Private AI workflows want local state

Private AI is a boundary choice before it is a model choice.

Once a tool reads notes, screenshots, drafts, browser state, or local project files, it is handling working material the user expected to stay nearby.

Start with narrow scope:

{
  "workspace": "personal-notes",
  "allowedPaths": ["drafts/agent-control-plane.md"],
  "excludedPaths": ["journal/", "taxes/", "secrets/"],
  "syncDerivedOutputs": false,
  "expiresAt": "session-end"
}

A file assistant may need the current file, not the whole folder. A notes assistant may need one note, not the vault. A coding assistant may need the current diff, not the repository.

Derived artifacts need the same boundary. Summaries, embeddings, tags, memories, logs, and cached outputs can contain the private material even when the source never leaves the device.

If the app builds a local index, the user should know where it lives, how it updates, and how to delete it. Removing a folder from scope should remove its derivatives too. Deleting a note should not leave an invisible searchable copy.

Keep private work local, let the user choose what syncs, and leave a receipt when anything moves. That is the structure that makes the workflow feel respectful.