The doctrine

An implementation strategy for running AI agents across many gigabytes of irreplaceable personal capture, message, and financial data — without ever granting one a writable handle to any of it.

This is the doctrine every §-numbered reference in the app points at, and the same text the app ships as a PDF under Doctrine → Read the doctrine. It is written for one operator on one Mac; the figures in §0 are the ones Mockingbyrd measures for you.

§0 · Current posture

Measure these on your own machine. Mockingbyrd measures each of these on your own machine:

Permission rules in allow list
Rules in deny list
Rules in ask list
Screenpipe db.sqlite · live wal attached
Imessage chat.db
Capture files in ~/.screenpipe/data

Every rule you hold today is a permission to act. Nothing on this machine currently expresses a permission to refrain. That asymmetry — not any single grant — is the finding.

§1 · Threat model

What you are actually defending against. Not an attacker with a shell on your Mac. If that happens, none of this matters. The realistic failure mode for personal agent use is narrower and much more likely: an agent doing exactly what it was asked, to the wrong copy of something. Five paths lead there.

VECTOR	HOW IT REACHES YOU SPECIFICALLY	LOSS IF IT LANDS
Silent mutation	An agent runs `sqlite3 ~/.screenpipe/db.sqlite` to answer a question. SQLite finds an unclean WAL, recovers it, and writes to a multi-gigabyte file that has no second copy. No prompt fires — you allowed `sqlite3:*`.	Irrecoverable. Years of capture.
Injection via capture	screenpipe OCRs whatever is on screen; Beeper carries messages other people wrote. Both land in agent context as plain text. A crafted string in either is indistinguishable from your instruction.	Agent acts for someone else.
The trifecta	One session holds bulk archive read and untrusted input and egress (`curl`, `ssh`, Gmail `send_message`, Beeper `send_message`). Exfiltration needs no exploit — only a convincing sentence.	Confidential documents, agreements, credentials.
Unattended blast	A scheduled pipe runs on a fixed cycle, reading OCR text and writing to Reminders. Nobody is at the keyboard to decline anything.	Compounds silently for days.
Subsumption	`Bash(python:)`, `Bash(osascript )` and `Bash(source:*)` are already allowed. Each is a general interpreter. Any rule you add is advisory while they stand.	All other controls void.

Read this before writing any config Three of your existing grants — python:*, osascript *, source:* — can execute arbitrary code, and osascript additionally drives Messages, Mail and Finder through AppleScript. A deny rule sitting beside them stops an honest agent, not a redirected one.

§2 · Data tiers

Classify once, then let the tier decide. The doctrine only becomes operational when “original” has an address. Sort every store on the machine into one of four tiers. The tier — never a judgment call in the moment — determines what an agent may hold.

TIER	CONTENTS	AGENT ACCESS	RATIONALE
T0 ORIGINAL	`~/.screenpipe/db.sqlite` multi-gigabyte · `~/.screenpipe/data/` tens of thousands of files · `~/Library/Messages/chat.db` hundreds of megabytes · `~/Library/Mail` · Photos Library · `~/.ssh` · Keychains · `*.env` · executed agreements, signed PDFs	NO PATH, EVER Not read-only. Absent. The agent is never told these paths exist.	No second copy exists, or the copy is the legal instrument. A single write is terminal.
T1 REPLICATED	Gmail · Drive · Notion · Slack · Beeper server-side · Supabase · Cloudflare · git remotes	READ WRITE · SEND · DELETE	Recoverable, but outward-facing. A send is unrecallable even when the record survives.
T2 PROJECTION	`~/agent/derived/` — read-only extracts built from T0 by a script you run. Mode 444, sha256-manifested.	READ No write	This is the agent’s window onto T0. Regenerable at will, so its loss costs nothing.
T3 SCRATCH	`~/agent/work/` — git-tracked. Everything an agent produces lands here and nowhere else.	READ · WRITE	Disposable by construction. Version control turns every agent action into a reviewable diff.

The only legal direction of travel T0 original (originals — no path, ever) → you run the extraction → T2 projection (read-only projection, mode 444) → agent reads → T3 scratch (scratch, git-tracked)

§3 · Invariants N1–N7

Seven rules that do not bend. Each states a prohibition and the mechanism that makes it true. A rule with no enforcement line is a preference, and preferences do not survive a busy afternoon.

N1 · Never open a T0 store with a writable handle.

Reading a SQLite database is not a read. If the db.sqlite-wal is live, any normal open triggers WAL recovery and writes to the main file. The correct move is to clone the triplet first and let recovery happen on the clone.

ENFORCED BY — mode 444 + chflags uchg on originals; extraction script clones db.sqlite, -wal and -shm with cp -c before opening anything.

N2 · Never combine bulk archive read with outbound capability in one session.

Split into two profiles that cannot be loaded together. Analyst reads T2, has no network and no send tools. Operator holds curl, Gmail, Slack, Beeper, Supabase — and has no path into ~/agent/derived/.

ENFORCED BY — two settings files selected at launch; additionalDirectories scoped per profile.

N3 · Never let the agent be the thing that applies a change to T0 or T1.

The agent’s output is a proposal: a diff, a migration file, a draft, a shell script. You run it. This costs one command and converts every irreversible act into a reviewable artifact.

ENFORCED BY — everything lands in ~/agent/work/ under git; a promote script is the only path outward, and only you invoke it.

N4 · Never treat ingested content as instruction.

OCR text, message bodies, email, PDFs, web pages and tool results are data. If any of them addresses the agent, that string gets quoted back to you, not obeyed. Standing text in CLAUDE.md should say so in those words.

ENFORCED BY — quarterly canary drill (§4 P5); a planted instruction must come back reported, not executed.

N5 · Never keep a grant that subsumes the deny list.

Drop Bash(python:*), Bash(osascript *), Bash(source:*) and Bash(sqlite3:*) from the allow list. Re-add the four or five specific invocations you actually use, spelled out in full. If a broad grant must stay, accept that permissions are advisory and rely on N1’s filesystem controls.

ENFORCED BY — the PreToolUse guard in §4 P4, which inspects the command string regardless of which interpreter is running it.

N6 · Never delegate deletion.

No agent path contains rm, trash_message, trash_file, DELETE FROM, DROP, or git push --force. Deletion is the one act with no diff to review afterward, which makes it the one act that stays yours.

ENFORCED BY — deny entries plus a guard-script pattern match; trash tools removed from both profiles.

A scheduled pipe consumes untrusted OCR with nobody watching. Scheduled agents get the narrowest profile on the machine: one read source, one write target, no network, no shell.

§4 · Rollout phase 0–5

Implementation, in the order that de-risks fastest. Phase 0 is an hour and removes most of the exposure. Do not let phases 2–4 block it.

P0 · Freeze the blast radius

~1 HOUR · TODAY

Add a deny and an ask block to ~/.claude/settings.json — both are empty today.
Strip the four subsuming grants from settings.local.json, and tccutil reset with them; nothing an agent does should be able to reset your macOS privacy grants.
Move curl, ssh, rsync from allow to ask. These are your egress.

~/.CLAUDE/SETTINGS.JSON — PERMISSIONS

"deny": [
  "Read($HOME/.screenpipe/**)",
  "Read($HOME/Library/Messages/**)",
  "Read($HOME/Library/Mail/**)",
  "Read($HOME/.ssh/**)",
  "Read($HOME/**/.env*)",
  "Bash(tccutil:*)",
  "Bash(rm:*)",
  "Bash(git push --force:*)"
],
"ask": [
  "Bash(curl:*)", "Bash(ssh:*)", "Bash(rsync:*)", "Bash(scp:*)",
  "WebFetch"
]

P1 · Seal the originals

~1 EVENING

Set the immutable flag on anything that should never change again — executed agreements, signed PDFs, key material. uchg blocks writes even from processes running as you.
Take an APFS local snapshot before each capture-heavy session, so a mistake has a floor.
Record a manifest of the sealed set, so drift is detectable rather than assumed absent.

SEAL — RUN ONCE, THEN AFTER EACH NEW EXECUTED DOCUMENT

mkdir -p ~/agent/manifests

# immutable flag: blocks writes from your own uid
chflags uchg ~/Documents/Executed/*.pdf ~/.ssh/id_*

# rollback floor, ~1s regardless of volume size
tmutil localsnapshot

# drift detection
shasum -a 256 ~/Documents/Executed/*.pdf \
  > ~/agent/manifests/executed.sha256
# weekly: shasum -a 256 -c ~/agent/manifests/executed.sha256

P2 · Build the projection pipeline

~HALF DAY

Clone db.sqlite plus its -wal and -shm with cp -c. On APFS this is a copy-on-write clone: instant, and it consumes no additional space for a multi-gigabyte file until something diverges.
Let WAL recovery and VACUUM run against the clone. The original is never opened by a writer.
Ship the result at mode 444 with a checksum. That file, and only that file, is what an Analyst session sees.

~/AGENT/BIN/PROJECT-SCREENPIPE — YOU RUN THIS, NEVER THE AGENT

#!/usr/bin/env bash
set -euo pipefail
SRC="$HOME/.screenpipe"
DST="$HOME/agent/derived/screenpipe.ro.sqlite"
STAGE=$(mktemp -d)
trap 'rm -rf "$STAGE"' EXIT

# APFS clone — O(1), no extra space, original untouched
cp -c "$SRC/db.sqlite"     "$STAGE/"
cp -c "$SRC/db.sqlite-wal" "$STAGE/" 2>/dev/null || true
cp -c "$SRC/db.sqlite-shm" "$STAGE/" 2>/dev/null || true

# recovery + checkpoint happen HERE, on the clone
sqlite3 "$STAGE/db.sqlite" "PRAGMA wal_checkpoint(TRUNCATE);"

# narrow the projection: drop what the task doesn't need
sqlite3 "$STAGE/db.sqlite" "VACUUM INTO '$DST.tmp';"
mv "$DST.tmp" "$DST"
chmod 444 "$DST"
shasum -a 256 "$DST" > "$DST.sha256"
echo "projection ready: $(du -h "$DST" | cut -f1)"

P3 · Split the profiles

~HALF DAY

P4 · Enforce below the config layer

~HALF DAY

A PreToolUse hook inspects every command string for T0 paths and destructive verbs, and blocks on match — independent of which interpreter would have run it. This is what survives N5’s escape hatches.
The same hook appends to a log you can actually read on a Sunday.
If you already run a PreToolUse hook, this chains beside it.

~/.CLAUDE/HOOKS/T0-GUARD — EXIT 2 BLOCKS THE CALL

#!/usr/bin/env bash
payload=$(cat)
LOG="$HOME/agent/audit/tools.jsonl"
mkdir -p "$(dirname "$LOG")"
printf '%s\t%s\n' "$(date -u +%FT%TZ)" "$payload" >> "$LOG"

T0='\.screenpipe/|Library/Messages/|Library/Mail/|\.ssh/'
T0+='|Library/Keychains/|Photos Library|Executed/'
DESTRUCTIVE='\brm +-[rf]|DELETE FROM|DROP TABLE|--force|tccutil reset'

if grep -Eqi "$T0" <<<"$payload"; then
  echo "BLOCKED: T0 original. Use ~/agent/derived/ instead." >&2
  exit 2
fi
if grep -Eqi "$DESTRUCTIVE" <<<"$payload"; then
  echo "BLOCKED: destructive verb. Deletion is not delegated." >&2
  exit 2
fi
exit 0

§5 · Limits

What this does not buy you. Stated plainly, because a control you overrate is worse than one you don’t have. It is not a security boundary against a determined chain. An agent running as your uid with a general interpreter can reach anything your uid can reach. The controls here raise the number of independent steps a mistake must take, and make every one of them visible. That is a real reduction in expected loss. It is not isolation. If you want an actual boundary, the next step is a second POSIX user that owns ~/agent/ and has no read access to your home directory, or a VM. Everything above is compatible with that move and makes it cheaper later. Context still leaves the machine. Anything an agent reads is sent to a model provider. Projection narrowing in P2 is the only control that touches this, and it is the reason to take it seriously rather than shipping the whole multi-gigabyte view. Assumptions — Single operator, single Mac, no shared accounts. Figures in §0 are measured on your own machine from ~/.claude/settings*.json, ~/.screenpipe and ~/Library/Messages. Permission-rule and hook syntax must be verified against your installed version before being relied on — both are noted inline. Paths assume the default home layout. Open decisions for you — Whether the Operator profile keeps osascript at all · which screenpipe app names to exclude from the projection · whether a scheduled pipe moves to the narrow profile now or after P3 · whether a second POSIX user is worth the friction this quarter.

Overview

Projects

§0 · Current posture

§1 · Threat model

§2 · Data tiers

§3 · Invariants N1–N7

N1 · Never open a T0 store with a writable handle.

N2 · Never combine bulk archive read with outbound capability in one session.

N3 · Never let the agent be the thing that applies a change to T0 or T1.

N4 · Never treat ingested content as instruction.

N5 · Never keep a grant that subsumes the deny list.

N6 · Never delegate deletion.

§4 · Rollout phase 0–5

P0 · Freeze the blast radius

P1 · Seal the originals

P2 · Build the projection pipeline

P3 · Split the profiles

P4 · Enforce below the config layer

§5 · Limits

​§0 · Current posture

​§1 · Threat model

​§2 · Data tiers

​§3 · Invariants N1–N7

​N1 · Never open a T0 store with a writable handle.

​N2 · Never combine bulk archive read with outbound capability in one session.

​N3 · Never let the agent be the thing that applies a change to T0 or T1.

​N4 · Never treat ingested content as instruction.

​N5 · Never keep a grant that subsumes the deny list.

​N6 · Never delegate deletion.

​§4 · Rollout phase 0–5

​P0 · Freeze the blast radius

​P1 · Seal the originals

​P2 · Build the projection pipeline

​P3 · Split the profiles

​P4 · Enforce below the config layer

​§5 · Limits

§0 · Current posture

§1 · Threat model

§2 · Data tiers

§3 · Invariants N1–N7

N1 · Never open a T0 store with a writable handle.

N2 · Never combine bulk archive read with outbound capability in one session.

N3 · Never let the agent be the thing that applies a change to T0 or T1.

N4 · Never treat ingested content as instruction.

N5 · Never keep a grant that subsumes the deny list.

N6 · Never delegate deletion.

§4 · Rollout phase 0–5

P0 · Freeze the blast radius

P1 · Seal the originals

P2 · Build the projection pipeline

P3 · Split the profiles

P4 · Enforce below the config layer

§5 · Limits