The boundary
The privacy layer answers two questions about anything an agent wants to do: may this leave? and can this be afforded? Both are answered by a mechanism, not by a promise. Nothing is metered by hoping a classifier was right.
May this leave?
Material is classified at its source. The gate assembles what leaves from parts it checked; it never inspects a finished prompt and guesses.
what the agent wants to send what GRIDLINE does with it "here is the code, review it" ──▶ repository-source may NOT leave · refused "here is a retrieved chunk" ──▶ rag-chunk may NOT leave · refused "here is the finding to check" ──▶ finding may NOT leave · refused "here is the review instruction" ──▶ public-instruction may leave · sent "here is a prompt I assembled" ──▶ assembled-prompt mixed by construction · refused whole anything nobody classified ──▶ default private refused
Three properties hold this together:
| two-valued | There is no "usually fine" class. Material that is sometimes safe is two classes with two names, or it is refused. |
| constructed | The gate assembles what leaves from parts it classified individually; one private part refuses the whole call. A classifier that reads a prompt and guesses can be wrong per span; a class attached at the source cannot. |
| attributed | Every refusal names the task and the class, in the same event log as the task's runs. "What almost left" is a query, not a forensic exercise. |
Eleven classes, one may leave
The reasons below are copied verbatim from the policy file the gate reads at call time (config/egress-policy.json). The default for anything unlisted is refuse.
| Class | May leave | Why |
|---|---|---|
| public-instruction | yes | It is written by this project, is identical for every repository, and is already published in the open-source tree. Sending it reveals nothing a reader of the repo does not have. |
| repository-source | no | This is the material the owner runs a local fleet in order to keep local. It is the whole reason the private tier exists. |
| rag-chunk | no | A chunk is repository source that has been cut up. Cutting it up is not a transform that changes its class, and an embedding is a lossy but real encoding of the text it came from. |
| finding | no | A finding quotes and paraphrases repository source by construction, and names the file and function it concerns. |
| verdict | no | The reason text restates the finding and the code to justify itself. The bare word CONFIRM would be safe; the verdict as recorded is not, and this file classes what exists rather than a hypothetical stripped form. |
| assembled-prompt | no | Mixed by construction, and refused for that reason rather than analysed per-call. Every builder joins a public instruction with private material, so a prompt has no single class and cannot be classified by inspecting it. |
| agent-output | no | A model working on a repository quotes it. Nothing bounds what a generated span contains, so it inherits the class of the most sensitive thing it could hold. |
| task-contract | no | allowedPaths is a map of the repository's structure, and the goal text routinely names files and functions. |
| node-fact | no | It describes the owner's private infrastructure — what hardware exists, what it runs, when it is up. Harmless in isolation and a reconnaissance map in aggregate. |
| accounting-record | no | It is node-fact by another route: durations and energy bands identify the hardware and its utilisation over time. |
| secret | no | Never leaves by any path, redacted or not. Listed explicitly so that no future argument about redaction can reach it: this class has no transform out of it. |
Provenance, not assertion. A class is attached where material is created, from a registry of published instructions — the gate trusts where a part came from, not what a caller labelled it. And it fails closed on every uncertainty: an unknown class, a missing policy, an unparseable policy, a malformed payload — all refuse.
Can this be afforded?
The money side is the egress boundary's sibling: a different instrument, kept apart on purpose.
- Costs are summed in micro-dollars, never floats.
- Reserve → commit → release. Every branch of a call — success, refusal, timeout, crash — commits or releases; a reservation that outlives its process is reaped with a reason.
- Three caps refuse by name: per task, per day, fleet total. Held money counts against the cap. Under six concurrent processes the caps held, after a cross-process race and a crash were found and fixed.
- Local inference has no dollar figure, ever. A test asserts the compute ledger contains no currency unit and does not import the money ledger.
- The human-approval threshold is deliberately low — a quarter — because the spend buys work the fleet cannot yet adjudicate automatically.
Local context is metered in tokens. Cloud egress is metered in dollars and gated by class. Nothing is metered by hoping the classifier was right.
What does not exist yet
Named as decisions, not gaps. The gate holds by test; what it does not yet have is a reason to trust it more, not less.
- A provider client. One provider is declared as a disabled peer with no key; no cloud call has ever been made. The first live call is the next step, and it lands behind the gate rather than beside it.
- Redaction. Deliberately not a class. Removing a secret from a log does not make the log leavable; redaction is a transform that may later be argued to move material between classes, with evidence.
- A second leavable class. Today exactly one class may leave, and it is the only material GRIDLINE holds that is already public.