Exposure wasn’t detected. It was cryptographically impossible — and here’s the proof.
NoData doesn’t secure retrieval. It computes whether plaintext is allowed to exist.
One layer before your retriever — the model only ever sees the slice it’s cleared for; everything else never becomes plaintext. No architecture change.
Most RAG architectures rest on a decision layer that picks what to retrieve — from information the system can already read.
NoData changes the model: authorization isn’t a filter over the data — it’s the cryptographic condition that lets the data exist as plaintext at all.
Even if every control layer fails, there’s no plaintext to pull. And every access — and every non-access — is a signed receipt you verify without trusting us.
Where it slots in
conventional RAG
Documents
↓
Embedding
↓
Vector DBplaintext
↓
Retrieverpulls all
↓
LLM
↓
🛡️Guardrailsonly control
The control is at the end. Everything above it is already plaintext. One step fails → exposure.
NoData RAG
🔒Encrypted Capsulesciphertext
↓
⬡Access Computethe gate
↓
Approved fragmentspermitted only
↓
LLM
↓
✓Signed proofsaw / never saw
The gate is at the front — before any plaintext exists. What’s forbidden was never decrypted.
RAGTraditional RAG asks: how do we stop the model from seeing something forbidden?
NoDataNoData asks: how do we stop unauthorized information from ever becoming visible at all?
Three steps
On the same primitive Fabric and the console use — no new engine.
1
Give the agent a clearance (grant)
Once: which fields and classifications the agent may see. Returns grant_token — its identity.
Instead of letting the retriever return everything: NoData returns the slice the agent is cleared for. Disallowed fields never decrypt, and every read signs an audit row.
const res = await fetch(
'https://nodatacapsule.com/api/agents/support-bot/read?receipt=true',
{ method:'POST',
headers:{ Authorization:'Bearer ndca-…', 'content-type':'application/json' },
body: JSON.stringify({ table:'kb_articles', columns:['title','body'],
where:{ topic:'billing' }, limit: 8 }) });
const { rows, audit } = await res.json();
// rows = only what this agent may read (denied fields never decrypted)
// audit = signed proof — for what it saw AND what it never could
3
Feed the LLM only that
The model gets a clean, permitted-only context. The classification travelled with the data — you didn't trust the prompt.
const answer = await llm.complete({ context: rows, question });
// The LLM never saw a byte it wasn't cleared for.
// Tip: use POST /api/access/compute first (action:"read") for a dry-run
// "may I?" BEFORE you retrieve — a decision, with no data released.
⚡10,000 API calls free every month · then $0.25 / 1,000
The mechanism: the one primitive — compute(subject, information, intent, state) → {decision, view, proof}. The same oracle (lib/access/decide.ts) behind /access/compute and /agents/{handle}/read. It works for Copilot, MCP, and A2A too — RAG is just the first door.