The transcript is untrusted content
Teleport published a white paper called From Zero Trust to Agent Trust. The argument: zero trust assumed actors that are bounded, verifiable, and predictable, and AI agents are none of those. So the paper proposes three evolved principles. Verify explicitly becomes enforce continuously. Least privilege becomes bound collective autonomy, because a swarm of individually authorized agents can converge on a destructive outcome without any one of them exceeding its permissions. Assume breach becomes assume misalignment, because an agent doesn't have to be compromised to drift, it just has to be talked into it.
It's serious infrastructure thinking, and if you're wiring agents into production systems, someone in your company needs to do that work.
The part we keep turning over is smaller. The paper's sharpest tool is what it calls the lethal trifecta: an agent becomes dangerous when it can touch private data, read untrusted content, and communicate externally, all at once. Its example is prompt injection hidden in customer records, instructions an attacker planted in data the agent was authorized to read.
Here's the thing that example implies about our corner of the world: a meeting transcript is untrusted content. Anyone on the call writes to it.
Everyone you've ever met is in your prompt
Think about what a cloud meeting platform with an AI layer actually is. Recordings of your most candid conversations sit on someone else's infrastructure. Agents and assistants read those transcripts to answer questions, draft follow-ups, and update systems. Those assistants have connectors, and connectors talk to the outside world.
That's all three legs of the trifecta, standing on the most sensitive corpus a company produces. Meetings are where strategy gets said plainly, where personnel are discussed, where the number that isn't public yet gets mentioned. And the input to that corpus is open: every vendor, candidate, and stranger who joins a call adds words to a document your AI will later read as context. You wouldn't let outsiders write to your production database, but a transcript is a database anyone in the room can write to.
The paper's answer for systems like this is real engineering: ephemeral runtimes, zero standing privileges, drift detection. For the meeting layer, we think there's a simpler posture available.
Keep the candid layer out of the blast radius
Boswell records, transcribes, and summarizes your meetings on your Mac. The recording and transcript never leave the machine that captured them, and the notes are plain Markdown files. Nothing reads them automatically. There's no standing credential to a meeting archive, because there's no archive service to hold a credential to.
Run that against the trifecta. Private data, yes, that's the point of the product. Untrusted content, yes, a transcript always is. External communication: none by default. The on-device AI that writes your summary has no tools, no connectors, and no network path. If someone on a call says "ignore previous instructions" into the record, the worst it can do is show up in your notes looking odd, where the reader is you, a person. Injection with no way out isn't an exploit, it's a typo.
The paper asks for delegated permissions traceable to a human grantor and zero standing privileges. A folder of Markdown gets both by construction. When an agent needs meeting context, you hand it the paragraph, per task. The grantor is traceable because the grantor is you, pasting.
What we don't claim
Boswell is not agent infrastructure. If your agents touch production systems, you still need the identity, boundary, and monitoring work the paper describes, and no note-taking app changes that. Our narrow claim is about where the meeting layer should sit while you do that work: outside the swarm's reach. A drifted agent can only leak what it can reach, and the candid record of what your company actually said doesn't need to be reachable. It can enter the agentic world the slow way, one chosen paragraph at a time, with a person deciding.
Assume misalignment, the paper says. Fine. Assume it about the room, too. The transcript was never trusted content. Best to keep it somewhere that never trusted it either.