16-10 AI Sources & Privacy 🔍🔒

We'll show you what the AI actually looked at before it answered. And the notes you'd rather it never saw? Those stay hidden.

← Home: ObsiKO 101 · Agent basics → AI Agent

No matter how convincing an answer sounds, it's hard to trust when you don't know where it came from. And on the flip side, some notes — journals, health records, contracts — you simply never want handed to an AI.

ObsiKO splits this into ① showing the evidence and ② drawing a boundary. Nothing to switch on: both work from the very first run. 😊

1️⃣ Where did this sentence come from? — Citations [S1] 📌

When you spot a small number like [S1] or [S2] in an answer, it means "this bit came from that note."

• Click it and the note opens right away. Go check for yourself that it really says that!
• The same note keeps the same number throughout an answer. If [S1] shows up several times, it's all one source.

🛡️ Made-up footnotes never reach your screen. The numbers are issued by ObsiKO, not by the AI. When a search tool finds a note, ObsiKO stamps the number on it — and if the answer contains a number we never issued, we quietly strip it before drawing. A citation with nothing behind it is worse than none at all: it tricks you into thinking someone checked.

And don't worry if your notes contain real code like arr[S1] — anything inside a code block is left completely alone. 😉

💡 Where does this work? On the desktop Claude engine, and on every chat-only engine (Claude, Gemini, OpenAI) — so you get source numbers on iPhone, Android, and web too. The only two that don't have it yet are the CLI-based Gemini and Codex engines (they don't issue the numbers).

2️⃣ The evidence behind this answer 🧾

When a task finishes, the completion card carries one collapsed line:

3 sources · 1 read in full · 2 excluded by protection rules

Expand it and you'll see the notes that were actually handed to the model for this answer. Click a filename to open it.

• read — the note whose full body was read. That's the heaviest kind of evidence, so it sits at the top of the list.
• search — only the title and a short snippet went over. The model didn't read the whole thing, but it did see that much, so we list it honestly.
• N excluded by protection rules — a count of how many notes you blocked in ③ were filtered out (names are never shown).

💡 This is not a log of "how many tools were called" — it's a record of what actually reached the model. Searches that returned nothing aren't counted, and notes that contributed only a snippet are labelled "search" rather than dressed up as sources.

3️⃣ Keep this note away from the AI 🚫

Blocking a single note — frontmatter ai: deny

Add one line to the note's frontmatter and you're done.

---
title: Counselling notes 2026
ai: deny
---

Besides deny, we also understand false, no, off, none, exclude, and private — all the same meaning. → Frontmatter Properties

Blocking whole folders — .obsiko-ai-ignore

Create a file called .obsiko-ai-ignore in your vault's top folder and list one rule per line, just like .gitignore.

# Nothing under these folders goes to the AI
Journal/
Private/
draft-*.md
Material/**/contract*

• folder/ = that entire folder · * = any characters (won't cross a folder boundary) · ** = including subfolders · # = a comment
• Start a line with / to match only at the top of the vault. Without it, the rule matches at any depth.
• Re-allowing with ! is deliberately unsupported. Exception rules end up becoming the hole — if any rule matches, it's blocked, full stop.

How thoroughly is it blocked?

Checking "right before a tool runs" is not enough — a one-line preview in search results leaks content just as effectively. So ObsiKO applies the same rule at every doorway: vault search, document-content search, table (.base) queries, semantic indexing, semantic search, file reads, file moves, and memory recall.

• Moving files is blocked too — the agent can't even relocate or rename a protected note (the principle is to not touch it at all).
• Memory recall is filtered too — if a memory file you've built up is protected, it never gets pulled into the conversation. → 16-11 Personal Memory
• Topic clusters, connection-graph exploration, and link suggestions (Backlinks & Outline · Dashboard) also compute with protected notes excluded entirely, and the same applies to the doorway opened by External AI apps (Settings & Themes).
• 📱 Chat-only mode on phone and web is identical — chat AI runs on different code from the desktop agent, but the checks are funnelled through a single gate that covers search, listing, reading, writing, and moving alike. A protected note won't even appear in chat's note listings, and it drops out of backlink results too.

Semantic search in particular is excluded at indexing time — no embedding is ever created, so it can't surface later. And in case the index has gone stale, we filter again at search time. If the rules file itself can't be read, we don't quietly let things through: everything closes.

⚠️ An honest limitation: the Gemini and Codex engines ship their own file tools (file reads, shell) that bypass ObsiKO entirely, so we can't guarantee 100% coverage there. If your vault has protection rules and you pick one of those engines, we'll tell you once — for genuinely sensitive notes, use the Claude engine.

Also, this boundary governs what gets handed to the agent. It won't stop you from opening a note yourself and pasting it into the chat. 😉

One natural side effect

A protected note isn't in the semantic index, so it won't appear under "Found by meaning" in unified search either (that's intended). Keyword search still finds it as usual, and the note is just an ordinary file in your vault. → Search & Navigation

At a glance 📋

← Previous: AI Billing Guide · Home · Next: Personal Memory →