Every Query Was Allowed

Take the Ashdown instruction, an invented intake matter that recurs through this book. The firm's advice note to Ashdown Ltd is privileged, and it recommends settling. A drafting agent has a grant that lets it read public filings and no other document. In the file, drafting_cannot_read computes that its grant refuses a read of the note.

The firm also has a matter-statistics tool, because partners like to know how often the disputes group advises settlement. It reads one field per matter, recording whether the current advice recommends settling. Someone thought about privilege when building it. It returns counts only, and refuses any count over fewer than two matters. The agent may call the tool. Here is what it asks, while assembling a benchmark for a pricing paper, with the second question a routine refinement of the first:

Two minus one. The agent now holds the conclusion of a note it may not read, whether or not it noticed. Every query was allowed, every log line is green, and nothing malfunctioned.

Whether a fact stays confidential is a property of a transcript, not of a query. Three claims follow. First, no check that sees one query and its answer can enforce that property, except by refusing queries that do not determine it on their own. That part is proved, and it is old. Second, I know of three exits, refusing the row, remembering the transcript and blurring the answers, and none is free. Third, and most contestable: the ledger, the exit that feels most like security engineering, prevents the least. Decided from the true answers, its refusals leak and, scoped per agent, it misses the case that matters. Decided without them, on my table it refuses for a lone query exactly what removing the row refuses. Either way its verdict depends on what the attacker already knows. If a firm wants statistics over privileged matters, it should add calibrated noise under a budget or not offer them.

I build AI systems for law firms, so I gain if buyers start asking this question of vendors, and I lose if the answer is that such systems should read less. Nothing here is legal advice.

Nobody Authorised the Combination argued for checking the closure of what agents can jointly do. This chapter concerns what they can jointly know. A capability closure is computed from declared capabilities. An inference closure depends on the answers, the data behind them and what the reader knew beforehand, so nobody can compute it from the permission table alone.

Nothing here is new

L. J. Hoffman and W. F. Miller published on getting "a personal dossier" from a data bank in Datamation in May 1970, and J. Schlörer on trackers in 1975; I know both only through the account in Denning, Denning and Schwartz. That paper names the belief this chapter's firm holds: "Many users and designers believe that the individual records will remain confidential as long as query programs refuse to report the statistics of query sets which are too small." Its finding: "Severe restrictions on allowable query set sizes will render the database useless as a source of statistical information but will not secure the confidential records" (Denning, Denning and Schwartz, 1979). Its general tracker needs no prior knowledge of any individual. My two queries are the plainer differencing attack, which Dinur and Nissim give as the reason the large-set intuition "fails for two or more queries": two large sets that differ on one entry (Dinur and Nissim, 2003).

A hostile specialist will name more. In multilevel databases this is the inference and aggregation problem, under Morgenstern (1987), Lunt (1989) and the survey by Farkas and Jajodia (2002). I confirmed those records but could not obtain the texts, so I say nothing about their content. Brewer and Nash, whom I did read, gave commercial access control a history-based policy in 1989: "it is necessary for the computer to remember who has accessed what" (Brewer and Nash, 1989). Their wall tracks which datasets a user touched, not what follows from the answers, so it would not catch two counts from one permitted tool. For language models, Jones, Dragan and Steinhardt show that "adversaries can misuse combinations of models even when each individual model is safe" (Jones et al., 2024), and Glukhov and colleagues define an inferential adversary, judged by what it infers, and prove a safety-utility trade-off for bounding the leakage (Glukhov et al., 2024).

None of the Lean below is a new theorem. This chapter states the old result's assumptions exactly and asks where the state must live when the querier is a fleet of agents.

What exactly cannot be done

"No per-query check can catch it" is false as a slogan. A check that refuses everything catches it. So the claim needs a precise form, and it has two.

Reveals views secret w says that every world giving the same answers as w to those views has the same secret as w. On the Ashdown table, three things hold. q₁_alone_open and q₂_alone_open say each query alone leaves the secret open at the actual world: for q₁ there is a twin world with the same count and the opposite Ashdown bit. Other worlds differ: an extreme count exposes it. union_reveals says the pair reveals the secret at every world, and differencing proves the step for any row and query set over these four matters. size_limit_admits_pair adds the arithmetic for size rules of the form k ≤ |S| ≤ n - k.

The first form of the impossibility is a dichotomy. no_per_query_check says that, given any two queries that are each open alone and revealing together at a world, every check either refuses one of them, which alone leaves the secret open, or passes both. The second is sharper. The block below is the statement only, and its proof compiles in lean/BuildingInSteel/Aggregation.lean on Lean v4.29.1.

theorem no_exact_per_query_check (ans : Q → W → A) (secret : W → S) (q₁ q₂ : Q) (w : W)
    (h₁ : ¬ Reveals [ans q₁] secret w) (h₂ : ¬ Reveals [ans q₂] secret w)
    (hu : Reveals [ans q₁, ans q₂] secret w) :
    ¬ ∃ check : Q → A → Bool, ∀ t : List Q,
        t.all (fun q => check q (ans q w)) = true ↔ ¬ Reveals (t.map ans) secret w := by

In words: no function of one query and its answer accepts exactly the transcripts that leave the secret open. ashdown_no_exact_check is that theorem instantiated on the firm's table. Each assumption is load-bearing:

1. The check gets the same input for a query whatever came before. A check that sees earlier queries is a ledger under another name, and the theorem does not apply to it.
2. Q may contain anything else. The query can carry the principal, the purpose and the time, and the check is chosen after the world is fixed, so its author may know the true state.
3. The combination exists. Where no pair satisfies h₁, h₂ and hu, the theorem says nothing.

no_per_query_check is a case split on two Booleans, useful only as the statement of the dichotomy. The sharper proof is three applications of the hypothesis to [q₁], [q₂] and [q₁, q₂]. All the content is in the type. A conjunction of local tests cannot express a non-local property. The statements that could have come out false are the ones about the table: had the tool rounded its counts coarsely, union_reveals would be false.

The obvious repair is a bigger window. no_window_suffices removes it, in a separate model where queries read single bits and the secret is parity. For every k and every world, each transcript of at most k queries leaves the parity of k + 1 bits open, and asking all k + 1 reveals it. In that model, any bounded window that does not over-refuse misses a combination one query longer.

Exit one: refuse the row

The dichotomy's first branch is often the right answer. excludeRow, a per-query check, refuses any query touching Ashdown. exclude_row_stops_q₁ shows that it refuses q₁, the branch the theorem predicts: a query that, at this world, leaves the secret open alone, although posterior_shift below shows it still moves the odds. If privileged matters can leave the statistics entirely, take them out. Three things can stop you: if every matter is privileged, the table is empty; if the secret is a relation across fields, there is no row to drop; and somebody must have named the secret first.

Information-flow control lands here too. Dorothy Denning's lattice labels a combination with the least upper bound of its parts (Denning, 1976). If labels sit on the query results, that scheme is a per-query check: join_low_iff_all_low proves, for a two-level lattice, that a transcript is low if and only if each query is. Low joined with low is low, and aggregation is exactly the case where that is wrong. Labels on the source field do better. Noninterference (Goguen and Meseguer, 1982) flags q₁ because its answer changes with the Ashdown bit, which q₁_interferes computes, and passes q₂, which q₂_ignores_row proves is unaffected by it. That is correct, and it is the over-refusal branch again, so a firm that wants statistics adds a declassifier for "aggregates". If the declassifier is a rule about each query, it is a per-query check once more. Declassification research treats this properly (Sabelfeld and Sands, 2009). My understanding, unverified at source, is that its strong forms reason about a known program as a whole, and an agent's plan is not known in advance.

Exit two: remember

Keep a ledger. Answer a new query only if the true answers so far would still leave the secret open. audit_sound proves the guarantee: for any list of worlds, any world and any query list, if the secret starts open, the answered transcript leaves it open. pooled_ledger_refuses computes the pair: answer q₁, refuse q₂. Unlike excludeRow, it keeps the secret while still answering q₁. A pooled ledger also keeps its detective value, for incident response and for the insider below; "prevents the least" is a claim about prevention, and about a ledger as the only control.

Now the costs, and there are four.

The ledger's scope is the security boundary. per_agent_ledgers_miss computes the failure. Give q₁ to the drafting agent and q₂ to a second agent with the same tool and no read grant, each with its own ledger, and both are answered, because each ledger holds one query. Pool the transcripts and the secret is revealed. Agents that can pass messages form one reader. The correct scope is therefore every principal whose outputs can reach a common reader, across every tool answering from the same data, which is a question about the delegation graph and not about any one agent. Who Proves the Agent Is Yours? deals with who sits in that graph. A chain in which every hand-off narrows scope can still hold both queries, since the tool is in scope for each agent.

Refusals leak. Dinur and Nissim make the point in an appendix of the version I read: "the auditor's approvals/refusals leak information about the database", and they attribute it to the auditor's decision taking into account the answer to the query in question. A specialist will name Kenthapadi, Mishra and Nissim's later Denials leak information: Simulatable auditing; I read only its record. denial_leaks computes a small instance. On [q₃, q₄], the sets {Ashdown, matter 2} and {matter 2}, at the actual world, the auditor refuses q₃ because the answer 2 would give the bit away, then answers q₄ with 1. Its answered ledger is [q₄], which leaves the secret open, so its soundness theorem holds. Yet every world, of the 16, that yields the same refused-then-1 transcript has Ashdown's bit set. The auditor is sound about its answers and leaks through its silence.

The repair is to decide without looking at the world. auditQ answers only if the ledger plus the new query would leave the secret open in every world. Its definition has no world argument, so its refusals cannot depend on the data, and auditQ_sound proves that what it answers leaves the secret open. auditQ_price then computes the bill on this table. Asked alone, it refuses each of the eight query sets containing the Ashdown row, because an extreme count would expose the bit, and answers each of the seven non-empty sets without it. For a query asked alone, on this table, this auditor refuses the same sets as excludeRow, a per-query check. So on this model the ledger returned you to exit one. That is one crude auditor on one table, which is why I call the third claim contestable. Dinur and Nissim's self-auditing may use anything the attacker already knows, including past answers, and mine uses none. Reading past answers does not rescue it: past_answers_do_not_help computes that a rule checking every world consistent with one earlier row-free answer still refuses every set containing the row, because while the row is untouched an extreme answer stays possible. To answer more here, an auditor must tolerate some chance of exposure or assume a narrower set of worlds. Their self-auditor does the former, assuming the distribution is known and tracking the attacker's confidence. I have not computed how much that buys.

The verdict is relative to a prior. background_defeats_audit computes it. Suppose a public filing lets a reader know matter 2 advised settling and matter 3 did not. The value-based audit, reasoning over all 16 worlds, answers q₁. Over the worlds the reader actually considers possible, q₁ alone reveals the bit. auditQ refuses q₁, but it is exposed the same way: background_defeats_query_audit computes that it answers q₄, and a reader who knows Ashdown and matter 2 advised alike learns the bit from that answer. excludeRow answers it too (exclude_row_passes_q₄), so exit one has this exposure, though it issues no verdict of safety. Dwork and Roth name the culprit in explaining why "learn nothing" fails as a definition: "the culprit is auxiliary information" (Dwork and Roth, 2014). An auditor must assume what the world already knows, and nothing in it checks that assumption.

Exactness undersells the harm, and cost oversells the method. posterior_shift computes that the answer q₁ = 2 moves Ashdown's bit from 8 worlds in 16 to 4 in 6: from one half to two thirds, under a uniform prior. Reveals sees nothing, and audit answers; auditQ refuses, at the price above. My auditors also enumerate 16 worlds, 2^n for n Boolean rows, which is no design. Dinur and Nissim report Kleinberg, Papadimitriou and Raghavan's result that it is NP-hard to decide, given a database and a set of queries, whether exact answers fully determine an entry. That is worst-case hardness, which does not forbid easy special cases.

Exit three: blur

Answer with calibrated noise and count what you spend. Dinur and Nissim's main result is why the noise cannot be decorative: to achieve privacy against their reconstruction algorithm "one has to add perturbation of magnitude Ω(√n)", and smaller perturbation "always results in a strong violation of privacy". Dwork and Roth state the general form as the Fundamental Law of Information Recovery: "overly accurate answers to too many questions will destroy privacy in a spectacular way". Cohen and Nissim ran such a reconstruction on a production statistical-query system, in a bug-bounty test environment (Cohen and Nissim, 2018). In a simulated attack, Abowd and colleagues report exactly reconstructing 97 million person records from the published tabular summaries of the 2010 US Census, every resident in 70% of census blocks (Abowd et al., 2023).

Differential privacy (Dwork et al., 2006) is the strongest exit I know, because being differentially private, in Dwork and Roth's words, is "a property of the data access mechanism", unrelated to auxiliary information, which removes the third cost from the guarantee. It does not remove it from the reader's conclusions. The guarantee bounds one row's effect on the output, and in their smoking example a study can still change what an insurer believes about a smoker, which they do not count as a violation. If other rows correlate with Ashdown's, a reader who knows that can still shift on its bit. A budget rule based only on what has been spent also refuses independently of the data. But it does not abolish the ledger. In Dwork and Roth's words, "the epsilons and the deltas add up": the budget is a ledger of spent loss, with the same scoping question, and agents with separate budgets over one dataset compose against you exactly as separate ledgers do. What changes is the question: not whether this transcript reveals a named secret, but a bound on how far any one row's value can change the probability of any transcript, with no list of secrets and no prior in the definition.

It also costs accuracy. A practice-group table is far smaller than a census, and at a small size noise calibrated to hide one row may swamp the statistic. I have not computed this for any real table, and my file does not model noise. Hence the thesis's disjunction: for a small privileged table, the dashboard perhaps should not exist.

Why agents change the price

All this was known when the querier was a person, and part of the protection was that few people would bother. The US Supreme Court had a name for its legal cousin in a freedom-of-information case, recognising an interest in the "practical obscurity" of rap-sheet information, and saying "there is a vast difference between the public records that might be found after a diligent search of courthouse files, county archives, and local police stations throughout the country and a computerized summary located in a single clearinghouse of information" (US DOJ v. Reporters Committee, 1989). That is US federal law, on one exemption in one statute, about compelled release by government. The observation travels further: part of the bar on combination was the labour of combining, though Denning and colleagues found trackers usually easy to find, so it was never high for a specialist. My judgement, not a measurement, is that an agent asking forty refinements in a minute removes that labour for anyone holding a tool grant.

The threat model: who can cheat, and how it shows.

• The honest agent. q₂ is a routine refinement. There is no intent to monitor.
• The steered agent. A document it reads tells it what to ask. The queries are all permitted, so a permission log records nothing unusual.
• The insider who splits. Someone who knows the ledger is per agent spreads queries across agents, or across budgets. This is visible only to a pooled ledger.
• The vendor. Per-query enforcement costs less to sell than a pooled ledger, and its audit log looks better, because every line is green. The buyer and the buyer's auditor read the log. Neither is paid to subtract.

Microsoft's documentation is a useful specimen because it is careful: "Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions" (Microsoft Learn, read 02/11/2026). I allege no leak. It is the right statement about access, and it does not address what several permitted answers imply. The risk is the reader who hears "permission-aware" and concludes that inference is handled. Two agent-authorisation texts fetched for this book, the IETF draft-klrc-aiagent-auth and the OpenID Foundation's AuthZEN post, return no match for inference, aggregation, cumulative or mosaic. A word search is weak evidence, and that is the size of my claim. Chen Yueh-Han and colleagues built a monitor that "cumulatively evaluates each subtask" and report a 93% defence success rate on their own dataset, with an 87% average attack success on GPT-4o without it (Chen Yueh-Han et al., 2025). That is a ledger read by a model, on harmful-task decomposition, not inference from data.

The ledger also adds attack surface. If it names secrets, it is itself a list of what matters. An attacker who compromises it can reset spending or lock out a practice group by filling it. Two agents racing can each pass a check against a stale copy, the problem Yesterday's Permission measures. It needs its own threat model before anyone buys one.

The law had the concept, and a looser test

Three regimes, kept apart, besides the US case above.

England and Wales, privilege. In Re Edwardian Group (2017), at [32], Morgan J recounts Lyell v Kennedy (No 3) (1884), where Cotton LJ said the documents would give the other party "a clue to the advice given by the solicitor", and quotes Bingham LJ's statement of its ratio in Ventouris v Mountain: "where the selection of documents which a solicitor has copied or assembled betrays the trend of the advice which he is giving the client the documents are privileged". At [33] the same judgment records the limit from Sumitomo: the principle did not extend to copies or translations selected from the client's own documents. I read the older cases through this judgment. The cases concern documents disclosed between litigants, not statistics or agents, and I do not claim that the Ashdown subtraction waives anything or that privilege attaches to a count. The analogy I claim is structural: English law has long accepted that unprivileged parts can betray a privileged whole. How much betrayal counts is contested, and the same judgment shows the range. At [31] it quotes David Richards J in Financial Services Compensation Scheme v Abbey National: privilege does not attach to a document from which advice is inferred, "unless perhaps the inference is obvious and inevitable", which is close to Reveals. At [37] Morgan J sees "considerable arguments" for that view, applies Lyell and Ventouris instead, and separates "a definite and reasonable foundation" for the inference from what "would allow one to wonder or speculate". That line falls somewhere between Reveals and posterior_shift, so the theorem that my auditor is sound may prove less than the law would ask about, and I do not know on which side a move from one half to two thirds would fall.

EU, data protection. The Article 29 Working Party's Opinion 05/2014, adopted 10 April 2014 and advisory, not binding, lists inference among the three risks and defines it as "the possibility to deduce, with significant probability, the value of an attribute from the values of a set of other attributes". It also says: "To limit inference and linkability attacks it is necessary to keep track of the queries issued by an entity and to observe the information gained about data subjects" (WP216), in its section on differential privacy. That is the ledger, from an advisory body of regulators, twelve years ago. GDPR Recital 26 takes into account "all the means reasonably likely to be used, such as singling out". An unfriendly reading, which I think is right: a firm cannot call a statistics tool anonymised because each answer looks aggregate. The binding authority is the Court of Justice's case law on identifiability, which I could not obtain, so this reading rests on an advisory opinion and a recital and should be tested against that case law. Nothing in my Lean bears on whether any dataset is anonymous in law, and a sound auditor does not make a controller compliant. Ashdown Ltd is a company and Recital 26 speaks of a natural person, so the toy's bit is a confidentiality problem until a row is about a person. A ledger of staff queries is itself processing, which needs a lawful basis, retention limits, an answer to the access rights of the staff it records and, if a vendor hosts it, a processor and transfer analysis.

UK, data protection. Section 171(1) of the Data Protection Act 2018 makes it an offence "knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller". An agent's subtraction, at someone's instruction, raises a question under that text that I cannot answer.

What exists and what does not

Proved in general, in Aggregation.lean: no_per_query_check, no_exact_per_query_check, reveals_mono, join_low_iff_all_low (two levels only), no_window_suffices (bit-query model), audit_sound, auditQ_sound, size_limit_admits_pair (arithmetic only), leavesOpen_iff (for the 16 Ashdown worlds), q₂_ignores_row, and differencing and union_reveals (the four-matter type). Computed on this one example by decide: q₁_passes, q₂_passes, drafting_cannot_read, exclude_row_stops_q₁, exclude_row_passes_q₂, exclude_row_passes_q₄, q₁_interferes, pooled_ledger_refuses, per_agent_ledgers_miss, denial_leaks, auditQ_price, past_answers_do_not_help, background_defeats_audit, background_defeats_query_audit, posterior_shift. Proved at the one world by exhibited twin: q₁_alone_open, q₂_alone_open. ashdown_no_exact_check is general in the check and fixed at that world. #print axioms reports at most propext, Quot.sound and Classical.choice, and the file has no sorry.

Sketched, not proved: that an agent's delegation graph sets the right ledger scope; that noise is useless at the size of a practice group. That the guarantee does not depend on auxiliary information is Dwork and Roth's result, not mine.

Cited, not read: Morgenstern, Lunt, Farkas and Jajodia, Kenthapadi and colleagues, Sabelfeld and Sands, Goguen and Meseguer, and Dwork, McSherry, Nissim and Smith. I read their bibliographic records only. Hoffman and Miller, Schlörer, and Kleinberg and colleagues I know only through the papers that report them.

Does not exist, as far as I know: a law firm's agent system with a pooled, cross-agent disclosure ledger. I have not surveyed vendors, so that is absence of evidence. My file connects to nothing running and has no noise or real table.

What a metric would do

If "refused inference attempts" or "budget remaining" becomes a dashboard number, expect it to be gamed. Shorten the secret list and refusals fall. Fragment the agents and every budget looks healthy. Set epsilon high and the budget never runs out. The honest metric: for a stated list of secrets and a stated prior, the maximum shift any permitted transcript across the pooled scope can cause. It would be gamed through the list and the prior, so someone other than the operator must set them.

What formalising loses. "Privileged" is an evaluative legal status, and the file reduces it to one named Boolean. Someone must decide that a settlement recommendation is a secret and which nearby facts matter, and a checker can only audit secrets someone named. The vagueness has a function: "a clue to the advice" lets a court respond to a selection nobody foresaw, which a closed list cannot do. So a formal check should be a floor under the lawyer's judgement. Vendors and firms gain from that floor; the client may lose if a green check replaces a partner's question.

Objections

"This is a toy. Real statistics tools suppress small cells, round and add noise." Some do. Size limits are what the 1979 paper attacked, and Dinur and Nissim's bound covers perturbation below the order of √n. Verdict: partly right, since the attack needs exact or nearly exact answers. A published evaluation showing that a real matter-statistics tool, with its actual controls, resists reconstruction at practice-group scale would change my mind on small-table risk.

"Just exclude privileged data from statistics, and your chapter disappears." Right whenever you can do it. It fails for tools whose purpose is to summarise privileged material, and for relational secrets. Verdict: the best answer where it applies, and it is the theorem's first branch, not an escape from it. If firms in fact keep agents away from all derived statistics on privileged matters, my third claim has no practical audience, and I would withdraw the urgency.

"Agents summarise anyway. A retrieval agent with read access to the note leaks directly. Aggregation is a rounding error beside that." The strongest objection. Most near-term leaks will probably be direct, through over-broad grants and prompt injection, the concerns of The Hands and A Summary Is Not a Permission. I have no incident data showing inference in deployed agents. Verdict: right on the near-term ranking, in my judgement, and no reason to ignore this. As grants tighten, inference becomes the residual path, one a green permission log will not show. If tightening grants does not shift disclosed incidents towards combination, I am wrong about the order of events.

"Your third claim overrates noise. Differential privacy is rarely deployed and small-group epsilons are meaningless." I concede the accuracy cost. My answer is the disjunction: a firm unwilling to accept noise should remove the exact tool, not bolt a ledger to it. Verdict: survives, and on many tables it will mean "nothing". A sound exact auditor that answers usefully on small tables, resistant to auxiliary information, would refute the claim.

Predictions

1. By 31/12/2027, no IETF RFC or working-group draft on AI agent authorisation will define a normative check over the cumulative answers a principal or delegation chain has received. Refuted by one such text, adopted by a working group, that requires it.
2. By 30/06/2028, a peer-reviewed paper or vendor-acknowledged report will show an LLM agent inferring a restricted fact in an enterprise retrieval system purely through queries its per-document permissions allowed. Refuted if no such demonstration exists by then.
3. By 31/12/2028, none of Microsoft 365 Copilot, Google Workspace's Gemini or Glean will document a default per-tenant budget or pooled disclosure ledger for answers over tenant content. Refuted by that documentation from any one of them.

A permission answers one question: may this principal ask this? The fact you are protecting lives in the difference between two green lines of a log, and a permission system is not built to read a log for differences.

About the author: Eduardo Aguilar Pelaez is CTO and co-founder at Legal Engine Ltd. He writes on formal methods, AI agents, and the discipline of building systems that survive being walked away from.