Access to a private document means the agent may use it for an authorized purpose. It does not mean the document's bytes may be sent to a third-party search service. The web query is an outbound disclosure. The URL, query string, tool arguments, logs and provider retention behavior all matter. A query that quotes a unique clause can disclose it even if the final answer never prints it.

Private evidence may inform an answer only through a permitted egress boundary
Private evidence cannot cross an unapproved outbound tool boundary.

I would label the document with its source, tenant and egress policy at ingestion. Tool results and derived snippets carry that provenance into context and proposed tool calls. Before public search, an executor evaluates the outbound payload and destination under a policy for the current task and principal. The model's “I think it is generic” is not an authorization decision. A strict keyword block is also insufficient: a paraphrase, embedding, hash or distinctive combination of facts may still reveal sensitive information. The practical boundary is to give the public-search tool a separate context that lacks private text, or pass only approved broad concepts such as “standard supplier termination notice periods,” then compare results locally inside the tenant boundary.

The answer can still be useful. Search public sources using non-sensitive terms, fetch the current public evidence, and compare it with the internal clause inside the private execution environment. The final response to the authorized user may quote the contract if that user's permissions allow it. The external search provider never needed those bytes. If the comparison genuinely requires disclosing a snippet to an external service, use an explicit, narrowly scoped approval or an approved provider contract and record what left, where, why and under which authority.

The hard case is derived information. A query like “supplier requiring 37-day notice for plant Q” may uniquely identify a confidential deal without copying a sentence. We need a policy that reasons about classes of data and context, and perhaps a human review path for unusual high-sensitivity queries. We cannot prove perfect non-disclosure with a generic string filter. OpenAI's agent safety guidance describes private-data exfiltration through downstream tool calls as a risk, including untrusted content. Here the model may be following a legitimate request. The same egress boundary is still needed.

Log the decision without logging the full secret in ordinary telemetry. Record the proposed outbound query digest, destination class, decision, approver if any, source labels and a protected audit reference. Test direct quotes, paraphrases, URLs with encoded text, query expansion, retries and fallback search tools. If one tool is blocked, the agent must not find an unreviewed alternate tool that sends the same data. A relevant incident note tells the agent to upload private logs. Where do you stop it? asks where an injected instruction to upload logs is stopped. This asks why individually permitted tools do not compose into an unrestricted information channel.