Who Controls Your AI Agent? Separating the Operator from the Analyst to Close the Agentic AI Surveillance Gap

Agentic AI systems such as Open Interpreter, Claude Code, and Cursor delegate operator privileges — arbitrary code execution, filesystem access, and network calls — to cloud-hosted large language models. We argue that the industry has normalized a qualitatively new surveillance surface by conflating two fundamentally different trust models: data sharing (bounded, user-gated, discrete) and remote system control (unbounded, continuous, delegated). Every prompt, tool invocation, file content, and command output becomes observable by a single US-jurisdiction provider and legally compellable via subpoenas, search warrants, National Security Letters, and FISA §702 — with gag orders that eliminate user awareness. This threat model is no longer hypothetical. Between 2025 and 2026, chat logs were introduced as criminal evidence, a litigation-hold order overrode a provider's own deletion policy, and the first known search warrant sought to unmask a user from their prompts. The lesson generalizes: a provider's privacy policy is subordinate to a court order, and the only property that survives compulsion is non-possession — a party cannot be compelled to produce what it never held.

Existing mitigations address this only partially. Local-only systems (Ollama, LM Studio) avoid the cloud but leave a capability gap that pushes users back to hosted models for non-trivial tasks. Confidential compute (Apple Private Cloud Compute) hides content from the infrastructure operator but preserves user identity; billing-linked inference and legal compulsion remain viable. Neither approach simultaneously preserves frontier-model capability and user anonymity.

We present SnowClaw, a reference architecture that closes this gap with three composable mechanisms. First, operator/analyst decomposition: the component that selects and invokes tool calls — the operator — is pinned to a local model (Gemma 4) whose network egress is blocked by a capability-gate framework under a fail-closed rule: if a protective layer cannot verify itself active, the path it guards is disabled. Interpretation is exposed to the operator as an ordinary tool (analyst) whose backend — a local mini-analyst or a frontier cloud model — the operator cannot distinguish. Second, three-domain trust separation: cloud analyst queries travel through an entry relay, a gateway, and a token issuer operated as distinct trust domains, so that no single party ever holds both a user's identity and their content. The relay sees an IP address and ciphertext; the gateway sees de-identified text but no identity; the issuer knows who paid but not what for. This topology is deliberately equivalent to Oblivious HTTP (RFC 9458), extended with anonymous usage tokens following the Privacy Pass architecture (RFC 9576) — the standardized descendant of Chaumian blind signatures — to unlink billing from queries. The cloud analyst can neither issue tool calls back to the user's device nor learn who submitted the query. Third, an on-device reversible pseudonymization gate on the cloud path: sensitive entities — personal identifiers, credentials, hostnames, and names drawn from a device-local dictionary the cloud can never see — are detected by layered detectors and replaced with consistent, format-preserving placeholders; the substitution map never leaves the device. Detection is necessarily best-effort, so the gate is fail-closed: any query that cannot be confidently de-identified is routed to the local analyst instead of the cloud.

This calibration-free decomposition is intentional. Small local models are poorly calibrated on "can I do this?" meta-questions but well-trained on tool selection. By collapsing the local-or-cloud decision into a fixed routing policy bound to an explicit user setting, SnowClaw plays to the local model's strengths and binds the routing decision to user intent rather than model self-assessment.

The architecture is grounded in a partial reference implementation built on SnowChat — an independently developed, production-deployed end-to-end encrypted messenger using our own Pure Dart Signal Protocol implementation (X3DH, Double Ratchet, Sealed Sender) with 115 library-level tests — and follows an explicit claims-to-invariants discipline: every privacy claim maps to a machine-checkable test, and unimplemented layers are disclosed rather than implied.

Implementation status. The local operator, capability gate, structural isolation of analyst output (verified by adversarial fixtures), and the sealed-envelope relay skeleton are implemented. Three further layers are specified and scheduled: Privacy Pass token issuance and verification, the on-device pseudonymization gate, and the operational separation of the relay and gateway into independent trust domains.