Every agent on ibl.ai now carries a Privacy tab with two sub-tabs — PII Filtering, which detects thirteen categories of personal information and allows, redacts, masks or blocks them before the model sees the message, and Incognito, which decides whether conversations with that agent reach chat history and memory at all — on a platform where you own all the code and the data.
The platform shipped Incognito into the OS interface (iblai-os-spa 0.163.0) and the SDK (@iblai/web-containers 1.37.0–1.38.0) the week before, recorded in the October 9 platform update.
The screens and the four-tier resolution landed in the iblai/vibe toolkit on October 8, 2026 and shipped in v2.12.0 on October 12, 2026.
PII filtering itself is older: the agent Privacy tab was first documented in the toolkit on May 25, 2026 (v1.2.0), then with three actions rather than four.
What happens to a Social Security number typed into a chat?
Whatever the agent's administrator decided. PII filtering is a per-agent capability with its own switch at the top of the sub-tab: "Automatically find and hide personal information — names, emails, phone numbers and more — in messages before the agent sees them."
Filtering runs on the way in, before the text reaches the model. An Also filter AI responses toggle runs the same detection over the agent's output on the way out.
When PII is detected offers four actions, each with its own on-screen description:
| Action | What reaches the model |
|---|---|
| Allow | The message, untouched. Detection still runs, for monitoring or auditing without altering what people write. |
| Redact (default) | The value replaced with its type — Email [EMAIL_ADDRESS]. |
| Mask | The value hidden behind asterisks. |
| Block | Nothing. The message is rejected and the block message you wrote is shown to the person instead. |
Choosing Block reveals a Block Message field, so the refusal is your institution's wording rather than a generic error.
Entity Types is a row of thirteen chips — Person, Email, Phone, SSN, Credit Card, Location, Date / Time, Passport, Driver's License, IP Address, IBAN, Medical License and Bank Number. Select none and the hint reads "Using defaults."
Who decides whether a conversation is saved at all?
Four tiers do, and the Incognito sub-tab is one of them. Incognito keeps a conversation out of chat history and memory; the question of who may turn it on is answered in this order, highest first.
| Tier | Who sets it | Where |
|---|---|---|
| Agent policy | Agent administrator | Agent → Privacy → Incognito |
| Organization gate | Administrator | Account → Advanced → Allow users to control chat privacy |
| This conversation | The person chatting | The Incognito toggle in the chat header |
| User default | Each person | Profile → Privacy |
The agent tier is three radio cards. Users Decide leaves it to the person. Always Incognito makes every conversation with that agent incognito, for anyone, and locks the header pill on.
Never Incognito removes the toggle for that agent — and people whose own default is Incognito are saved anonymously instead, rather than silently losing the protection they chose.
One control writes both underlying flags in a single save, so the contradictory "always and never" pair cannot be configured from this screen at all.
How does an application know which tier won?
It asks. Over the platform's REST API, one endpoint resolves all four tiers for a given organization, user, agent and session, and answers three things: the resolved mode, the source that decided it, and whether the result is locked.
The three modes are normal, anonymized and disabled — and disabled is Incognito. That resolved answer is what lets a chat header render an honest locked state with a tooltip explaining which tier decided, instead of a toggle that quietly does nothing.
Saving an Incognito card also refreshes that resolution and the agent's public settings, so an open chat's pill locks, unlocks or disappears without a reload.
What does Incognito actually withhold?
The message text. No chat-history row is written for an incognito turn and nothing from it feeds memory — and a chat started in Incognito is created with no owner at all, so the guarantee rests on a missing ownership record rather than a flag someone can flip back.
Each turn is still recorded against the user for usage, so an incognito conversation still counts against consumption. What Incognito withholds is the history row and the memory write.
Turning Incognito on mid-conversation is the one action that asks first, because it is the one that is easy to misread — the earlier messages do not disappear.
Turning it back off, and either direction on a chat with no messages yet, act immediately with a toast.
Once an ownerless incognito chat holds messages it can never be converted back: the toggle locks, and its tooltip points the person to a new chat.
Can a person set their own default rather than per chat?
Yes. The Privacy tab of each person's own profile sets a default Incognito setting across three options — Normal, Anonymized and Incognito — with the platform's own description of each on screen.
Anonymized is the middle ground that is easy to miss: conversations are still saved for context, but stripped of the identifying account information.
That tab is the successor to the Default Private Mode panel covered in User Profile and Organization Settings — same place in the profile, renamed, and now one tier of four rather than a standalone preference.
What happened to Private Mode?
It is called Incognito now, on every surface: the chat toggle, the agent's Privacy tab, the profile tab, the toasts and the dialog. The agent-level switch also moved — it used to sit among the capabilities on the Settings tab and is now the Incognito sub-tab beside PII Filtering.
Three underlying wire fields keep their older names — disable_chathistory, disable_privacy_mode and chat_privacy_mode — so nothing built against the API breaks on the rename.
That is the kind of detail a platform you host yourself can afford to get right, because the upgrade is yours to schedule.
Which of these can an administrator lock down?
All of them, field by field. With role-based access control enabled, seven fields on this tab carry independent permissions — the PII capability switch, the action, the block message, the entity list, the response filter, and the two Incognito flags.
A field someone may read but not write renders disabled rather than hidden, and when nothing on the tab is readable it shows a single notice instead. Members typically see Incognito read-only and no PII Filtering at all.
Underneath the agent's own policy sits the organization gate in Account → Advanced. With it off, user control disappears everywhere — no Incognito sub-tab, no profile Privacy tab, no chat toggle.
Unless an agent's policy already decided, the resolver then answers normal and names the organization as the tier that decided.
What does this change for a regulated buyer?
It moves two decisions a compliance team actually gets asked about — what personal data reaches the model and what gets retained — out of a model vendor's console and onto screens inside a deployment you control.
Both are per agent, which matters more than it sounds. An intake agent handling applicant records and an internal research agent do not need the same retention posture, and a single organization-wide switch forces the stricter one onto both.
The PII filtering panel is documented in Agent Settings: Privacy. Both sub-tabs ship as the iblai-vibe-agent-privacy skill in iblai/vibe, with the chat toggle in iblai-vibe-incognito — 68 releases from v1.2.0 on May 25, 2026 through v2.12.0 on October 12, 2026.
Apps built with Agentic Vibe mount the same components; Agentic OS runs them today.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.
Want to see agent-level privacy controls on your own stack?
We can walk your privacy and security teams through PII filtering, Incognito policy and the four tiers that resolve it, on infrastructure you own. Book a 30-minute demo or talk to the ibl.ai team — ibl.ai is family-owned and operated from New York, NY.