Confidential AI needs separate answers for privacy and authority

Confidential inference solves part of an enterprise AI problem. Even when an infrastructure operator cannot read a prompt, an agent still needs to identify its user, retrieve only permitted documents, and obtain authority for consequential actions. October publications from Brave, Twilio, Docker, and CNCF help separate these responsibilities before a platform decision.

Brave's October 15 announcement describes a protected GLM route in Leo, combining device-side encryption, attestation, and inference inside a trusted execution environment. The claim applies to that specific route, not automatically to every browser model. The same day's Twilio discussion of agentic identity ties actions to an owner and bounded authority. Docker's October 14 security analysis covers autonomous execution risks. An October 8 CNCF contributor article argues for agents proposing a verifiable next system state. That final source is an architectural position, rather than a mandatory CNCF standard.

Four boundaries need different evidence

Transport encryption limits interception in transit. Confidential computing adds a boundary inside the provider's infrastructure. Delegation establishes whose authority an action uses. The execution layer decides whether a particular change is permitted now. Passing one check cannot satisfy the others.

Consider an employee asking for an explanation of a contract. Protecting the prompt matters, but the application first needs to establish that the employee may read that contract. A subsequent request to change its deadline creates a different operation. Read permission does not establish authority to alter the company's obligation.

A practical integration therefore selects authorized data before calling the model, exposes tools with bounded parameters, and evaluates policy again before execution. The model proposes work; the application remains responsible for the access rules. This also makes individual decisions easier to test than an instruction telling the model to behave safely.

These boundaries imply different procurement questions. Evidence that a provider cannot inspect prompts says little about the permissions granted to a downstream tool. Evidence that a user signed in says little about whether a prepared amendment still matches the current document. A buyer needs both explanations, with named components responsible for enforcing each one.

Attestation does not verify the answer

Attestation connects trust to a particular environment and executing code within the stated design. It does not establish that a generated answer is correct, or make an adversarial instruction harmless. An isolated agent can misunderstand a document and propose an unwanted action. That mistake may remain confidential while still causing damage if another system executes it.

Observability requires similar care. A promise not to retain readable prompts cannot quietly be reversed through verbose tool logs. An investigation often needs a run identifier, policy version, permitted operation, authorization result, and technical error code. Retaining document contents requires a separate decision about necessity, access, and retention.

Endpoint devices and downstream destinations remain in scope. If a result is forwarded through ordinary email, the confidentiality of inference does not describe the complete information path. Map the route from input to final recipient, including fallback providers and failure behavior. Otherwise, a service outage can become the moment when sensitive requests silently move to a different arrangement.

Hypothetical design: a contract assistant

Imagine an assistant that reads one department's contracts, explains terms, and prepares proposed amendments. This is a design example, not a delivered project. Bind retrieval to the employee, send only necessary fragments to inference, and represent an amendment as an exact draft with supporting evidence. An executing service rechecks authorization and the current record version.

Suppose an employee approves a new deadline while another person edits the contract. The previous approval should not automatically apply to the revised document. Show the difference and request a new decision. If delegated authority expires during the task, stop with an intelligible status. Continuing under a shared administrator credential would change the original agreement.

Such a system takes more work than attaching a chat interface to a folder, but its boundaries can be exercised directly. Before a pilot, simulate revoked access, a foreign document appearing in search, an expired approval, and an unavailable confidential-inference route. The expected outcome is a reproducible refusal or an appropriate escalation, rather than a plausible explanation after the fact.

Our article on business rules, states, and permissions explains the underlying application boundary. The custom API case supplies a connected-application context. You can discuss your assistant's access boundaries, beginning with the operations and information that actually require protection.