Module privacy_helpers 

String-based privacy boundary helpers.

These work with the string representation of privacy boundaries (“local_only”, “encrypted_only”, “any”, “inherit”, or empty) so enforcement logic doesn’t require the full privacy feature flag.

Functions

boundary_allows_network

Check if a privacy boundary allows outbound network access.

boundary_allows_provider

Check if a privacy boundary allows the given provider kind.

boundary_allows_recall

Check if a memory entry with entry_boundary should be visible to a query running under query_boundary.

is_network_tool

Check if a tool name is known to require network access.

resolve_boundary

Resolve a child boundary against a parent. The result is always at least as strict as the parent.