Solutions
Give the agent a copy, never the original.
The only control in the doctrine that reduces what leaves your Mac is narrowing what an agent can read in the first place. The data layer is how that narrowing is built, generated and checked.
Originals are sealed
The live stores have no agent path, ever. The guard enforces that below the permission list, and the scan notices when the files move.
The projection is generated
A read-only copy, built by a script that reads the capture schema in front of it rather than a list of table names that goes stale.
Three scopes, because it depends
Frames only; text from an allow-list of apps; or text from everything except an exclusion list. What the copy carries is a setting, not a default.
The tiers
| Tier | Contents | Agent access | May leave the machine |
|---|---|---|---|
| Original | the live stores | no path, ever | no |
| Replicated | server-side services | read; sending asks first | already has |
| Projection | real rows, narrowed, read-only | read | no |
| Synthetic | fabricated rows, real structure | read and write | yes |
| Scratch | agent output, version-controlled | read and write | by promotion only |
Why the narrowing is a script
Capture schemas move. The doctrine was written against tables a current screen recorder no longer has, and a list of SQL statements aimed at tables that are gone either fails or narrows nothing. The generated script reads the schema in front of it and:
- drops every full-text index first — a full-text index keeps its own copy of what it indexes, so narrowing the base tables and leaving those behind would ship the text twice;
- applies one policy per table — keep the row, keep it but blank the text, filter by app, drop it;
- clears browser URLs in every scope, because a URL carries paths, query strings and tokens;
- refuses to build when it meets a text column it has no rule for, naming the table — so an upgrade to the recorder cannot widen the projection silently.
Two things are dropped in every scope
Audio. Transcriptions, meetings, speakers and diarization never reach a projection at any setting, because what was said near this Mac includes people who never agreed to be recorded. Secrets and plugin output go the same way.
An allow-list beats a deny-list, and by more than it looks. A deny-list only covers the apps you thought of, and browser-based banking and password pages are captured under the browser's own name — so an app-name deny-list never sees them.
The synthetic tier
A corpus that preserves the shape of the capture and message stores without carrying their values. Its defining property is not that it is safer to read — the projection is already safe to read — but that it is the only tier allowed to appear in a screenshot, a bug report, a demo or a public page.
It buys two things the projection cannot. The injection route collapses, because a synthetic corpus contains no text an adversary wrote. And the canary drill becomes valid: an agent can spot a planted instruction when it is the only thing in an otherwise empty folder, which tests noticing rather than resisting.
Status: the fixture, generation on a clone and the declassification gate are built and tested. Per-column treatment, profile rewiring and the coverage metric are not. Synthetic data does not replace the projection, does not answer the questions you actually ask a capture store, and is not a privacy guarantee.