Auditing Write-Path Privacy in Shared Agent Memory: Source Counterfactuals and Authorized Sharing

We audit how private messages enter shared agent memory and implement a restricted release interface for useful collaboration. A scheduling task may authorize an absence to be shared without authorizing its reason. Matched source replacements and non-injected questions test this boundary. On 16 fixed personas, judge-detected borderline-fact exposure is 0.875 for profiles and 0.594 for digests; model-assisted adjudicated reference rates are 0.922 and 0.719. Independent human reannotation retains a pooled profile-minus-digest contrast of 0.094 over 48 personas. Software cases trace storage, retrieval, and publication: five of twenty audited open-source workspace assistants exhibit the unbound configuration as shipped or by default, and two assistant deployments merge private messages into shared state in their tested defaults. An openclaw pilot exposes a private target in 3/4 channel-requested digests against 0/4 source-placebo digests. In 128 scheduling trajectories across four configurations, the two shared-workspace configurations let protected names reach a reader holding only the saved digest, while both audience-separated configurations show no detected disclosure on complete-evidence units. Native isolation already supports useful sharing, and an owner-confirmed release interface is not established as superior. External checks (the full public MuPPET and AgentLeak releases and an official-code CI-Work reconstruction) find AgentLeak leakage at 0.845 unbound and 0.441 under a prompt policy, reduced to 0.023 by a trusted pre-consolidation scope. The contribution is a reproducible audit and executable task-specific configuration evidence, not a general defense; simulated transport, ideal owner approval, and automated labels limit deployment claims.