CAIN-42 CAIN StudioAGENTIC AI 75 · #65
Work–personal data separation for mobile agents
Android Enterprise described controls preventing personal agents from accessing corporate data.
Last reviewed 2026-11-11
Agentic AI 75 / #65
2026 status: Enterprise platform announcement · Category: Mobile security
The 2026 development
Android Enterprise described controls preventing personal agents from accessing corporate data.
The governance gap
A separation control is only real if the data path enforces it. If the agent can read a work profile through a share sheet, clipboard or accessibility service, the policy is decorative.
Where CAIN-42 fits: Moat 2 — Security-Context Continuity
Core question: Does authority survive every boundary? Identity, scope and delegation are carried across tools, agents, memories and systems.
Enforce the boundary at the data and identity layer, not only in the UI. Work data carries a tenant tag; the agent's context is filtered by that tag; the tool call is checked against it.
How the wiring works
- Tag work data with a tenant and a handling class.
- Filter the agent's readable context by tag.
- Block cross-boundary share, clipboard and screen capture.
- Record every boundary decision.
What is real today
PROPOSED A design mapping only. No dedicated implementation exists yet; do not buy this as a finished control.
No Android Enterprise or mobile data-path implementation exists here. This is a boundary design.
| Component in this repository | What the module says it is |
|---|---|
cain/argus/memory_firewall.py | CAIN ARGUS — memory-to-authority firewall (Prompt 14, section 12). |
cain/spiffe.py | CAIN Trust Fabric - SPIFFE / SPIRE Workload Identity Bridge (Phase 3) |
cain/argus/envelope.py | CAIN ARGUS — Behavioral Authority Envelope (Prompt 14, section 6). |
Descriptions are the first line of each module's own docstring, read without importing it. A module path is a pointer into this repository, not a hosted endpoint. Its existence is checked by the test suite; its status for this use is the label above.
Check it yourself
- Run the live memory-sanitisation demo
/memguard-keystone - Fire a live decision through the CAIN-42 pipeline
/fabric/try— the same enforcement path every product sits behind.
Commercial package
| Offer | Mobile Data Boundary Review |
|---|---|
| Buyer | Mobile-platform vendors and enterprise mobility teams |
| Price (proposal) | $5,000–$12,000 per review |
| Bundle | Memory & Context — Memory that cannot launder authority. |
| Operator stream | Stream 2 of the 10-stream operator playbook |
Agent-platform teams, enterprise AI governance, regulated data owners is the bundle buyer. The entry offer for this bundle is Memory authority audit; hosted memory-sanitisation pilot; the range is $2,500 per audit; metered from $0.0002 per inspection. A price on this page is a proposal, not a validated rate, and no customer is claimed.
Buy this as a product or service
CAIN-A75-065 — Mobile Data Boundary Review DESIGN
A design-partner statement of work and architecture: authority boundaries, evidence points, and a build plan. No control is delivered and no integration is claimed.
Kind: Assessment · Price (proposal): $5,000–$12,000 per review · Lead time: 15 business days.
Open the product page · all 75 products
What this page does not claim
What this page is not. CAIN-42 is not affiliated with, endorsed by, integrated into, or shipped with the organisation named in the 2026 item. The item is public context; the page describes how CAIN-42 would govern that class of capability. No page here claims a customer, a partnership, a certification, a patent, or a production integration. Prices are proposals. Built by a three-person team.