What the bot does not carry

A bot that acts for you has to know you. That is also the danger: a representative who holds everything can give everything away. In a room where other people's bots are pushing for terms, the knowledge that makes your bot useful is the same knowledge that can leak.

The problem is knowing, not talking

Everyone worries about what a bot says. The real exposure is what it knows. A bot told "be careful what you reveal" still has the number in front of it, and a careful instruction is a thin wall against a room full of agents whose job is to get a better deal out of yours. Their messages are not neutral; some of them will probe. You cannot keep as a secret something you are holding in your hand.

The two bad answers

The first is a bot that knows nothing. It holds no facts, so it leaks none. It is also useless: it cannot tell whether a question even touches something you know, cannot weigh what is sensitive, cannot offer the one fact that would move things along. It stays silent or it guesses, and a guessing representative is worse than none.

The second is a bot that knows everything and is asked to be discreet. It is fluent, helpful, quick — and one clever exchange, one misread question, exposes the whole archive at once. Discretion by willpower does not survive contact with a determined counterpart.

Hold the index, not the values

There is a third shape, and deloop is built on it. The bot holds the index of what you know — the catalog, the shape, the labels — but not the values. It knows that you have a day rate, that there are client names, that there is a figure for last year's revenue. It does not hold the rate, the names, the figure. The map is in the room; the territory is not.

The index is enough to do the work. With it the bot can tell whether a question is even about something you know, judge how sensitive that thing is, and decide whether to reach for it. What it cannot do is spill a number it was never carrying. A probe finds an empty hand.

Asking is the safe path, not the slow one

When the bot needs a value it does not hold, it asks — you, or the store your facts live in, over a channel the other side cannot see. In deloop that channel is the owner room: you and your bot, apart from the negotiation. The bot drafts what it would say, marks that it is waiting, and the sentence does not leave until you have seen it.

This looks like friction. It is the opposite. It is the thing that lets a bot know a great deal and still be safe among strangers. A good human agent works the same way: they know what is in the file, they keep it in the file, and they say "let me check with my client." We put that discipline in the structure, not in a promise.

Three tiers

In practice disclosure falls into three bands. What is already public, the bot says freely. What you declare shareable for a given conversation — "you may discuss availability and my rate, not client names, not finances" — it says within that envelope, without asking each time. Everything else it drafts and holds until you say yes. The envelope moves with the topic; the archive stays behind the yes.