PHASE D / CORE ARCHITECTURE

Privacy Perimeter

Privacy is an architecture: classify information before deciding which tool or model may receive it.

Humansets privacy policy

Dataclassified before use

Toolallowed by policy

Modelreceives scoped data

Evidenceoutput shows what was shared

IMPLEMENTATION

Build a privacy envelope where data is classified before use

Use explicit privacy classes, an allowlist/deny list, and classification at every boundary.

Define privacy classes

Use P0 public, P1 local-safe, P2 trusted-local, P3 approved-cloud, P4 manual-only, P5 no-AI.

Create an allowlist

Explicitly permit data, tools, models, and actions; default deny.

Apply at the boundary

Check classification before every tool invocation or model call.

Log decisions

Record what was shared, with whom, why, and when—without exposing secrets.

Review drift

Re-evaluate classifications when model, provider, or task changes.

STRUCTURED REFERENCE

Privacy classes

| Class      | Meaning                     | Default access                |
|------------|-----------------------------|-----------------------------|
| P0-public  | Safe to publish             | Any human or model            |
| P1-local-safe| Ordinary private working material | Approved local model only   |
| P2-trusted-local| Personal/system data       | Hermes and explicitly trusted local agents |
| P3-approved-cloud| Selected files for a cloud task | Explicit allowlist only   |
| P4-manual-only| Highly private people, investigations, journals, raw sessions | Human review before every AI use |
| P5-no-ai   | Secrets, credentials, private keys, auth/cookies | No AI ingestion; references only |

FAILURE MODES

Common pitfalls and mitigations

Assuming local models are safe

Apply the same privacy ceiling to local models as to cloud models.

Using bulk classification

Classify per item; never trust a whole folder or vault.

Logging secrets

Redact exposed values as [REDACTED] and rotate if disclosure occurred.

Copyable public prompt

Classify [FILE LIST] P0–P5 and produce minimum access, an allowlist, and a deny list. Never print secrets.

Public boundary

Use placeholders for paths, accounts, endpoints, identities, and credentials. Never publish secret values, private records, or a live control surface.

Verification gate

Verify scope and inputs
Run a focused test
Check outputs and evidence
Confirm no private data leaked