Finding / paperclip
2026-10-24-paperclip-stable-enforces-private-task-reads-with-privileged-and-shared-agent-exceptions
Stable enforces private-task reads, with privileged and shared-agent exceptions. Tasks/projects remain open by default; private content uses explicit participation and inherited access across reads, search, lists, run details, documents and plugin surfaces. Agent authority is intersected with the responsible user’s current access. Sharing a child does not expose its ancestors or siblings, and revoking one grant does not remove independently valid access. Ordinary company owners/admins need an audited break-glass read with a task notice. The release headline needs qualification: the code bypasses privacy for local implicit authority and instance administrators; optional Cloud customer-success inspection is a separate permitted path without a task break-glass notice. Company aggregate totals and restricted run metadata remain visible for oversight. PAPERCLIP_ISSUE_PRIVACY_MODE defaults to enforcement but accepts shadow/off.
Channel: tagged-release. Half: both. Date: 2026-10-24.
Operator consequence: Use private tasks for control-plane read boundaries on v2026.1023.0, and test the actual user, agent, plugin and administrator principals you deploy. Check the privacy mode and inspection setting. Do not interpret a private task as isolation from a trusted agent that can copy learned content into shared memory, home directories or external tools; the tagged design explicitly excludes that guarantee. This supplies an enforceable primitive beyond a private-looking dashboard, while leaving execution trust and administrator access as separate decisions.
Receipt
- https://github.com/paperclipai/paperclip/blob/v2026.1023.0/doc/ISSUE-PRIVACY.md
- https://github.com/paperclipai/paperclip/blob/v2026.1023.0/server/src/services/authorization.ts#L538-L658
- https://github.com/paperclipai/paperclip/blob/v2026.1023.0/server/src/services/authorization.ts#L2634-L2671
- https://github.com/paperclipai/paperclip/blob/v2026.1023.0/doc/CUSTOMER-SUCCESS-INSPECTION.md
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-paperclip-stable-enforces-private-task-reads-with-privileged-and-shared-agent-exceptions
Source links
Primary links, including exact changelog lines when available.
- tagged commit file2026-10-24-paperclip-stable-enforces-private-task-reads-with-privileged-and-shared-agent-exceptionspaperclipai/paperclip / doc/ISSUE-PRIVACY.mdtagged commit file2026-10-24-paperclip-stable-enforces-private-task-reads-with-privileged-and-shared-agent-exceptionspaperclipai/paperclip / server/src/services/authorization.ts#L538-L658tagged commit file2026-10-24-paperclip-stable-enforces-private-task-reads-with-privileged-and-shared-agent-exceptionspaperclipai/paperclip / server/src/services/authorization.ts#L2634-L2671tagged commit file2026-10-24-paperclip-stable-enforces-private-task-reads-with-privileged-and-shared-agent-exceptionspaperclipai/paperclip / doc/CUSTOMER-SUCCESS-INSPECTION.md