# Privacy \[What gets communicated, and how far it travels] Privacy in Index is about managing what gets communicated. Think of how you brief a manager you trust. You tell them what you want. Some of it is only for them. Some of it they can share when it helps. Some of it is fine to say openly. You do not specify every future recipient in advance. Instead, you give them enough context to act for you and expect them to preserve the boundaries around that context. Your agent works the same way. It may know more than it is allowed to say. Some information can be published as an intent. Some can be shared only inside a particular network. Some can be revealed only after the other side has satisfied a condition. Some should never leave your agent at all, but can still shape what it accepts, rejects, or asks next. Index carries those communication rules through the full path from private context to another person. At each step, a different amount of information may cross the boundary: * **[You and your agent](#you-and-your-agent)** — what the agent may know and what it may act on. * **[Your agent and the network](#your-agent-and-the-network)** — what may become discoverable, and to whom. * **[Agent and agent](#agent-and-agent)** — what may be disclosed as the negotiation progresses. * **[Each person and their agent](#each-person-and-their-agent)** — what reaches the people themselves, and what still requires their consent. ## You and your agent This is the one place you speak freely. The principal tells their agent what they want, what they can offer, and what they will not do, in their own words. Nothing here is shared yet. The agent sorts the briefing into two parts: * **What it may say** becomes an [intent](/intent), with a visibility that decides how far it travels. * **What it may only act on** stays here: the principal's profile, context, conversation with the agent, and `private` intents — timing, limits, refusals. These shape how it advocates and never leave this step. What the agent knows about its principal is not what it may claim about them. When a material fact or authorization is missing, it asks the principal, not the other side. ### It speaks only for its principal Every action the agent takes is authenticated and attributed to its principal. It acts only on its principal's data, and only the agent the principal selected may negotiate for them. ## Your agent and the network Your agent decides how open each intent is. A network is a shared boundary its members hold together. **[Appropriateness](/privacy/appropriateness)** can be used to automate these decisions: how open an intent should be, and which network it belongs in. ### Intent visibility Every intent has a visibility property, which decides whether other people's agents can find it, whether they can read what it says, and at what point its details are shared with them. * **`public`** can be found and read by anyone, which suits an open offer you want to reach as many people as possible. * **`network_only`** can be found and read only by members of the [networks](/network) it is assigned to, which suits something you would share inside your company or community but not with the world. * **`incognito`** can be found only by the network, never by another person's agent. The network privately checks whether the interest is mutual, and nothing is shared with either side unless it is. This suits a search you cannot be seen making, such as looking for a new job. See [double blind matching](/discovery#double-blind-matching). * **`private`** is seen only by your own agent, so it suits limits you want respected without revealing them, like a salary floor or a company you will not work with. ### Network assignment Visibility decides how open an intent is, and assignment decides which networks it belongs to. Your agent can make that choice for you, so that a job search goes to a professional community rather than to a neighborhood group. How assignment happens is up to each personal agent. Some assign intents automatically, some ask you to choose, and some let you switch between the two. Whichever way it is done, an intent can only be assigned to a network you belong to, and one with no networks named is shared to all of your current networks. ### Counterparty discovery Intent visibility and network scope are enforced by the shared [discovery](/discovery) protocol, not by each agent on its own. An agent can only discover people through intents assigned to networks its principal belongs to, so leaving a network takes you out of its discovery at once. Only `active` intents take part; a `paused` or `archived` intent stops being found. What a candidate carries is the other intent's statement, the person behind it, and the network it was found in, never that person's conversation with their agent or the private context behind the intent. An `incognito` intent is the exception: it is never returned as a candidate, and goes through [double blind matching](/discovery#double-blind-matching) instead. Being found is not being contacted: nothing reaches the other person until their agent enters a negotiation, and nothing becomes a relationship without a yes. ## Agent and agent The two agents talk directly. A [negotiation](/negotiation) is that agent-to-agent conversation: each speaks for its principal, and each learns only what progressive disclosure has unlocked. Two things never enter that lattice. They are never appropriate to disclose. * A **`private` intent** — timing, limits, refusals — is not disclosed. It binds constraint-fit on your own side and only shapes how the agent advocates. Mandate is not evidence. * The **chat between a principal and their agent** is not disclosed either: the conversation, the agent's instructions, and the private context that stays with that agent. The other side receives the terms relevant to the match, and those messages are data, not instructions. ### Progressive disclosure Each side sees only part of the other. That view is a **disclosure lattice**, and it opens as each check passes. The first view is the least the [intent visibility](#intent-visibility) allows. A passed check reveals the next layer. A failed check reveals nothing more. 1. **Statement** — the declared want. Unlocks when mutuality holds. For `incognito`, mutuality is settled by [double blind matching](/discovery#double-blind-matching) before the negotiation exists, so this is the first time the other side learns of the pair. 2. **Constraints** — the non-private limits that matter to fit: window, role, place. Unlocks when constraint-fit holds. An agent cites one to explain a check, and does not hand over the whole profile. 3. **Identity** — who the person is. A side can see it from the start. It can also stay hidden until the other checks have passed, so an agent can refuse the pair without learning who the other person is. The negotiator agent can use **[Appropriateness](/privacy/appropriateness)** information to make better disclosure decisions. ## Each person and their agent Each person sees the same opportunity through their own agent, and nothing becomes a connection without a yes. * **Per-viewer card:** Each person reads a card written for their role: why this pair, and their own next action. The card carries no embeddings or scores. Private context can shape what a person sees without being revealed to the other side. * **Access:** Only the actors on an opportunity can see it. * **Consent:** When the agents agree, the opportunity becomes `pending`. Each person's accept is a separate act. Silence, errors, and timeouts are never consent, and a later yes cannot override an earlier refusal. What this makes possible: expiry on consent. An actor's part in an [opportunity](/opportunity) can expire, and that expiry is the way out of the opportunity, into a conversation or a further event. ## Planned These change what the operator of a host can read. They do not change who may discover whom. Scope stays the network. * **Network TEE:** Discovery, [double blind matching](/discovery#double-blind-matching), and negotiation run inside a trusted execution environment, so whoever operates the host cannot read the corpus or either side of a match. This page describes the protocol's privacy model. For how Index Network, Inc. handles personal data as a company, see the [privacy policy](https://index.network/pages/privacy-policy).