What Your Friend Knows and Your Colleague Shouldn't

I use AI assistants to write texts which I publish, and I also use them to think through things which are nobody else’s business. This article is about keeping the two apart, so that what you tell an assistant in confidence does not turn up in something it writes for the public, possibly without you noticing. Separate accounts help less than you’d expect here. The good news is that we already know how to handle overlapping contexts, as we do it with people every day.

My interest in this topic goes back to the time when I started using an assistant for longer texts. At some stage I noticed that it shared some information across all my projects, and I asked myself whether details from other projects could have found their way into the texts it had written for me. Fortunately, none had, but it could have happened.

So we’ll start with how we protect ourselves when we share information with people, and then see what changes when the other side is an assistant. This is the first of two parts. The second one looks at why we keep modeling our dealings with AI on our dealings with people.

An Example

Let’s say a product manager has used an AI assistant for a year, for private matters only. For work she deliberately uses another account with another tool. In her private account she discusses all kinds of things: vacation plans, tax questions and, every now and then, her trouble with a colleague who regularly questions her decisions in meetings. The assistant helps her sort her thoughts and suggests how she could approach the next conversation with him.

After a large project she wants to thank her team on LinkedIn. She asks the assistant for a draft which sounds personal and not like a press release, changes two words and posts it. The third paragraph thanks everyone “who believed in the project, also when it didn’t have support from all sides internally”. The sentence is accurate, yet it describes a conflict she had only discussed in private, and everyone on the team knows who it refers to. She reads the paragraph again when this colleague comments on the post.

Her first thought is that this shouldn’t have happened, as she had kept work and private matters apart.

Why Separate Accounts Aren’t Enough

Keeping a work account and a private account protects you against one specific mistake, which is that a work tool learns private things. It does not protect you against two things meeting in the private account which shouldn’t meet.

And they meet there all the time. We think about work after hours, too: about colleagues, about changing jobs, about the next salary negotiation. Applications, contract offers and resignations usually go through private addresses anyway, as they need to outlast the access to the company account. At the same time, the texts we publish are written in the same private account: the LinkedIn post, the article, the email to HR.

So the boundary which matters runs between confidential and publishable, and it runs right through the account you’d consider the safe one.

In Where Does Your AI’s Context Actually Come From? I described how an assistant assembles its context anew for every request, from the prompt, from files, from connected systems and from the web, and how combining harmless sources creates new sensitivity. That article was about companies, and its answer was that enterprise architecture already has the instruments for this. This article asks the same question for each of us, and here, too, we can build on something we know, which is the way we deal with people.

An Old Problem

If you replace the assistant with a person in your mind, the technical leak turns into a very familiar situation. I noticed this parallel on a day on which I had told an assistant some things which I didn’t want to make the rounds. On the same day, a friend told me on a walk about things at his work which certainly weren’t meant to make the rounds at his company either. My friend could talk to me about it, as he trusted that I, as the listener, would never get anywhere near his work, and I had treated the assistant in the same way. In both cases things can turn out differently than planned. My friend’s employer could become my client, and I’d suddenly be standing in a workshop room with my friend and the people from the story. And an assistant could mention something in a text which I overlook and then send it to the wrong person.

Each of us moves in many circles which partly overlap. With some people you talk about the handball club, with others about the football club, and with the two people who are members of both about the things only they understand. We tell friends about colleagues, sometimes by first name, on the unspoken assumption that these worlds will never meet. In most cases that works, and when it doesn’t, someone at the summer party mentions in passing that they’ve heard you’re looking around for a new job. So the problem with the assistant is an old problem in a new form, and we have developed mechanisms for it over a long time.

How We Protect Ourselves with People

I see five mechanisms, and they differ in how reliable they are.

Trusting the Other Person’s Judgment

Most people sense what belongs in which circle, and we rely on that, usually without thinking about it. The weakness is that not everyone has this sense, and not everyone knows where our limits are.

Telling Each Circle Only What It Needs

Everyone learns what they need for their circle. The weakness is that people change circles: the acquaintance from the club applies at your company two years later and brings along what they know.

Briefing

We say explicitly what may be told where: “This stays between us.” The weakness is that it is not up to us whether the other person remembers this and whether they want to stick to it.

Sanctions

Doctors, therapists and lawyers are bound to confidentiality by law or by contract. In Germany, a breach is a criminal offense (section 203 of the Criminal Code), and in serious cases it can cost them their license. This is the most robust of the five mechanisms, as it still works when trust and briefing fail.

Relying on Nobody Making the Connection

Sometimes we rely on the fact that hardly anyone could make the connection. Let’s say a therapist describes an unusual case in a book, anonymized and with good intentions, as others can learn from it. The patient recognizes the case at once, which is unpleasant but harmless as long as nobody else can make the connection. Two neighbors, however, have seen the patient go to the only practice in town every week, and they read the book. Each detail was harmless on its own, but together they point to one person. The therapist did nothing which is forbidden, but underestimated the remaining risk.

And with an Assistant?

Now let’s put the five mechanisms next to an assistant.

Trusting its judgment mostly drops out. A language model has a general sense of what belongs in a LinkedIn post, but it does not know what you personally don’t want to share, and it doesn’t know who is reading along. What a friend senses after years, you have to tell an assistant explicitly, so the gut feeling turns into a written rule.

Telling each circle only what it needs gets stronger, provided you know the paths. A model does not learn from your conversation while you talk to it. What reaches another conversation travels on paths you can name: the memory of the app, a search across your past chats, projects with their own files and instructions, instruction files which a coding assistant loads, and connected tools. Many providers add one more path, which is easy to forget, as they use the chats of consumer accounts to train future models unless you switch it off. Anthropic, for example, introduced this setting for its consumer plans in 2025 and announced that it keeps the data for up to five years if training is switched on. The chance that a future model repeats one of your sentences is probably small, but your data is stored for longer and is out of your hands.

These paths also lead out of the conversation. An assistant which may search the web, send an email or commit to a repository can carry context to places you didn’t plan for, and in the article on context I described an assistant which apparently searched the web for people without being asked. There are more of these paths than most people expect, but unlike with people, you can list them and close the ones you don’t want.

Briefing gets stronger, too, but it is not absolute. A model doesn’t forget the instructions in a project or a configuration file out of convenience. They only apply in the context which loads them, though, and a model can also overlook a rule which is buried among many others.

Sanctions move to another place. You cannot hold the model itself liable. The provider has made commitments in its terms of service and its privacy policy, and in Europe it’s also bound by the GDPR, which allows fines of up to 20 million euros or 4 percent of the worldwide annual turnover for breaches of data protection law. Two differences remain, though. With a therapist, the person who sets the rule, the person who knows the secret and the person who is liable are the same. With an assistant they come apart: you set the rule, the session holds the knowledge, and the provider is liable, but only for its own failures. If you gave a conversation the wrong context yourself, the provider has done everything right. On top of that, the law around AI is still taking shape. The EU withdrew its proposal for an AI liability directive in 2025, and its new product liability rules, which count software as a product, only apply to products placed on the market after 9 December 2026. They deal with injuries, damaged property and lost data, while a secret which was passed on is a different matter (as of November 2026).

Relying on nobody making the connection is the same trap as with the therapist. An assistant with a memory combines details from many conversations, and it is the mechanism I described for companies, where aggregation creates new sensitivity.

So the mechanisms you control yourself, telling each circle only what it needs and briefing, get stronger with an assistant, while those where you rely on others get weaker or move to another place. The comparison looks like this:

Trust Zones Modeled on Our Circles

You might wonder why the tools for this feel so familiar. The point is this: the trust zones of an assistant are modeled on the circles we know from dealing with people. Claude, for example, gives each project its own memory, separate from other projects and from chats outside projects, so a project is a circle which only knows what you told it there. An incognito chat is not saved and does not turn up in a later search, much like a conversation on a walk which nobody writes down. A coding assistant loads a global instruction file into every project, which is what you’d tell everyone, and a project file, which is the briefing for one circle. And a sandbox which limits an agent to one folder works like a meeting room into which you only bring the documents you want to discuss there.

I think this is good news, as you don’t need to learn a new concept. You can ask the questions you’d ask about a person: what does this circle know, what may it pass on, and who checks before something goes out?

Five Steps

The following steps do not require any special knowledge. They only require you to do consciously, once, what you do intuitively with people.

Know the Paths

Find out which stores your tool has and which of them are loaded into which context: a memory in the app, a search across past chats, projects with their own files, instruction files on your computer, and the training setting. Coding assistants, for example, often load a global instruction file into every project and one more per project. If you casually say “remember this”, you should know which of the two it ends up in, and say so if in doubt. While you’re at it, check which tools the assistant may use to send something out.

Separate Thinking from Publishing

Discuss whatever you like in your private context, including the things where work and private life meet, as this is where an assistant is most valuable. As soon as something is meant to go out, switch to a separate context, without memory or with a memory of its own, and give it only what may go out.

Write Down Your Gut Feeling

Put a clear rule into the publishing context, e.g. no statements about your own professional situation, about conflicts and about people around you. Style, tone and preferences can be described generously there, as they make the texts better and don’t harm anyone. Your own situation does not belong there, as it doesn’t make an article any better.

Keep an Internal and a Public Version

If content depends on other content, e.g. a CV and a website, keep a complete internal version and a public one. Between the two there’s a release step which you trigger yourself.

Review Every Change

If an assistant works on a larger website, it may change more than the new article. So look at all changes before something is published, also those outside the article you asked for, and let the assistant publish only when you ask it to.

My Own Setup

For my own work I give each project a sandbox of its own, which can only access a single folder in the file system. Projects with security-relevant topics run in a Docker container of their own and have no access to the global memory of the assistant. In general, I don’t share memory and settings between projects, and how I make sure of this depends on how much protection a project and its data need.

For confidential data I add two more measures. Before a text goes to the model, I pseudonymize it, which means that names are replaced by placeholders. For this I use Presidio, an open-source tool by Microsoft which detects personal data such as names, together with my own lists of names. In addition, I’ve introduced separate zones: one for work with internal systems, one for web research and one in which the results are brought together. This way a web search doesn’t carry internal information out, and content from the web only meets internal data in the zone which brings the results together.

If It Happens Anyway

Then it’s the same as with people. Even a good friend has told something in the wrong place at some stage, and some risk always remains. The difference is that with an assistant you can trace where the context came from and set things up differently next time, while with people the only option is often to tell them less in the future.

Conclusion

If you use an assistant for private matters and for texts you publish, the boundary which matters runs between confidential and publishable, and separate accounts do not draw it for you. With people we handle the same situation every day, by trusting their judgment, by telling each circle only what it needs, by briefing, by sanctions and by relying on nobody making the connection. With an assistant, the mechanisms you control yourself get stronger, and the tools of the providers follow the circles we know. So the main work is to set up these circles once: know the paths, think in one context and publish from another, write down the rule you’d otherwise keep in your head, and check every change before it goes out.

In the second part I’ll look at why we keep modeling AI on the way we deal with people, from trust to the division of work among agents, and what this means for how much control we keep.