## What Privacy in Nuggets Is - and Is Not

### Privacy in Nuggets Is

- Privacy by design, enforced at the point of action
- Data minimisation through cryptographic proof rather than inspection
- Selective disclosure based on necessity, not convenience
- Auditability without full data exposure
- Compatibility with strict regulatory and jurisdictional requirements

### Privacy in Nuggets Is Not

- A data storage platform
- A personal data vault
- A consumer data management system
- A centralised repository of personal information

Nuggets does not require organisations to pool, retain, or expose raw personal data in order to establish trust.

## Why Privacy Breaks in Autonomous Systems

As AI systems become autonomous, they increasingly act on sensitive information across tools, clouds, and organisations. Traditional approaches to trust and compliance rely on:

- collecting more data
- storing more logs
- retaining more context “just in case”

As autonomy scales, this approach creates significant risk:

- expanded attack surfaces
- higher breach impact
- conflicts between auditability and privacy obligations
- regulatory exposure across jurisdictions

In autonomous systems, trust cannot depend on data accumulation. It must be proven without excessive data exposure.

## Privacy-Preserving Trust as a Solution

Nuggets enables organisations to prove that actions were authorised and compliant without requiring access to raw personal data. Instead of centralising information, Nuggets focuses on:

- verifying authority rather than inspecting content
- producing cryptographic proof rather than retaining sensitive records
- enforcing consent and policy without persistent data collection

This allows autonomous systems to operate responsibly while preserving privacy by design.

## How Privacy-Preserving Trust Works

### Authority Without Data Exposure

Human and organisational decisions - including consent, delegation, and constraints - are defined in advance and issued as verifiable credentials. At runtime:

- agents present cryptographic proofs of authority
- Nuggets verifies validity and applicability
- actions are permitted or denied

The underlying personal data does not need to be accessed, stored, or exposed to the trust layer.

### Proof Without Disclosure

For each evaluated action, Nuggets generates cryptographic evidence proving:

- valid authority existed
- applicable policies were enforced
- consent requirements were met

This evidence demonstrates control and compliance without revealing what data was processed.

### Consent That Travels With Actions

In autonomous systems, consent must be:

- explicit
- contextual
- enforceable across system boundaries

Nuggets binds consent to authority as verifiable credentials. When an action is attempted, consent is evaluated automatically alongside policy and intent - ensuring that personal data is only accessed within approved boundaries. Consent is preserved as cryptographic proof, not as retained personal information.

## What Problems This Solves

Privacy-preserving trust enables organisations to:

- minimise retention of personal data
- reduce breach and insider-risk exposure
- satisfy data-minimisation and purpose-limitation requirements
- support cross-border and cross-regulatory deployments
- reconcile auditability with privacy obligations

This is critical for deploying autonomous AI in environments subject to strict privacy regulation.

## How This Fits With the Nuggets Trust Model

Privacy-preserving trust works alongside:

- **Verifiable Actor Identity** - establishes accountable actors
- **Action Authorisation for Autonomous Systems** - enforces limits at runtime
- **Human Authority & Oversight** - defines consent and boundaries
- **Provable Compliance** - enables audit without disclosure

Together, these allow organisations to scale autonomy without centralising personal data.

## When to Use This Approach

This approach is appropriate when:

- autonomous systems handle personal or sensitive information
- privacy regulation applies across jurisdictions
- data minimisation is a hard requirement
- trust must be proven without exposing underlying data

If your AI systems must act on sensitive information while preserving privacy, privacy-preserving trust is essential. For detailed technical specifications and implementation guides, explore our full documentation.