Conversation Privacy and Cross-Client Disclosure Guardrail Automation: One Client's Name, Inside Another's Group

A safeguard built once, for one specific tool, protects exactly that tool — nothing else automatically inherits it, no matter how obviously the same logic should apply elsewhere. Axis's financial tools already enforced "never discuss this with a client present," a rule written specifically because financial detail belonging to one client has no business surfacing in front of another. The client-notification tool sits right next to those financial tools conceptually, does something just as capable of exposing one client's information to another, and simply never had the same rule written into it — not because anyone decided it didn't need one, but because it was a separate piece of code that nobody had gone back to check.

The incident traced in this investigation started with an ordinary mistake: someone typed a request into the wrong group — one where a client was actively present — and then deleted it, presumably realizing the error right away. The deletion happened at the level a person can see: the message itself vanished from the conversation. It did not happen at the level the AI assistant's own processing queue operates at — the request had already been queued with its content captured at the moment it arrived, and nothing re-checked whether the message behind it still existed by the time the assistant got around to acting on it. The assistant answered as if the mistaken request still stood, and in doing so, confirmed inside that client's own group that it had notified a completely different client, by name — disclosing that other client's name, their status as a client of the agency, and the existence of their own private group, to someone with no legitimate reason to know any of it.

The deeper cause was not the deleted message alone — it was that the tool responsible for notifying a client had never been given the same guard Axis's financial tools already carried: refuse outright whenever a client is present in the conversation making the request. That gap meant even a CORRECTLY intentioned request, typed in the wrong group by simple human error, had no independent check standing between the mistake and the disclosure it caused.

The fix closes this at three independent layers, deliberately not relying on any single one alone. First, the notification tool itself now checks whether a client is present in the calling conversation and refuses outright if so — the same category of guard the financial tools already had, extended to cover a capability just as capable of leaking one client's information to another. Second, the assistant's own operating instructions were updated specifically for the client-present case: naming another client from the roster is stated as never acceptable, even said in passing, even to confirm that something routine was already handled. Third, and specifically to close the exact path this incident took: a queued action is now re-validated against its own originating message immediately before the assistant acts on it — if that message was deleted in the time between being queued and being answered, the action is discarded outright, with its own explicit, named reason recorded, rather than proceeding as if the request still stood.

A second, related leak surfaced in the same investigation, sharing the identical missing-filter root cause on a different, adjacent surface: the query behind a conversation list's own preview line — the short snippet shown next to each conversation before it's opened — did not exclude a deleted message from consideration. If a deleted message happened to be the most recent one in a conversation, its actual content kept appearing in that preview line, even though the conversation itself, once opened, had always correctly shown "message deleted" instead. The fix adds the identical filter to the preview query, which now naturally falls back to the last message that was not deleted — the same discipline the open thread already enforced, extended to the summary view that sits in front of it.

Someone on the team means to ask the internal assistant, in the team's own private channel, whether a different client has already been notified about something — but types the request into the wrong group by mistake, one where a client is actively present, and deletes it seconds later on realizing the error. Before the fix, the assistant's own processing queue had already captured the request before the deletion, and answers it anyway, confirming inside the present client's own group that the other client had been notified — naming them directly. After the fix, the assistant re-checks the originating message immediately before responding, finds it deleted, and discards the action outright — nothing is said, and no name crosses from one client's context into another's.

Centriu Axis's client-notification tool and its assistant's own instructions now carry the same client-present guard the financial tools already enforced, and a queued action is re-validated against its own originating message before acting — closing a real, dated disclosure of one client's name and group to another, plus a related conversation-preview leak sharing the same root cause.

This automation governs what an internal AI assistant is permitted to say or act on when a client is present, and how a stale or deleted request is handled — it does not change how the assistant behaves in a normal, correctly directed, team-only conversation, and it is not a general content-moderation or message-retention product.

Building a safeguard for one sensitive capability and assuming a similarly sensitive one nearby inherits it automatically is exactly how this gap persisted — the financial tools were protected, and the notification tool, doing something just as capable of crossing a client boundary, simply never received the same review. Centriu's fix treats the underlying RULE — never disclose one client's information to another — as something that has to be verified independently at every place capable of causing that disclosure, not assumed from the existence of a similar rule somewhere else in the system.