Data and Privacy

Local signals

Claude/Codex sessions, Granola meetings, local repos, Obsidian vaults, and scripts can produce signal on the user's machine.

Company records

Approved proposals, wiki pages, source references, actions, and audit receipts belong to the selected workspace.

Promotion boundary

A local signal becomes company data only when the user or workspace policy approves it.

localOnly

Use true when an event should stay on the machine and never sync to a workspace.

containsCompanyData

Use true when the event includes workspace, customer, source, or business context.

containsPersonalData

Use true when the event includes personal information.

redaction

Use summary_only or redacted when raw content should not be included in the event.

consent

Records whether consent is not required, granted locally, granted by workspace policy, or still pending.

Multiplayer OS does not need to own every model call. A producer can run inference locally or through a customer-approved provider, then submit the judged event. The event should still record enough inference metadata for review and audit.

• none when no model inference happened.
• local_model when inference stayed on the user's machine.
• user_agent when the user's AI tool produced the judgment.
• workspace_provider when the workspace-approved provider handled inference.
• mos_cloud when the managed platform handled inference under workspace policy.

Source references let reviewers inspect provenance without embedding every raw source into an event. Prefer pointers, excerpts, and summaries over wholesale uploads.

• Use git for repos, branches, commits, and pull requests.
• Use local_file for local context that should stay on the machine unless approved.
• Use drive, url, app_db, or s3 for managed source records.
• Mark sensitive source references as redacted when the reviewer should know the source exists but not receive raw content.