nothing else to produce. The boundary held against legal compulsion for the same reason it holds against bugs: absence has no failure rate.

In our own architecture the same posture is the domain lock. A domain-locked design eliminates cross-domain read, projection, and egress paths rather than mitigating them, and sharing still happens, the one way it honestly can: a person deliberately carries a thing across the boundary, an act that is visible, attributable, and theirs. The guarded version of this system asks its checks to be perfect forever. The locked version asks its compiler to refuse a path once. Only one of those requests has ever been reliably granted. Grant it, and the guarantee compounds. Context that cannot leave its domain can finally be trusted with more, and trust extended to structure rather than to promises is the one kind that scales.