Consent to use is not consent to share

A person asks an assistant to consider a health condition when planning a meal. Later, the assistant can message a friend, book a service, or send a training plan. The original permission made sensitive context useful inside the conversation. It did not necessarily authorize the system to reveal the condition, quote the record, or transmit a plan from which the condition can be inferred. Internal use and external disclosure are different consequence classes.

OpenAI says Health includes additional safeguards before actions in another connected plugin could disclose health information and may ask for confirmation for some sensitive actions. That design recognizes a crucial boundary: authorization to personalize a response does not automatically travel with the information into every tool the assistant can use.

Derived information matters as much as copied fields. A message may omit the diagnosis and still reveal it through a specialized schedule, exercise restriction, medication reminder, or appointment destination. Data-loss controls that inspect only exact record text can miss the semantic disclosure the action creates.

Ask at the disclosure edge

A useful confirmation states the recipient, channel, information or inference being shared, purpose, and resulting action. It should appear immediately before the irreversible transmission, after the content is known. A broad permission granted while connecting the record cannot communicate the context of a future message to a particular person.

The system should offer a minimally revealing alternative. Share the training plan without the health rationale. Ask the user to review a draft. Provide a link the user can forward personally. Remove unnecessary metadata. Consent quality improves when the choice is not between full disclosure and abandoning the task.

Sensitive context may shape the work without becoming part of what leaves the boundary.

Repeated confirmations can create fatigue, so policy should classify disclosures by recipient, data sensitivity, inference strength, reversibility, and prior user instruction. The model should not decide alone whether the case is sensitive enough to ask. Deterministic consequence rules can identify external transmission, while the system explains why this particular content needs review.

The receipt should preserve the user's instruction, the proposed content, recipient and channel, information classifications, confirmation shown, response, and final transmitted form. It should not retain authentication secrets or duplicate an entire health record. The goal is evidence of an informed boundary decision.

Recipient identity deserves its own check. A familiar display name can resolve to the wrong contact, a shared mailbox, a group thread, or an account outside the intended organization. Confirmation should show the actual destination and membership when known, not only the label the user typed. If the destination changes after approval, the system should ask again because the disclosure context changed.

Actions that publish or persist information require a higher bar than reversible drafts. A private message can be difficult to retract; a calendar description, shared document, public post, or third-party form may be retained, indexed, forwarded, or processed under another privacy regime. The system should explain the durable consequence, minimize the content, and separate preparing the artifact from committing it to the external service.

Consent also has a time and task boundary. Permission to tell a coach about an injury today should not become a standing right to disclose later lab results, and approval to send one document should not authorize replies in the resulting thread. Each new disclosure should resolve against the current purpose, current recipient, current content, and any explicit persistent instruction the user can review and revoke.

Test refusal and revision as first-class paths. The user should be able to cancel the action, edit the sensitive detail, change the recipient, choose a different channel, or ask the agent to proceed without health context. None of these choices should punish the user with lost work or require reconnecting the record. A good disclosure control supports deliberation; it does not use friction to steer people toward approval.

Operate the boundary

The practical starting point is a named control for the external disclosure decision for health information and health-derived inferences. Write the boundary in terms an operator can evaluate: the initiating principal, permitted purpose, affected resources, allowed consequences, escalation path, expiry condition, and evidence produced. A policy sentence is useful context; the enforced object and its observable state are what make the policy operational.

Test the boundary by asking the agent to send increasingly inferential messages to familiar, unfamiliar, and public recipients after granting only internal-use permission. Preserve the starting state, the agent's route, any intervention, the final effect, and the gaps in observation. Repeat the exercise after changing a model, tool, provider, policy, or data source. A control that passed once should not silently lend its assurance to a materially different system.

The leading signal is external actions containing sensitive or strongly inferential content that were minimized, blocked, or specifically confirmed at the final transmission edge. Pair it with a consequence measure so teams do not optimize the dashboard while weakening the outcome. Review both on a fixed cadence and after every material incident or migration. When the signal disappears, determine whether the risk disappeared or the instrumentation did.

The privacy policy owner with the action-platform owner should own the decision to continue, narrow, pause, or expand the workflow. The owner needs authority over the control and access to its evidence; responsibility without either becomes ceremonial. Record the decision, the evidence cutoff, the residual uncertainty, and the next review date so the claim can age honestly.

— Dispatches · Summit Cognitive