Data privacy requires a clear purpose and lawful basis for handling information, along with minimization, access control, retention limits, secure transfer, transparency, and meaningful user rights. Shared AI systems can expose information through memory, prompts, tools, workspace state, or participant access.
Multi-user agents should keep private, personal, and team context distinct. Permissions must apply when information is stored, retrieved, summarized, handed off, and used by tools, not only when a person first uploads it.
ELI5
Data privacy is about controlling how personal or sensitive information is collected, used, shared, and kept. In an AI system, that information can appear in prompts, uploaded files, conversation history, tool results, and logs.
For example, running a model on a laptop may keep a document away from an external model provider, but another app or backup service could still copy it elsewhere. Privacy depends on the complete system, not only where the model runs.
Where can a shared AI system expose private data?
Exposure can occur through prompts, memory, logs, summaries, tools, files, notifications, search, exports, handoffs, incorrect permissions, and other participants.
How can multi-user agents protect privacy?
Use minimization, explicit ownership, role-based access, separate contexts, provenance, encryption, retention limits, auditing, correction, and deletion controls.
