Need-to-Know sits between your assistant and the internet. It reads every request the agent is about to send, works out who receives it and why, then blurs, removes or blocks what they don't need, under rules you can read. It remembers what you teach it, and when something needs your OK, it asks.
Sandboxes control where an agent may connect. Filters catch fixed patterns. Neither knows that your sister may hear about a hospital visit and your colleague may not, or that a hotel needs your dates but not your passport, yet.
privacy boundaries collected from 0 people across 60 scenarios. They shift with the recipient, and people grow more careful when an AI shares for them.
Guo, Xu, Zhang & Li, "It's My Agent, Not Me", arXiv 2509.21712Google Research lists turning a person's norms into the permissions an agent obeys as an unsolved problem, and sketches a contextual policy engine without releasing one.
Google Research blog, 5 October 2026OpenShell's sample content guard matches fixed words. Its own README says it is not a general PII detector. The context was missing; this is the context layer.
NVIDIA OpenShell v0.1.6, supervisor middleware examplePick what the agent is about to do. Each run calls the real guard: its rules engine. Edit the request, or teach it one rule, and run again.
Left: what the agent tried to send, with the personal data it found highlighted. Right: what the recipient actually received.
The guard is an OpenShell supervisor middleware service. Every request the sandboxed agent sends to a guarded host reaches it after network policy and before credentials are added.
Models only read requests and phrase rewrites. They cannot grant a recipient anything your rules don't.
After a rewrite the guard checks that nothing removed is still in the body. If anything survives, the request is blocked.
Decisions are logged with masked values and a hash of the body, never the body itself.
The rules you teach it persist across sessions, so it remembers. When a request needs your OK, the agent is told why, and you decide in the local console. You can try that click here too.
1. Hermes's flower order would hand the shop your sister's address. It stops, and the agent is told why.
2. You allow exactly that request, once, in the console. No standing rule is created.
3. The agent retries the same request and it goes through. Its next try asks again.
Run live on 28 Oct 2026 with Hermes Agent in an OpenShell sandbox: 30 to 40 seconds from the block to the shop's reply.
The same test requests, judged by Need-to-Know with its rules only, with Nemotron reading each request, and by a recipient-blind pattern filter of the kind you would configure with OpenShell's regex middleware.