Private by architecture, not by reassurance

A promise that public intelligence will not inspect private context is weaker than an architecture where the public surface has no private retrieval capability at all. Good boundaries make the safe behavior the default rather than a preference.