Could a few simple privacy settings do the job of making users read through everything an AI remembers about them?

This explores whether people could govern an agent's memory through a small set of clearly defined permission categories instead of reading through everything it has stored. The short answer is partly. Bounded categories make compliance checkable, but they can't do all the work alone. Note that none of these papers measures how much effort users actually spend; they come at the question from the system-design side.

The strongest case for bounded fields is the iMy privacy contract Can a two-category privacy boundary actually be auditable?. It sorts user data into just two buckets: LOW (fine to use by default) and HIGH (needs explicit approval). Two buckets turn out to be enough. The contract is simple enough that agents follow it reliably, and precise enough that anyone can check, mechanically, whether a rule was broken. That's the real shift. You stop asking "what's in the memory?" and start asking "did the agent cross a line it was told about?" The second question is far easier to answer. A related idea from benchmark auditing points the same way. Audit agents work best when they have a narrow job, a fixed set of evidence to look at, and a requirement to cite that evidence Can scoped agents reliably judge semantic hacks in runtime analysis?. Narrowing what gets looked at is what makes a judgment trustworthy.

The catch is that sensitive data doesn't stay inside its field. In one study, about three-quarters of privacy leaks in reasoning traces came from the model recalling private details in the middle of its reasoning Do reasoning traces actually expose private user data?. Scrubbing those traces afterward hurt performance, which suggests the model uses private data as working material while it thinks. A disclosure label can say "this is HIGH," but it can't stop the model from carrying that fact into its reasoning. A second catch is that rules checked one action at a time can't detect harm that builds up over a sequence of actions Can stateless checks ever catch sequence-level constraint violations?. Five separate disclosures might each be allowed and still add up to something the user never agreed to.

The corpus's practical answer is layered: bounded fields for the user, a full record kept somewhere else for verification. Cryptographic commitments let an organization prove that a record exists and hasn't been changed, without revealing what it says Can commitments protect sensitive agent data while enabling verification?. The full log still exists, but checking it doesn't mean reading it. Treating learned knowledge about a person as versioned files that can be inspected and rolled back Can person-grounded skills remain auditable without hidden prompt state? offers a middle level of detail. You check a specific file when something seems off, instead of reading a whole transcript. In one long-running deployment, rules stored directly in the memory the agent consults while working were followed more reliably than outside policy documents Can governance rules embedded in runtime memory actually protect autonomous agents?. So your disclosure fields may work better as instructions the agent reads than as a dashboard the user reads.

What you may not have expected to learn: the thing you'd most want to audit, the model's own reasoning, is where private data leaks most, and it is also the hardest place to put a disclosure boundary. Bounded fields reduce how much a user has to audit. They don't remove the need for someone, or something, to watch what happens across the whole sequence of actions.