Agents piece together secrets from documents they are allowed to read, and file permissions can't stop it

The problem is well recognized but unsolved. A 2026 arXiv paper on agent authorization says limiting each tool's permissions cannot stop agents from building up unauthorized knowledge, and calls the general case unsolved. CIO and OODA Loop describe the exact failure, where every individual read is allowed but the combined conclusion is the breach. The one funded startup aimed at inference-driven oversharing, Knostic, is built around Microsoft Copilot and enterprise knowledge tools. It relies on query simulation and need-to-know policies rather than checking an agent's final answer against an explicit list of forbidden conclusions. Generic guardrails such as Bedrock denied topics block whole subjects rather than specific conclusions. MetroStar DeCypher applies classification guides to documents, not to agent outputs. A new entrant could win in three places. The first is turning security classification guides, including their rules on combined facts becoming classified, into machine-checkable conclusion lists. The second is cheap rule-based checks that can be accredited inside the IL6 and IL7 classified networks where the Pentagon cleared commercial AI in May 2026, since an AI judge on every turn is costly and hard to approve there. The third is tracking leakage across a whole session, because secrets can come out a piece at a time over many answers. The risks are that rule-based checks may miss conclusions that are paraphrased or only partly stated, that Knostic, MetroStar or the classified AI platform vendors could add this feature, and that customers must write and maintain the conclusion lists themselves.

• Knostic

  Closest competitor. Sells need-to-know controls for enterprise AI, starting with Microsoft 365 Copilot. It frames the problem as LLM inference causing oversharing even when file permissions are correct, and says it enforces policy at the inference layer. It simulates employee queries to find oversharing paths and monitors for drift. Reported funding is $19.3M, a vendor-sourced figure. Focused on office knowledge tools rather than defense research agents or conclusion-list screening.

• Amazon Bedrock Guardrails (denied topics)

  Generic platform feature. User-defined denied topics are blocked in queries or model responses, and custom regex filters run on outputs. It could be set up as a crude conclusion list but works on topics, not specific forbidden conclusions.

• MetroStar DeCypher

  LLM tooling that classifies and declassifies documents against agency security classification guides, with a human in the loop. It already has the defense rulebooks and customers, and could plausibly extend to screening agent outputs.

• US Navy generative AI classification effort

  Government exploration of putting classification guides into natural-language tools to assign security labels. A Center for Naval Analysis researcher called it really hard because guides can't specify every case.

• Protecto

  Data control plane for agentic AI that masks and unmasks data based on permissions. It works on individual sensitive values, not inferred conclusions.

• Hoop.dev

  Open-source proxy with response masking and information-flow-control ideas for agents. It works on values and data provenance, not aggregation or inference.

Checked 2026-10-24