I Almost Built a Second Search Index—Then I Realized Privacy Was a Runtime Toggle

I noticed it in the worst possible place: mid-call, screen-shared, with a financial advisor driving. They typed a query into the search UI, got a crisp ranked list back, and then—without thinking—hovered right over a client's name and AUM. The call didn’t explode, but my stomach did that little drop you only get when you realize a system is technically correct and still socially dangerous. This is Part 10 of “How to Architect an Enterprise AI System (And Why the Engineer Still Matters)” . In Part 9 I talked about progressive disclosure via dual-channel streaming. (If Part 5 on kill switches and rollout flags sounds related — it is, but different. Part 5 was about deployment controls : circuit breakers and gradual rollout. This is about runtime modes : per-conversation behavior that changes the output shape without changing the pipeline.) This time the core decision is quieter, but it’s the kind of decision that separates an AI demo from an AI system you can actually operate: anonymizat