Privacy Mode (v0)

Modes

• allow (default): providers may return minimal necessary snippets; redact clearly sensitive spans.
• redact: providers must redact sensitive spans; ACS propagates redactions.
• block: providers must not return raw text; only IDs/metadata; ACS returns portals/navigation only.

Responsibilities

• Providers MUST honor privacy_mode in the request.
• ACS MUST avoid including raw sensitive text in fragments; prefer IDs/refs when block.

Contract touchpoints

• Request field: privacy_mode in render_request.v0 (allow | redact | block)
• Reply behavior: render_context_reply.v0
  • redact: fragments[].text may contain masked spans (e.g., "[REDACTED]")
  • block: fragments[].text SHOULD be an empty string or high-level label; use id to reference source
  • Optional: use kv_policy.pin for safe IDs to keep; avoid storing sensitive payloads

Examples

Render Request (privacy=redact)

{
	"version": "v0",
	"id": "5a2c63a0-0c75-4d53-8a2b-6e47a1b2c9d1",
	"intent": "summarize project onboarding doc",
	"budgets": { "tokens_max": 1200, "time_ms": 700 },
	"privacy_mode": "redact",
	"request_id": "req-2025-09-06-001"
}

Reply (redact): redacted spans preserved as placeholders

{
	"request_id": "req-2025-09-06-001",
	"fragments": [
		{
			"id": "layer:L2:onboarding#section-intro",
			"lod": "macro",
			"text": "Team contact: [REDACTED]; follow procedures in section 2.",
			"entities": ["onboarding", "contacts"],
			"cost_tokens": 128
		}
	],
	"kv_policy": { "pin": ["layer:L2:onboarding#section-intro"] },
	"metrics": { "used_tokens": 128, "planner_ms": 42, "coverage_entities": 0.5 }
}

Render Request (privacy=block)

{
	"version": "v0",
	"id": "b8e51d4a-2b8a-4c0b-9d91-f1b5a7d2e4c8",
	"intent": "list finance policies",
	"budgets": { "tokens_max": 800, "time_ms": 500 },
	"privacy_mode": "block",
	"request_id": "req-2025-09-06-002"
}

Reply (block): no raw text, only navigational IDs/labels

{
	"request_id": "req-2025-09-06-002",
	"fragments": [
		{
			"id": "global:finance-policy-index",
			"lod": "macro",
			"text": "",
			"entities": ["finance", "policy"],
			"cost_tokens": 0
		},
		{
			"id": "global:finance-policy-2025-01",
			"lod": "micro",
			"text": "",
			"entities": ["finance", "policy"],
			"cost_tokens": 0
		}
	],
	"kv_policy": { "pin": ["global:finance-policy-index"], "evict": ["global:finance-policy-2025-01"] },
	"metrics": { "used_tokens": 0, "planner_ms": 33, "coverage_entities": 0.4 }
}

Notes

• For block, text is an empty string to avoid leaks while preserving navigation.
• For redact, prefer mask tokens (e.g., [REDACTED]) over partial reveal.
• Providers SHOULD annotate entities to keep evaluation coverage meaningful even under privacy constraints.

Secure field bypass

• ACS MUST skip processing in known secure fields (password inputs, secrets)
• Providers MUST not echo back any captured secure input
• When bypass triggered: return minimal reply with fragments: [], non-zero planner_ms, and optional warning at adapter level

Telemetry coupling

• See ../privacy-telemetry.md for retention and consent rules
• Evaluation privacy metrics: leak rate and token leak rate computed from adapter/client probes