# Agent data boundary: an evaluation you can reproduce
Reviewed 27 September 2026. Implemented mechanism, source-inspected acceptance check and separately retained execution evidence are distinguished below.

## Three-step check
1. Read a permitted fixture record through the actual agent retrieval path; compare recovered bytes.
2. Request a restricted fixture through that same path, including an instruction embedded in untrusted input. Verify that it supplies no protected plaintext.
3. Change the relevant authority, restart and repeat. Inspect alternate routes, cached plaintext and retained credentials.

Keep root keys and the authority to issue cryptographic contexts outside the agent. Use fictional fixture records, not sensitive customer data. Passing these cases qualifies those cases; it is not certification or proof against every attack.

## Evidence map
The retained H12 clearance-boundary source at 8DB revision d5d0f58e86064b410f1a0c424e9b7c1e06c545f2 derives writer and reader keys, encrypts a fixture and requires different keys, byte-exact writer recovery and reader decryption error. This review inspected that implementation and assertion. It does not report a newly executed H12 pass.

Separate retained 13 September evaluator logs record expected stale-authority and unknown-policy refusals on named native cases. They use historical runtime identity 9f73b5d5ac8eac4bf739c8d248bba0eabc503c68 and kit summary 4beaaed4fa512809ff8a6719e2cf079660821fce; these are not the later source-capture revision. That overall kit was inconclusive for broader live-transition qualification. Its individual refusal outcomes do not certify the whole package or establish H12 execution.

For evaluation, request the exact build, invocation, inputs and result for the protected path you will use. The useful architectural property is that reading encrypted content requires the appropriate key context; an instruction in a document does not grant that authority. Application controls still govern authorized plaintext and actions.

The three-step method applies alongside OWASP least-privilege and excessive-agency guidance: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ . To discuss a boundary, send only the kind of record the assistant should not open to ashley@8braid.com. Do not send its contents.