You gave your AI everything. Your messages, your calendar, your salary, your relationships. The question is not whether it knows these things. The question is what it says to other people.
The useful AI is the one with your full context. That is not a marketing line; it is a constraint. An AI with partial context gives partial answers. An AI that knows your calendar but not your commitments, your contacts but not your relationship history, your messages but not which ones actually mattered to you: that AI is doing its best with incomplete inputs, and the outputs reflect it.
So you give it everything. And then a colleague connects to your AI and asks about the project you are both working on. Fine. Your manager connects and asks how you are feeling about your workload. Less fine. Your friend asks if you got the promotion. Not fine at all.
This is the real problem. Not whether the AI can hold your context. Whether you can trust what it does with it.
The obvious answer is to instruct the AI not to share sensitive information. Tell it that salary is private. Tell it health history is off-limits. Set a system prompt that sounds careful and thorough.
The problem with instructions is that they are requests. A language model that has been instructed not to share your salary is a model that will usually not share your salary. It is not a model that structurally cannot share your salary. The difference matters.
Instructions drift between sessions. They can be reasoned around. A patient person with the right framing can often get a model to discuss things it was told not to discuss. The instruction lives in the same channel as everything else, and any message in that channel can move it.
There is also a subtler problem. If your AI knows something about you and you ask it not to say so, a careful non-answer is itself an answer. When someone asks your AI about your health and it responds with unusual vagueness, the vagueness confirms something. When it says "I'd rather not discuss that," the refusal tells them the topic exists. A hesitant non-answer and a confident one land differently, and a person who notices that difference has already learned something.
Instructing an AI not to share is a request. The only structural solution is a gate that runs before the model sees the query.
The structural fix is to move the decision upstream. Before the model sees the query. Before it reads the context. Before it composes anything.
A rules engine evaluates each query against four things: who is asking, what they are asking about, what context this is (a message, an email draft, a casual question), and which surface the query is coming from. It does not read the content of the question to make this determination. It reads the identity of the requester and the structure of the query, then applies compiled rules that were set in advance.
When the gate holds something, it returns a response that is identical in length and timing to a response where there is genuinely nothing to share. The person asking cannot distinguish "I have nothing on this" from "I have something and am not sharing it." That is not evasion. It is the correct behavior. Evasion leaks information. Indistinguishable responses do not.
This is the property that instructions cannot produce. A language model's response is shaped by what it knows. A rules engine's response is shaped by what the rules say, before any model is involved.
Here is what the gate log looks like when a recipient queries a topic they are not cleared to see. [J.] has access to project information and can query Mandaire freely on shared work. When [J.] asks about compensation, the gate evaluates the query before any model is involved.
Disclosure gate log: representative format
Two things to notice. First, the decision was made before any model was invoked, by code, with no AI involved in the hold. Second, the log tells you exactly what was blocked, why, and what to change if the rule is wrong. The gate is not a black box. It is auditable. You can read every decision it made.
When [J.] asks about the project they share with the user, they get a useful, complete answer. When they ask about compensation, they get a response that is not evasive, not hesitant, just the same shape of response they would get if Mandaire genuinely had nothing on the topic. The indistinguishability is deliberate.
An AI that knows when to hold something and produces a different-shaped response when it does is doing disclosure wrong. The difference in shape is the disclosure. The only correct behavior is one where a hold is invisible: same response time, same length, same confidence level. Achieved not by prompting the model to sound confident when holding, but by removing the hold decision from the model entirely.
Every external query hits the disclosure gate before it reaches any language model. The gate evaluates per-(recipient, topic, context, surface) using a compiled rule hierarchy. Holds and genuine unknowns return byte-equal responses. The decision is logged. The model never sees what was gated.
This is not a configuration option on top of an existing AI. It is a separate layer of code that runs upstream of inference. You cannot replicate it by adding a careful system prompt to Claude or ChatGPT, because those models are the layer the gate runs before. The gate position is the structural property; everything else follows from it.
The real production artifacts are on mandaire.app/proof, including the disclosure-checked draft from one founder's actual account. The gate log above uses the same structure with representative field values; the real verbatim artifacts, including dated gate decisions, are on that page.
The full specification of how the disclosure engine works, including the per-(recipient, topic, context, surface) evaluation model and the indistinguishability properties, is on mandaire.org.
Read the architecture →