Frontier Inference Without Frontier Custody Tony Malott · Source dated 2026-07-29 https://shareplane.malott.ai/artifacts/frontier-inference-without-frontier-custody/ Semantic Candidate v03 Interactive Architecture Brief · Protected Development Frontier Inference Without Frontier Custody A practical architecture guide and offline toolkit for using frontier reasoning while keeping authoritative source custody under organizational control. By Tony Malott · Version 1.0.0 Keep authoritative source custody under organizational control. Export only the minimum reasoning surface required for the approved task. Open decision runway Download toolkit v1.0 System mode · custody map Authoritative source stays under organizational control. Controlled environment Authoritative source Local agent Reconstruction key Minimum reasoning surface → Approved processing path Exact endpoint Bounded inference Returned output Inference path and custody surface are separate decisions. Architectures Classification Decision guide Operating model Agent controls Examples Toolkit Evidence System mode · six deterministic outcomes Every path names the custody boundary. A Local agent + local model Original source and inference remain inside the controlled environment. B Minimized remote inference Original source remains local; only the approved minimum reasoning surface crosses. C Enterprise-hosted inference Approved prompts, files, output, history, memory, or session state may exist remotely. D Cloud-hosted agent Authorized repositories, files, logs, builds, and workspace state may exist remotely. E Stop + escalate Classification, approval, retention, authority, or re-identification risk is unresolved. F Remove prohibited information Credentials, private keys, tokens, active secrets, or other prohibited material is accessible. Protected Development preview. Doctrine, architecture, classification, decision precedence, privacy boundary, controls, and toolkit inventory are locked by Issue #214. Exact-head owner UAT remains required. Merge and Production are not authorized. The central design problem is not whether an organization should use a capable model. It is whether the system can use frontier reasoning without turning the provider, product, endpoint, session, or cloud workspace into the custodian of the organization’s authoritative source. Keep authoritative source custody under organizational control. Export only the minimum reasoning surface required for the approved task. Use frontier intelligence without surrendering frontier custody. This is an architecture guide, not a provider endorsement, compliance certification, or authorization to process a particular workload. It makes the information path visible, classifies the complete accessible context, selects a bounded architecture deterministically, and preserves evidence without reproducing the sensitive corpus. The distinctions that keep the model honest Inference is not retention. Retention is not training. Training is not disclosure. Local execution is not necessarily local inference. Local source custody does not necessarily mean zero data egress. No-training commitments do not necessarily mean zero retention. Deleting a chat is useful hygiene, not the primary privacy boundary. Sanitization must address combinations of facts, not merely direct identifiers. Model output may be more sensitive than model input. Approval to reason does not authorize deployment, merge, publication, external communication, regulated action, or Production change. Provider approval applies to a specific processing path, not to a provider in the abstract. Evidence should prove the controls without creating another uncontrolled copy of the sensitive corpus. These distinctions prevent a familiar category error. A local program can read a repository, select a few passages, and call a remote model. The repository remained local, but selected content crossed the boundary. A provider may promise not to train on that content while retaining it for another bounded period. A session may be deleted while logs, abuse-monitoring records, memory, connectors, or derived outputs follow separate rules. None of those conditions is necessarily unacceptable. They are different conditions, and the architecture must name them precisely. Approved architecture model A. Local agent and local model Original source content and model inference remain inside the controlled environment. Use for Restricted or regulated information, tasks that cannot be safely abstracted, or environments where task content cannot leave. The information path is local source → local agent → local model → local output. No task content is approved to cross a remote inference boundary. Primary risks include endpoint compromise, local transcripts and caches, model provenance, silent remote fallback, and capability limitations. The control objective is not merely “offline.” It is a provable local path with remote fallback disabled, bounded file access, bounded persistence, verified model provenance, and evidence that the actual execution followed the approved route. B. Local agent with minimized remote inference Most practical controlled architecture Original sources remain local. A local agent selects, reduces, sanitizes, and packages the task. Only the approved minimum reasoning surface reaches the remote frontier model. Use for Confidential analysis, proprietary engineering, architecture review, strategy, research, and policy development where frontier reasoning is materially useful and the task can be safely abstracted. A coding agent can process files locally without uploading the repository while still transmitting selected content to a remote inference endpoint. The information path is local source → local selection and reduction → local re-identification review → exact outbound-context approval → approved remote inference endpoint → returned output → local validation and reconstruction. The provider may receive only the approved package, endpoint metadata, account context, feature state, and the resulting output. The repository, full document set, Git history, local logs, credentials, unrelated files, and reconstruction keys remain local. C. Approved enterprise-hosted inference Prompts, files, outputs, history, memory, or session state may exist in an approved provider environment. Use for Public or Internal information and explicitly approved Confidential workloads. The exact provider, product, endpoint, model, account type, feature configuration, region, retention profile, processing purpose, and information class must be approved together. Approval of one enterprise product does not silently authorize another product, endpoint, memory feature, connector, region, or account type. D. Approved cloud-hosted agent Highest convenience and broadest custody surface Repositories, files, logs, build artifacts, execution state, or workspace state may exist in a provider-managed environment. Use only when cloud workspace custody is authorized for the data class and purpose. Remote inference approval alone is insufficient. The authorized boundary must cover repository custody, workspace snapshots, logs, build output, tool output, connector state, memory, retention, identity, network egress, and closeout. E. Stop and escalate Use when classification, approval, material retention, regulated authority, or re-identification risk is unknown or unacceptable. Unknown is not a low-risk answer. Stop when the task needs frontier reasoning but cannot be safely abstracted and the original source must remain local; when a remote endpoint is not approved; when a regulated environment or processing purpose is not approved; when cloud workspace custody is required but not authorized; or when combinations of facts remain re-identifiable beyond the accepted threshold. F. Remove prohibited information Use when credentials, private keys, tokens, authentication material, active secrets, dangerous exploit details, or other prohibited information is present or accessible. Removal precedes every other outcome. Do not sanitize an active secret into a reasoning package. Remove it from the accessible context, isolate or revoke it as appropriate, confirm that the model and tools cannot reach it, and restart classification from the changed context. System mode · classification Classification is a progression, not a label. The highest class in the complete accessible context governs the path. C0 Open reasoning surface C0 Public Information intentionally approved for unrestricted public release. Public does not mean consequence-free: combinations of public facts may still support a sensitive inference, and generated output receives its own classification. Reasoning boundary Output remains independently classified. Custody requirement Approved public sources only. Example Public research synthesis C1 Organizational context C1 Internal Information intended for the organization or an approved working group but not for unrestricted public release. Reasoning boundary No unrestricted public release. Custody requirement Keep organizational control unless the exact path is approved. Example Internal procedure improvement C2 Material disclosure risk C2 Confidential Proprietary, commercially sensitive, strategically sensitive, personally sensitive, or otherwise controlled information whose disclosure or uncontrolled processing could create material harm. Reasoning boundary Use only a bounded, purpose-approved reasoning surface. Custody requirement Authoritative source remains controlled. Example Confidential strategy analysis C3 Regulated authority C3 Restricted or regulated Information governed by law, regulation, contractual restriction, formal handling rules, or a risk level that requires the strongest approved controls and explicit purpose-specific authority. Reasoning boundary Explicit purpose-specific authority is required. Custody requirement Use the strongest approved custody controls. Example Restricted clinical analysis C4 Prohibited reasoning input C4 Prohibited Credentials, private keys, tokens, authentication material, active secrets, or other information that must not enter the reasoning path. Dangerous exploit detail or another explicitly prohibited class also resolves here. Reasoning boundary Removal precedes every architecture decision. Custody requirement Must not enter the reasoning path. Example Repository containing active credentials Highest-class rule The highest class in the complete accessible context governs. Accessible context includes prompt, files, repository, Git history, tool output, terminal output, logs, screenshots, connectors, prior sessions, memory, environment variables, retrieved content, and generated output. Mixed-classification rule A lower class may be used only after higher-class information is removed, isolated, replaced with synthetic content, made technically inaccessible, confirmed absent, and made non-reconstructable through remaining context. Unknown rule Unknown is unresolved. It must never be treated as Public, Internal, approved, or low risk. Output rule Output is classified independently because inference may produce a more sensitive conclusion than the literal input. Decision mode · private by construction Choose the processing path. One decision at a time. Nine fixed-choice answers stay in transient browser memory. The deterministic result grants no authorization. Review all nine questions and deterministic precedence The interactive guide on this page runs entirely in the browser. It asks nine fixed-choice questions: 01 What is the highest information class? 02 Must original sources remain local? 03 Can the task be safely abstracted? 04 Is frontier reasoning materially required? 05 Does the task require remote execution? 06 Is an approved remote endpoint available? 07 Is the remote environment approved for this regulated data and purpose? 08 Is cloud workspace custody authorized? 09 Can re-identification risk be reduced to an acceptable level? It applies this outcome precedence exactly: 01 Remove prohibited information 02 Stop and escalate 03 Local model only 04 Local agent with minimized remote inference 05 Approved enterprise-hosted inference 06 Approved cloud-hosted agent Every result identifies the recommended architecture, why it fits, what remains local, what may cross the boundary, required controls, residual risks, approval required, closeout actions, and decision basis. The result is educational, not authorization. It cannot approve a provider, endpoint, purpose, regulated action, deployment, merge, publication, external communication, or Production change. Decision progress 0 of 9 0 of 9 complete Completed decisions No decisions completed yet. Decision 01 of 09 What is the highest information class? C0 Public C1 Internal C2 Confidential C3 Restricted or regulated C4 Prohibited Unknown Decision 02 of 09 Must original sources remain local? Yes No Unknown Decision 03 of 09 Can the task be safely abstracted? Yes No Unknown Decision 04 of 09 Is frontier reasoning materially required? Yes No Unknown Decision 05 of 09 Does the task require remote execution? Yes No Unknown Decision 06 of 09 Is an approved remote endpoint available? Yes No Not applicable Unknown Decision 07 of 09 Is the remote environment approved for this regulated data and purpose? Yes No Not applicable Unknown Decision 08 of 09 Is cloud workspace custody authorized? Yes No Not applicable Unknown Decision 09 of 09 Can re-identification risk be reduced to an acceptable level? Yes No Unknown Previous decision Continue Reset answers Print guide Live trajectory Awaiting the first decision Trajectory is provisional until all nine decisions are complete. Decision 1 of 9. Choose one explicit answer. Recommended architecture Answers that caused this outcome What remains local What may cross the boundary Required controls Residual risks Approval required Closeout actions Decision basis Educational, not authorization. This result cannot approve a provider, endpoint, workload, regulated action, deployment, merge, publication, external communication, or Production change. Public-site privacy boundary Assessment answers remain in transient browser memory for the current page only. The guide stores no assessment answers in cookies, local storage, session storage, IndexedDB, URL parameters, hidden form fields, or persistent history. It transmits no assessment answer through requests, analytics, embeds, third-party scripts, beacons, or error reporting. The page requires no login, accepts no file upload, connects to no repository, requests no organization or project names, requests no source content, requests no provider credential, and contains no hidden assessment telemetry. Reset clears every answer and returns focus to the first question. Native controls preserve keyboard operation. The result and full guide can be printed without JavaScript. The global SharePlane theme preference is separate shell state. It records only the reader’s light or dark presentation choice and contains no assessment answer. System mode · operating journey Twelve controls move one task across the boundary. The sequence stays intact from purpose definition through closeout. Bound the task 01 Define the task Name the exact decision or transformation. Action, failure mode, and evidence Required action State the approved purpose, expected output, accountable owner, and actions that remain outside authority. Common failure mode Sending a broad corpus because the actual reasoning question was never isolated. Evidence produced Task statement, purpose, owner, authority boundary, and stop condition. 02 Classify the information Determine the highest class across everything the system can reach. Action, failure mode, and evidence Required action Inspect prompt, files, repository, history, tools, outputs, logs, connectors, sessions, memory, and environment. Common failure mode Classifying only the visible prompt. Evidence produced Classification assessment with scope, rationale, unknowns, reviewer, and time. 03 Reduce the source set Keep only material necessary for the approved reasoning task. Action, failure mode, and evidence Required action Remove irrelevant files, history, metadata, examples, logs, and context. Common failure mode Treating an entire repository or document room as the unit of work. Evidence produced Source inventory, inclusion rationale, exclusion record, and size limits. Minimize the context 04 Sanitize locally Replace or remove information the remote path does not need. Action, failure mode, and evidence Required action Remove direct identifiers, exact values, unique phrases, credentials, internal locators, and reconstruction keys; use synthetic replacements when they preserve the reasoning problem. Common failure mode Removing names while retaining a uniquely searchable combination of facts. Evidence produced Sanitization record and a diff or transformation receipt that does not reproduce prohibited values. 05 Test for re-identification Determine whether the reduced package still points back to a person, organization, project, event, or sensitive conclusion. Action, failure mode, and evidence Required action Review combinations of dates, ranges, roles, geography, exact values, technologies, events, phrases, public information, provider context, prior sessions, memory, and connectors. Common failure mode Counting removed identifiers instead of testing remaining combinations. Evidence produced Re-identification review with critical overrides, unknowns, residual risk, and disposition. 06 Build the minimum reasoning package Give the model enough structure to reason without exporting the authoritative source. Action, failure mode, and evidence Required action Include the question, bounded facts, synthetic structure, constraints, desired analysis, and output contract. Exclude the reconstruction key. Common failure mode Copying the source into a template and calling it minimized. Evidence produced Versioned package manifest, content hash, classification, purpose, and expiry. Approve and run 07 Select the endpoint and features Approve the exact processing path. Action, failure mode, and evidence Required action Evaluate provider, product, endpoint, model, account type, feature configuration, region, retention, purpose, and classification together. Common failure mode Treating a provider name or enterprise contract as universal approval. Evidence produced Provider and endpoint assessment with source dates, retrieval dates, review due date, and approver. 08 Enforce local-agent controls Make the approved boundary mechanical. Action, failure mode, and evidence Required action Constrain workspace, read and write paths, environment inheritance, credentials, files, context size, outbound preview, network, tools, connectors, memory, transcripts, cloud workspace use, repository governance, and Production authority. Common failure mode Trusting the prompt to enforce restrictions the harness can enforce. Evidence produced Effective configuration, negative tests, permission receipt, and exact agent identity. 09 Approve outbound context Review the exact bytes that may cross. Action, failure mode, and evidence Required action Show the final package, endpoint, purpose, classification, controls, and expected response path to the designated approver. Common failure mode Approving a category of content while the actual outbound context changes later. Evidence produced Exact package hash, approval identity, timestamp, expiry, and permitted endpoint. 10 Perform inference Run only the approved reasoning request. Action, failure mode, and evidence Required action Use the exact package, endpoint, account, feature state, and purpose. Capture minimal non-sensitive telemetry needed to prove the route. Common failure mode Adding context interactively after approval or enabling memory and connectors by convenience. Evidence produced Inference receipt with package hash, processing path, time, output identity, and declared retention posture. Validate and close 11 Validate and reconstruct locally Treat output as untrusted and classify it independently. Action, failure mode, and evidence Required action Validate claims, logic, citations, code, and conclusions; reconstruct organization-specific detail locally; keep deployment and publication decisions under separate authority. Common failure mode Copying a persuasive response directly into an operational system. Evidence produced Validation results, output classification, local reconstruction record, and downstream decision boundary. 12 Close the loop End access, persistence, and authority cleanly. Action, failure mode, and evidence Required action Remove temporary packages, close sessions, clear permitted transient state, revoke temporary access, retain bounded receipts, record exceptions, and review whether controls worked. Common failure mode Treating successful inference as completion while temporary copies, sessions, permissions, or unresolved output remain. Evidence produced Closeout receipt, deletion or retention record, revocation proof, incidents, exceptions, lessons, and next valid action. Re-identification and sensitive inference Removing names does not prove anonymity. Review combinations of dates, ranges, roles, geography, exact values, technology combinations, event sequences, searchable phrases, terminology, public information, industry knowledge, insider knowledge, provider account context, prior sessions, memory, and connectors. The review has five outcomes: Acceptable — no unresolved critical risk and remaining combination risk is within the approved threshold. Acceptable with controls — the task may proceed only with named compensating controls, an owner, and an expiry. Additional reduction required — the package must be changed and reviewed again. Local inference required — the reasoning task may proceed only inside the controlled environment. Stop and escalate — classification, approval, regulated authority, retention, or re-identification risk remains unknown or unacceptable. A single critical risk overrides any aggregate score. Unknown is not Low. Model output receives an independent review. Ordinary facts can produce a sensitive ranking, diagnosis, legal conclusion, vulnerability path, strategic conclusion, or identity inference even when no single input looked sensitive. System mode · local agent controls Local is a provable control stack. Execution location alone does not establish a privacy boundary. Immutable boundaries These conditions define the architecture and cannot be waived by convenience. Inference location Name inference location Record the exact local or remote model endpoint independently from execution location. Enforcement point Model endpoint configuration Evidence produced Endpoint identity receipt Source custody Keep source custody explicit Identify which source systems remain authoritative and which temporary copies are permitted. Enforcement point Source-system boundary Evidence produced Custody inventory Workspace root Bind one workspace Bind the agent to one validated workspace identity; do not rely on a raw path copied into a public receipt. Enforcement point Workspace claim Evidence produced Validated workspace identity Secret scanning Scan every boundary Scan source, selected context, diffs, output, logs, packages, and archives before boundary crossing. Enforcement point Preflight and package gates Evidence produced Secret-scan result Exact outbound-context preview Preview exact outbound context Make the final outbound bytes inspectable and hashable before approval. Enforcement point Outbound approval gate Evidence produced Approved package hash Cloud workspace use Authorize cloud custody separately Require separate authorization for repository, file, build, log, snapshot, and workspace custody. Enforcement point Cloud workspace admission Evidence produced Custody authorization Repository governance Preserve repository governance Require exact base and head identity, bounded branch scope, review, validation, and protected transitions. Enforcement point Branch and review controls Evidence produced Exact base/head receipt Closeout Close temporary access Remove temporary material, release access, preserve bounded receipts, and record the next valid action. Enforcement point Terminal closeout Evidence produced Revocation and release receipt Evidence receipts Keep receipts content-minimal Prove identity, classification, selected context, processing path, controls, results, and closeout without becoming another source copy. Enforcement point Evidence boundary Evidence produced Bounded evidence manifest Configurable controls These controls must be set deliberately for the exact task and path. Execution location Pin execution location Record the exact device, container, virtual machine, or cloud workspace in which tools run. Enforcement point Runtime or workspace launcher Evidence produced Execution identity receipt Read and write allowlists Allowlist reads and writes Permit only required paths and make unrelated repositories inaccessible. Enforcement point Filesystem policy Evidence produced Effective path permission receipt Environment inheritance Minimize environment inheritance Pass only necessary environment variables; do not inherit broad shell or CI secrets by default. Enforcement point Process environment Evidence produced Sanitized environment inventory File and context ceilings Enforce file and context ceilings Bound file count, byte count, token count, history depth, and tool-output size. Enforcement point Agent harness limits Evidence produced Limit configuration and negative test Network allowlist Allowlist network destinations Limit destinations to the approved endpoint and required infrastructure; deny silent fallback. Enforcement point Network policy Evidence produced Destination test receipt Tool permissions Separate tool permissions Separate read, write, execute, network, connector, repository, deployment, and administrative capabilities. Enforcement point Capability policy Evidence produced Effective permission receipt Connector permissions Constrain connectors Disable unused connectors and constrain enabled connectors by account, scope, class, and purpose. Enforcement point Connector scopes Evidence produced Connector inventory Persistent memory Disable persistent memory by default Disable unless specifically approved; classify and inspect what memory may contain. Enforcement point Session configuration Evidence produced Memory-state receipt Transcript storage Govern transcript storage Define location, access, retention, deletion, and evidentiary need. Enforcement point Transcript policy Evidence produced Retention and deletion receipt Monitoring Monitor without copying source Record policy decisions and technical outcomes without copying the sensitive corpus into telemetry. Enforcement point Telemetry policy Evidence produced Content-minimal monitoring receipt Prohibited surfaces These capabilities or materials remain outside the approved reasoning path. Denied paths Deny sensitive paths Deny credential stores, secrets, unrelated workspaces, private archives, browser profiles, messaging stores, and regulated repositories unless explicitly authorized. Enforcement point Filesystem deny policy Evidence produced Negative access test Credential stores Keep credentials out Use platform-managed identity and least privilege. Never place credentials in prompts, repositories, transcripts, or evidence. Enforcement point Platform identity boundary Evidence produced Credential handling receipt Production authority Keep Production authority separate Keep merge, deployment, publication, external communication, regulated action, and Production changes outside inference approval. Enforcement point Protected lifecycle gates Evidence produced Zero-mutation receipt A local coding agent becomes a privacy-preserving architecture only when source access, outbound context, network behavior, persistence, and authority are all bounded and provable. Provider and endpoint assessment Evaluate the exact path: Provider + Product + Endpoint + Model + Account type + Feature configuration + Region + Retention profile + Processing purpose + Information classification For every provider-specific claim, record the provider, product or feature, account type, authoritative source, source date, retrieval date, applicable claim, and review due date. Treat provider terms, features, retention, regional availability, memory, connectors, logging, abuse monitoring, and training posture as current evidence that can change. A provider is not approved in the abstract. A specific processing path is approved for a specific purpose, data class, architecture, configuration, and period. This guide contains no provider ranking, leaderboard, universal approval label, or “safe” badge. The toolkit provides an empty assessment record. An organization must populate it from current primary sources and its own authority before use. Engineering controls An approved architecture must fail closed. Test that the local agent cannot read denied files, inherit unapproved credentials, exceed file or context ceilings, send to an unapproved network destination, enable an unapproved connector, persist assessment data, or perform a Production action. Test that an unavailable endpoint does not cause silent remote fallback. Test that the exact outbound preview matches the approved package hash. Test that logs and receipts prove the control result without containing source content. Keep approval layers separate: approval to inspect source; approval to construct a minimum reasoning package; approval to send that exact package through one processing path; approval to use the output for a bounded purpose; approval to merge, deploy, publish, communicate externally, or take regulated action. Passing one layer does not pass the next. System mode · scenario storyboards Twelve synthetic paths make custody visible. Each storyboard separates source, reduction, reasoning location, permitted output, and closeout evidence. Scenario 01 Public research synthesis Source material C0 Public, subject to output reclassification. Abstraction or minimization Searchable public facts can still produce a sensitive new conclusion. Review output independently. Reasoning location Approved enterprise-hosted inference may be appropriate when the sources are intentionally public, the endpoint is approved, and no private memory or connector adds higher-class context. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 02 Internal procedure improvement Source material C1 Internal unless the procedure contains higher-class operational detail. Abstraction or minimization Remove system locators, employee data, credentials, and exception history that the task does not need. Reasoning location Approved enterprise-hosted inference or a minimized remote package may be appropriate. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 03 Confidential strategy analysis Source material C2 Confidential. Abstraction or minimization Keep company identity, exact market position, financials, dates, counterparties, and reconstruction key local. Reasoning location Local agent with minimized remote inference when the task can be abstracted and frontier reasoning is materially useful. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 04 Proprietary code review Source material C2 Confidential, potentially C3 or C4 when regulated data or active credentials are accessible. Abstraction or minimization Git history, environment files, terminal output, tests, build logs, and generated patches are part of accessible context. Reasoning location Local agent with minimized remote inference for a synthetic or reduced code slice, or local model only when the task cannot be safely abstracted. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 05 Approved public cloud-agent task Source material C0 Public. Abstraction or minimization Public source does not authorize Production credentials, deployment authority, private issue context, or unrelated repositories. Reasoning location Approved cloud-hosted agent only when repository and workspace custody are expressly authorized. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 06 Restricted clinical analysis Source material C3 Restricted or regulated. Abstraction or minimization Removing names does not remove combinations of dates, conditions, geography, rare events, or provider context. Reasoning location Local model only unless the exact remote environment, purpose, region, retention, account, and data class are explicitly approved. Otherwise stop and escalate. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 07 Repository containing active credentials Source material C4 Prohibited. Abstraction or minimization Revoke or rotate exposed credentials as appropriate, isolate the repository context, confirm inaccessibility, and restart classification. Reasoning location Remove prohibited information before any inference architecture is considered. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 08 Sensitive inference from ordinary facts Source material Inputs may begin as C0 or C1; output may become C2 or C3. Abstraction or minimization A single critical re-identification or sensitive-inference risk overrides an aggregate score. Reasoning location Choose the architecture based on the complete accessible context and the likely output, not the literal sensitivity of each input fact. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 09 Legal agreement review Source material Commonly C2 Confidential and sometimes C3 depending on jurisdiction, matter, and content. Abstraction or minimization Approval to identify clauses does not authorize legal advice, signature, negotiation, filing, or external communication. Reasoning location Minimized remote inference only when safe abstraction and the exact processing path are approved; otherwise local inference or stop. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 10 Security architecture review Source material Commonly C2 Confidential; active secrets or dangerous exploit detail may be C4. Abstraction or minimization Output may create a more actionable attack path than the input and must be classified independently. Reasoning location Use a minimized architectural abstraction when safe; keep precise exploitable configuration and credentials local. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 11 Executive mailbox analysis Source material Highest class across messages, attachments, contacts, calendar context, connectors, memory, and inferred relationships. Abstraction or minimization The mailbox is not a single document. It is a high-reconstruction context with sensitive combinations and third-party information. Reasoning location Often local model only or stop and escalate unless the exact enterprise environment and purpose are explicitly approved. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Scenario 12 Public article derived from internal experience Source material Source experience may be C1 or C2 while the intended output is C0. Abstraction or minimization A public destination does not retroactively make the source public. Reasoning location Build a synthetic minimum reasoning package locally, remove private locators and reconstructable combinations, approve the exact outbound context, then review the output for residual disclosure. Permitted output Only output within the approved purpose; classify the result independently before use. Retention and evidence Retain a bounded receipt without reproducing the sensitive corpus, then close temporary access and state. Every example is synthetic. None authorizes a real workload. Evidence mode · offline toolkit Carry the controls into the real decision. The downloadable frontier-inference-without-frontier-custody-toolkit-v1.0.zip is deterministic, versioned, and designed to work offline. It includes executive briefing material, architecture references, classification worksheets, privacy reviews, engineering control profiles and test plans, governance templates, twelve worked examples, synthetic packages and receipts, four JSON Schemas, a machine-readable manifest, SHA-256 checksums, a publication receipt, license, change log, and source/evidence index. Download toolkit ZIP Version 1.0.0 Members 35 data-only files Archive SHA-256 e182a486f3b7…61cb621 Manifest Inspect JSON Checksums Verify SHA-256 Publication Inspect receipt The archive contains no executable, macro, external spreadsheet connection, active content, credential, real organizational data, hidden comment, tracked change, unsafe path, or organization-specific default. JSON examples validate against JSON Schema Draft 2020-12. YAML templates parse as data and contain no custom tag. Evidence Stable doctrine and current provider evidence remain separate. The architecture, classification, precedence, operating sequence, privacy boundary, and controls in this Work are stable owner authority under Issue #214. Provider-specific behavior is not frozen into that doctrine. The toolkit’s provider assessment is intentionally empty. Each use must gather current primary evidence for the exact product path, record its dates, and set a review due date. Validation evidence proves the artifact’s code and package behavior. It does not certify an organization, provider, endpoint, workload, legal conclusion, privacy program, security posture, or regulatory compliance. Full thesis The choice is not between frontier reasoning and privacy. The choice is between an uncontrolled custody surface and an engineered processing path. The strongest pattern keeps authoritative source custody under organizational control, classifies everything the system can reach, reduces the source set, sanitizes locally, tests combinations for re-identification, constructs the minimum reasoning package, approves the exact endpoint and features, bounds the local agent mechanically, previews and hashes outbound context, validates output locally, and closes the loop. Sometimes the correct result is local inference. Sometimes it is a minimized remote package. Sometimes an approved enterprise environment or cloud-hosted agent is justified. Sometimes the only defensible action is to remove prohibited information or stop and escalate. The architecture is credible only when it names what remains local, what may cross, what may persist, what can be inferred, what the system can change, who must approve, and what evidence remains. Privacy is not achieved by refusing to reason. It is achieved by controlling what the reasoning system receives, where it operates, what it retains, what it can infer, what it can change, and what evidence remains. Evidence behind the thesis Check the work, not just the conclusion. Public research, authority, lineage, and author testimony are labeled separately. Sources can corroborate, challenge, or bound the argument; they do not replace Tony Malott's judgment. Portable public record Take the complete artifact with you. The deterministic package contains a self-contained offline article, the exact public-route snapshot, canonical public metadata, receipt, source text when available, plain-text context, claim ledger, source records, and a member-hash manifest. Download full artifact package Read plain-text context Inspect package manifest 4 public sources Sources, authority, and lineage Each record states the role it plays. Research support and governance provenance are not treated as interchangeable. Owner Locked Semantic And Implementation Authority Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit Governs the doctrine, architecture, classification, decision precedence, privacy boundary, operating model, controls, toolkit, validation, and Development-only stop. The complete issue-first authority. Implementation does not reopen or reinterpret its semantic model. Open source Public Standard Artificial Intelligence Risk Management Framework (AI RMF 1.0) Public lifecycle risk-management context; it does not authorize a provider, endpoint, workload, or SharePlane decision. NIST framework context for governing, mapping, measuring, and managing AI risk. Open source Public Standard NIST Privacy Framework Public privacy-risk context for identifying and controlling data processing. Framework context only; the Issue #214 classification and branching model remain owner authority. Open source Public Guidance NIST Privacy Engineering Program Public privacy-engineering context for data processing and system design. Supports the general minimization posture without certifying this artifact or any processing path. Open source Claim discipline What is asserted—and how it is bounded Research, author analysis, and personal testimony remain distinct. Supporting links and caveats stay attached to each claim. Owner Locked Primary Doctrine claim:214:custody Keep authoritative source custody under organizational control. Export only the minimum reasoning surface required for the approved task. Support Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit Owner Locked Primary Distinction claim:214:frontier Use frontier intelligence without surrendering frontier custody. Support Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit Owner Locked Control Statement claim:214:agent-boundary A local coding agent becomes a privacy-preserving architecture only when source access, outbound context, network behavior, persistence, and authority are all bounded and provable. Support Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit Owner Locked Governance Statement claim:214:path-approval A provider is not approved in the abstract. A specific processing path is approved for a specific purpose, data class, architecture, configuration, and period. Support Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit Owner Locked Final Control Statement claim:214:control Privacy is not achieved by refusing to reason. It is achieved by controlling what the reasoning system receives, where it operates, what it retains, what it can infer, what it can change, and what evidence remains. Support Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit Public boundary. Public-safe doctrine, synthetic examples, empty templates, schemas, and validation evidence only. No real organization, project, source corpus, credential, provider approval, regulated record, assessment answer, private locator, or hidden operational evidence is included. 4 sources 5 governed claims 1 portable package Connected work Continue the thinking Each connection explains why the next work belongs here. The graph records the edge; this layer makes it useful to a reader. Foundations Companion: The Agent Is Not the Security Boundary The Agent Is Not the Security Boundary Continue from information custody into the mechanical controls that keep an agent-bounded system safe when the agent is wrong. Do not ask whether the agent is trustworthy. Ask whether the system remains safe when the agent is wrong. Systems Essay By Tony Malott 2026-07-25 16 min · Standard long-form article Applications Companion: The Agent Is Not the Product The Agent Is Not the Product. The Control Plane Is. Connect the local-agent control profile to the broader control-plane architecture around authority, evidence, recovery, and valid action. The more useful an agent becomes, the less its safety can depend on the agent behaving well. The durable product is the governed execution environment around it. Reader Choice Publication Family By Tony Malott 2026-07-23 complete standalone reading experience · Personal systems narrative, Architecture argument, Enterprise warning Companions Companion: The Semantic Operating System The Semantic Operating System See how custody, authority, provenance, freshness, and next-valid-action semantics fit into a durable cross-system operating model. A system becomes a semantic operating system when it preserves the governed conditions under which meaning remains identifiable, authoritative, explainable, movable, and actionable. Authored Systems Work By Tony Malott 2026-07-29 14 min · Deep thesis Explore the complete graph About the author Tony Malott AI architect, systems engineer, and author publishing serious work on agentic systems, architecture, governance, automation, and the operating models around them. About Tony Résumé Email Tony SOURCE REFERENCES Publish Frontier Inference Without Frontier Custody as a SharePlane Guide and Toolkit https://github.com/pinklon/shareplane-platform/issues/214 Artificial Intelligence Risk Management Framework (AI RMF 1.0) https://www.nist.gov/itl/ai-risk-management-framework NIST Privacy Framework https://www.nist.gov/privacy-framework NIST Privacy Engineering Program https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering