Eight domains. Eight confidential assets. One layer of clothes.
Each block below names a sector, the one thing its agent must never give away, why existing tooling misses it, a fully scripted simulation you can step through, and the care label — the actual disclosure policy, sewn in.
Hospitality — the floor price.
Buys it: revenue manager, hotel group
The floor rate — the point below which the room should stay empty.
Why existing tooling misses it: no credential leaks, no personal data moves, no guardrail trips. The floor is reconstructed from statements that each look like good customer service — an occupancy admission here, a matched "competitor rate" there. Perishable inventory makes soft agents rational, not stupid; that is exactly what a trained buyer exploits.
- never confirm occupancy below 60%
- never price against an unverified ceiling
- never name a volume rate without binding the volume
- escalate before any commitment
Freight — the absent alternative.
Buys it: shipper's transport desk, or a brokerage
That you have no other truck. Your leverage is entirely a function of your BATNA.
Why existing tooling misses it: "we're stuck, our carrier fell through" contains nothing a scanner flags. It is a complete transfer of negotiating leverage in eleven words. An agent that reveals a weak BATNA has given away more than any number.
- never disclose that an alternative carrier is absent
- never counter an anchor — re-anchor on corridor data
- reveal the need, never the desperation
- always hold a named, real alternative before refusing
Software renewal — the switching cost.
Buys it: procurement / vendor management
What it would cost you to leave. A vendor who learns it stops pricing the product and starts pricing the exit.
Why existing tooling misses it: "we're deep in it, migrating would be a nightmare" reads as a satisfied customer. It is a signed blank cheque. Nothing in it is a secret in the security sense — it is lock-in, self-reported, in the first ninety seconds of a renewal call.
- never describe migration cost, effort or pain to the vendor
- never accept an uplift as "industry standard" without evidence
- keep the exit visibly open, whether or not it is
- never sign against a manufactured deadline
Accounting & audit — the other client's numbers.
Buys it: managing partner or risk partner, accounting firm
Another engagement's figures, and any finding that has not been through partner review.
Why existing tooling misses it: nothing here is personal data or a credential. It is a professional-duty breach that looks like good client service — warmer, more useful, and a violation of engagement confidentiality under the ICAI Code of Ethics.
- never let figures from one engagement inform advice on another
- anonymising is not disclosing
- never communicate a finding before partner review
- route urgency to the partner rather than satisfying it
Investigation analysis — the bystander.
Buys it: state cyber cell, telecom compliance, or the legal unit that defends the file in court
Every person in the dataset who is not the target.
Why existing tooling misses it: the analyst is authorised, the data was lawfully obtained, and no rule is technically broken. The exposure is volume — how many uninvolved people were resolved, retained and exported alongside one target, and whether anyone can prove what was excluded. Section 20 interception under the Telecommunications Act, 2023 needs no consent from the subject; that is exactly why minimisation, and the record of it, carry the whole weight before a Review Committee.
- never resolve SDR or KYC for subscribers outside the order's target set
- mark and exclude legally privileged contacts
- never merge datasets across separate authorisations
- every exclusion is logged, and the log ships with the file
This product reduces what is collected, retained and disclosed, and produces the minimisation record a Review Committee or court asks for. It is sold to compliance, legal and court-admissibility — never as a way to see more.
Pattern recognition — the decision boundary.
Buys it: fraud, risk or trust-and-safety lead
The thresholds, features and windows the detection runs on. Publish them and you have published the evasion recipe.
Why existing tooling misses it: the agent is being helpful and arguably compliant — it is explaining a decision to the person affected. Nothing leaks except the method, and the method is the product. Enough explanations and an adversary rebuilds the boundary without ever seeing it.
- never state a threshold, window or feature weight to the subject of a decision
- give a reason sufficient to appeal, and a route
- full detail to authorised reviewers, always logged
- never confirm or deny a hypothetical evasion
Software companies — the roadmap and the defect.
Buys it: VP Sales, VP Customer Success, or the security lead who finds out afterwards
Unreleased dates, unpatched defects, architecture limits, and why deals were lost.
Why existing tooling misses it: the agent is doing its job — answering a prospect's questions accurately and quickly. Accuracy is the failure. An internal estimate repeated to a prospect becomes a promise; a named defect breaks a coordinated-disclosure embargo.
- never state an unreleased date or delivery confidence
- route every vulnerability question to coordinated disclosure
- never confirm churn reasons or named-competitor outcomes
- publish benchmarks, never improvise limits
The same layer applies to coding agents with repository access — proprietary architecture, credentials in source, and unreleased work leaving through an external context window. Same asset class, different door.
Workforce — the private life.
Buys it: COO or head of operations who wants to know whether commitments are being met
Everything the agent must read in order to answer, and must not repeat.
Why this one is different: every other domain protects you from an outsider. This one protects your people from you. The EU AI Act prohibits workplace emotion recognition outright and puts most workplace monitoring under high-risk obligations; the product stays descriptive, aggregate-first, and task-focused by design.
- report events, never inferences
- a fact and its reason are separable — report the late delivery, withhold the family emergency
- public work channel is reportable, a direct message is not
- the withheld log records categories, never content
The analysis agent must read everything and report almost nothing. That is a harder engineering problem than the dashboard, and it is the only part a competitor cannot copy in a weekend.
A floor price. An absent alternative. A switching cost. Another client's margin. A bystander's name. A detection threshold. An unpatched defect. A colleague's private message.
Not one of these is a secret in the security sense. No credential, no personal data, nothing a scanner would flag. Each one is reconstructed from statements that look harmless alone, across turns, by someone with an interest in reconstructing it.
Eight industries. One mechanism. One missing layer.