When someone else queries your personal AI, what does it say? The question is not hypothetical. The answer depends on whether your AI has a disclosure policy or just instructions.
You gave your personal AI everything. Your email history. Your calendar. Your messages. Your salary, your health, your closest relationships. You did this because a personal AI that knows your full life is genuinely more useful than one that starts from zero each session.
Here is the question that follows from that: when someone else asks your AI something, what does it say?
Not you. Someone else. A colleague who shares a ChatGPT instance. A family member with access to the same Claude account. An application that queries your AI via a connected tool. Your employer, if your AI is provisioned through a company subscription. A renderer LLM that another AI assistant dispatches on your behalf.
The list of "someone else" scenarios is longer than it first appears. And for most personal AI systems, the answer to "what does it say?" is: whatever you told it not to say. Which is different from: whatever it has been instructed not to disclose.
The standard architecture for controlling AI output is a system prompt. You add instructions: "Do not share information about my salary." "Do not discuss my health conditions." "Keep my personal relationships private." The model reads these instructions and tries to follow them.
This is meaningfully different from a disclosure policy.
Instructions are requests to a model. A model that tries to follow instructions is not the same as a system that enforces a rule. The difference matters in adversarial conditions, edge cases, and prompt injection scenarios. A skilled user who wants to extract your salary can craft a query that circumvents your instructions. The model tries to comply with the new framing because it has no ground truth to check against. It was not told your salary is confidential; it was told not to share it, which is a softer constraint.
A disclosure policy is something else. It is a rule evaluated against a fact, not a guideline applied to an output. "Salary is not disclosed to employer-class recipients" is a policy. The evaluation happens before the model generates anything. The model never sees the query in the context where the answer is confidential; it sees a different version of the query, or it sees no query at all.
The structural question is not "does the model know not to share this?" It is "does the system have the concept of confidentiality encoded at the architecture layer, upstream of any model?"
There is a second problem that instructions do not solve: the confirmation problem.
If you tell your AI "do not tell anyone my salary" and someone asks it "does he earn more than $200,000 a year?", the model faces a choice. It can say "I cannot share that information," which confirms that information exists and is being withheld. It can say "I don't know," which may be false. Or it can fabricate a response that neither confirms nor denies.
A well-designed disclosure policy handles this without model judgment. The concept comes from a 1975 Supreme Court case: the CIA refused to confirm or deny whether documents existed, and the court held this was a valid response. The correct behavior for a personal AI when a confidential query arrives from an unauthorized recipient is not "I cannot tell you this." It is a response that is structurally indistinguishable from "I have nothing relevant to that query." Whether the information exists or not, the response looks the same from the outside.
This requires the disclosure policy to run before retrieval, not after generation. If the model has already retrieved your salary before deciding not to share it, the retrieval itself is a privacy exposure; the model has your compensation in its context window, and its behavior may leak that implicitly. The policy must intercept the query before it touches the corpus.
Mandaire implements disclosure as a deterministic engine that runs upstream of every query. Before any retrieval begins, the system evaluates four dimensions: who is asking, what they are asking about, what context the query arrives in, and which surface it comes through. The evaluation produces a decision (retrieve and respond, retrieve a constrained subset, or respond without retrieval) before the model sees anything.
The rules are explicit. Not prompt text. Code. A rule that says "employer-class recipients do not receive health information" is a conditional in a policy table, not a sentence in a system prompt. It evaluates consistently. It does not depend on how the question is phrased. It does not have off days.
This means the privacy guarantee is structural, not behavioral. A behavioral guarantee says "the model will try to protect this." A structural guarantee says "the model cannot see this in the context where the rule applies." These are different categories of assurance.
The architecture question becomes more complicated when you use multiple AI assistants. If your knowledge graph is shared via an MCP endpoint, an API, or a common tool, then each connected AI is a potential query path. Each has different prompt behavior. Each may be operated by different parties. Each may be queried by third-party applications you did not configure.
A disclosure policy that lives in the knowledge graph, not in any individual AI assistant, handles this. The policy runs at the data layer. Every AI that queries the data layer encounters the same policy, regardless of what model it runs, what instructions it was given, or who is querying it. The guarantee is at the substrate, not the surface.
This is the architecture Mandaire uses. The MCP endpoint is designed to evaluate the disclosure policy before returning any result. For enforced policy classes, the caller (Claude Desktop, ChatGPT, Gemini, or any renderer LLM) receives an already-filtered response. It cannot query the restricted corpus for those classes. For enforced policy classes (including health information and employer-class recipients, which are red-team verified), it cannot bypass the policy by rephrasing the query. The policy is not in the caller's context. It is in the infrastructure the caller reads from.
Personal AI is moving toward a model where your AI context is queryable by other systems: your employer's AI, a healthcare AI, a financial AI, an AI assistant in a product you use. MCP has made this easier to build. It has also made the disclosure question more urgent.
The default posture for a personal AI system without a disclosure architecture: every caller with access to the data layer sees everything the owner sees. The burden of access control falls on each caller individually, which means it is only as reliable as the least disciplined caller in the chain.
The correct posture is a policy enforced at the data layer. The architecture ensures that callers receive a view filtered to their recipient class for all enforced policy categories, starting with the highest-risk classes (health information and employer-class disclosures, which are red-team verified), and that guarantee holds regardless of how the query is framed or which model is asking.
The full architecture is described in the Mandaire specification. The disclosure engine implementation is available to renderer LLMs via the .dev API.