Filed under meta
Every brief tagged "meta".
- § 01 · AI-AGENTS
Keeping an AI Agent Inside Its Personal-Information Boundaries: What Meta's PrivacyLib Shows About Making PIPL Purpose Limits Work at Runtime
On October 27, 2026, Meta described PrivacyLib, a layer of its privacy infrastructure that enforces privacy rules where backend services actually read and write data. AgentLib ties each agent tool call to its session, so the check happens even when an agent strings tools together in ways no developer anticipated. 网安寻路人 uses the disclosure to answer a question the PIPL leaves open for agents: how do you hold a system whose execution path unfolds at runtime to Article 6's purpose and minimum-necessity limits and Article 13's legal bases? The author's answer has five parts. Turn the user's task into concrete processing boundaries, set by trusted business systems rather than the model. Check every operation where data actually flows, not at the final answer. Carry provenance and use conditions onto derived content (summaries, vectors, long-term memory), and re-classify when inference yields sensitive personal information. In agent-to-agent delegation, grant only the intersection of the upstream's delegable scope, the sub-agent's own permissions, and the subtask's needs; keep control instructions apart from business data; and map each tool to its legal role under Article 21 (entrusted processing) or Article 23 (provision to another handler). And make the rules themselves current, revocable, and auditable. Five diagrams from the original are included.