@agent-native/core 0.111.3 → 0.112.0

package/corpus/templates/brain/.agents/skills/brain/RUNBOOK.md

@@ -15,6 +15,42 @@ in the public `template-brain.md` overview and previously sat inline in
 intentionally not in the public docs. Read it when you are operating, rolling
 out, or debugging Brain internals rather than answering an ordinary question.
 
+## Privacy, Evidence Audiences, And Search
+
+Brain applies the deterministic hard-category screen before any privacy model.
+It blocks performance/discipline, layoffs or termination, compensation,
+recruiting, health/accommodation, investigation, privileged legal, credentials,
+and personal data. An approved privacy classifier may make handling stricter;
+it cannot override a deterministic hit. When no classifier is configured,
+Brain is in degraded deterministic-only mode: clearly clean company material
+may be allowed, while uncertainty is quarantined and `get-brain-health` reports
+the missing configuration.
+
+Quarantined re-fetchable material from Slack, GitHub, or Granola keeps only a
+metadata receipt because the content can be re-fetched during an authorized
+review. Push-only generic and Clips payloads instead use an encrypted,
+short-TTL private side store that no search, agent, source editor, log,
+citation, or distillation surface can read; expiry converts it to a suppression
+receipt. Review records policy metadata, never a shortcut to raw sensitive
+content. HR-blocked evidence is never declassifiable: write a new,
+non-identifying reviewed statement if it has durable organizational value.
+
+Every allowed capture and derived row has an audience id and ACL hash. Public
+and organization material use the trivial organization audience. Private Slack
+material uses its channel membership audience, and meeting material uses its
+attendee audience. Retrieval prefilters by audience before FTS/vector ranking;
+answers spanning multiple sources may only cite the intersection of their
+evidence audiences. Private Slack audiences fail closed when membership has not
+been refreshed for 15 minutes, so removal upstream cannot leave indefinite
+Brain access.
+
+Semantic indexing starts when a capture is `allowed`, rather than waiting for
+distillation. A derived row is current only when its staleness key matches
+`contentHash + BRAIN_SEARCH_INDEX_VERSION + sensitivityPolicyVersion + aclHash`.
+Changing content, policy, or membership invalidates indexed artifacts,
+knowledge/proposal evidence, and mirrored canonical resources before they can
+be served.
+
 ## Search model layers
 
 Brain search has three layers:
@@ -60,8 +96,11 @@ pnpm --filter brain action create-source \
 ```
 
 The connector verifies each configured conversation before reading history and
-rejects DMs and MPIMs. Cursor state is stored on the source so each sync can
-pick up where the last one stopped, including after Slack rate limiting.
+rejects DMs and MPIMs. Public discovery is opt-in and exclusion patterns are
+applied before capture. Private channels are never silently joined: an operator
+must manually invite the Slack app before validation and membership sync. Cursor
+state is stored on the source so each sync can pick up where the last one
+stopped, including after Slack rate limiting.
 
 Use `test-slack-connection` before a production backfill. It validates the Slack
 bot token with `auth.test` and, when channel refs are provided, checks channel
@@ -121,7 +160,8 @@ recommended rollout steps without returning raw capture bodies.
 
 Recommended production rollout:
 
-1. Start with one or two high-signal channels and channel IDs.
+1. Start with one or two high-signal public channels and explicitly invited
+   private channels; never use discovery as implicit private-channel consent.
 2. Keep `autoSync: false` until review quality is proven.
 3. Run `test-slack-connection`, then `run-slack-pilot` without history.
 4. Run one explicit `run-slack-pilot --readHistory true` sample when the report
@@ -246,8 +286,11 @@ with `mode: "retrieval"`.
 
 The repository-level `pnpm test` command includes `pnpm test:brain-evals`, which
 runs Brain's product-demo and retrieval action evals against a disposable local
-SQLite database. The CI/prep eval path is fully seeded and offline; it does not
-require production Slack, Granola, Clips, or any external workspace data.
+SQLite database. `pnpm test:brain-privacy-evals` is a separate CI lane with
+must-block sensitive fixtures and must-allow benign false-positive fixtures
+(such as API-limit raises, bonus features, and medical-device customers). Both
+paths are fully seeded and offline; neither requires production Slack, Granola,
+Clips, or external workspace data.
 
 ## Generic ingest payload validation
 

package/corpus/templates/brain/.agents/skills/brain/SKILL.md

@@ -17,18 +17,48 @@ Use Brain actions rather than raw SQL.
    for a capture that's already queued/processing refreshes the handoff
    instructions instead of creating a duplicate queue row.
 4. Before writing knowledge, call `get-capture` and copy short exact quotes.
-   `get-capture` redacts `title`/`content`/`metadata` by default; pass
-   `includeRawContent: true` (requires `editor` access on the source) to get
-   the real text needed for an exact-substring quote.
+   Quotes and offsets always reference the persisted safe capture, never an
+   upstream raw payload. `get-capture` redacts `title`/`content`/`metadata` by
+   default; `includeRawContent: true` only reveals allowed, source-accessible
+   capture content and never bypasses a sensitivity disposition.
 5. Call `write-knowledge` with `evidence` entries whose `quote` fields are exact capture substrings — `validateEvidence` throws otherwise.
 6. If `write-knowledge` returns `mode: "proposal"`, leave it in review unless the user asks to approve. See AGENTS.md for the exact tier/confidence conditions that trigger a proposal.
 
+## Privacy, Quarantine, And Safe Captures
+
+Every ingest first receives a deterministic sensitivity screen. Performance,
+discipline, termination/layoff, compensation, recruiting, health or
+accommodation, investigation, privileged legal, credential, and personal-data
+signals can only tighten handling; no model or workspace instruction can lower
+that boundary.
+
+- `allowed` captures persist safe content and may be indexed immediately. This
+  is independent of distillation: semantic coverage must not wait for an agent
+  to author a memory.
+- `quarantined` or `suppressed` content is unavailable to search, citation,
+  distillation, source editors, agent tools, and logs. Review shows only the
+  minimal policy metadata needed to operate the queue.
+- Re-fetchable providers (Slack, GitHub, Granola) retain metadata-only
+  quarantine records. Push-only `generic` and `clips` material is retained only
+  in the encrypted, short-TTL private quarantine store; expiry becomes a
+  suppression receipt.
+- If no approved privacy classifier is configured, deterministic-only mode
+  allows clearly clean, company-relevant material and quarantines uncertainty.
+  Treat the health/setup warning as a requirement to configure the classifier
+  before broad ingestion.
+
+Administrators may review a disposition but may not declassify HR-blocked
+evidence. A broader statement must be a newly reviewed, non-identifying memory
+with no private quotes, links, or identities.
+
 ## Capture Sanitization (Transcripts)
 
 Transcript-kind captures are sanitized **before storage** by default
 (`shouldSanitizeCaptureBeforeStorage` — true whenever `kind === "transcript"`,
 unless `captureSanitizationEnabled: false` in settings or a per-capture
 `metadata.sanitizeBeforeStorage` / source-config override says otherwise).
+That override may skip relevance-oriented transcript cleanup, but deterministic
+privacy and PII scrubbing always run and raw input is never retained.
 Sanitization always strips, regardless of settings:
 
 - Recruiting/hiring/candidate-evaluation content (`RECRUITING_SIGNAL`).
@@ -46,19 +76,20 @@ company-relevant survives, the stored content becomes the literal string "No
 company-relevant content retained from this capture." — treat that string as
 "this capture had nothing worth distilling," not as an error.
 
-## Search: Two Distinct Actions, No Vector Index
+## Search: Scoped Hybrid Retrieval
 
-- `search-knowledge` — SQL text match over `title`/`summary`/`body` of
-  **distilled knowledge only**. Use for "what does Brain officially know about
-  X."
+- `search-knowledge` — scoped retrieval over **distilled knowledge only**. Use
+  for "what does Brain officially know about X."
 - `search-everything` — broader pass across knowledge, raw captures, and
   sources in one call, plus `federatedCoverage` (delegation hints for other
-  apps). Use this as the default first search for an open-ended question;
-  narrow with `type: "knowledge" | "capture" | "source"` when you already know
-  which record type you need.
-- Neither uses embeddings/vector search — matching is deterministic SQL LIKE
-  scoring. Don't describe results as "semantically similar"; they matched on
-  literal term overlap.
+  apps). It uses full-text and available semantic signals after applying source,
+  project, kind, and audience filters. Use it as the default first search for
+  an open-ended question; narrow with `type: "knowledge" | "capture" |
+  "source"` when you already know which record type you need.
+- Audience filtering happens before ranking. Public and organization sources
+  use the cheap organization audience; private channels and meetings use their
+  restricted audience. A multi-source answer must use the intersection of the
+  cited evidence audiences.
 
 Follow `sourcePolicy` for how much of `search-everything`'s output an answer
 may lean on: `strict` means reviewed knowledge only, `balanced` means raw
@@ -76,5 +107,6 @@ directly.
 - `ingestion-and-connectors` — source creation, health states, sync scheduling,
   and credential resolution order.
 - `brain-runbook` — internal architecture and ops detail (Slack rollout,
-  distillation worker, scheduled sync cron, demo/eval seeding).
+  privacy quarantine, semantic index, distillation worker, scheduled sync cron,
+  demo/eval seeding).
 - `ask-across-everything`, `security`, `sharing`.

package/corpus/templates/brain/README.md

@@ -8,16 +8,47 @@ from approved company knowledge, with links back to the source.
 
 Brain ingests approved Slack channels, meetings, transcripts, GitHub issues/PRs,
 and webhook captures, distills them into reviewable knowledge, and answers with
-exact evidence quotes and source links instead of guesses.
+exact evidence quotes and source links instead of guesses. It can search both
+organization-wide material and explicitly invited private channels or
+attendee-scoped meetings without widening their audience.
 
 ## Features
 
 - Company chat that answers from cited, reviewed knowledge — not hallucinations.
 - Source connectors for Slack, Granola, GitHub, Clips, and generic webhooks.
-- Pre-storage privacy filter and review queue before knowledge becomes durable.
-- Portable SQL text search and agentic query expansion — no vector database required.
+- Deterministic privacy screening before storage, with an optional approved
+  privacy classifier for richer review decisions.
+- Hybrid full-text and semantic search over allowed captures and knowledge,
+  filtered by the requesting user's evidence audience before ranking.
+- Private-channel and meeting evidence stays audience-scoped; multi-source
+  answers use only the intersection of their evidence audiences.
+- Sensitive sources are suppressed or quarantined before search, citations,
+  distillation, and source editors can see their content.
 - Read-only, citation-backed retrieval exposed to other apps over A2A.
 
+## Privacy posture
+
+Brain never treats a connected provider as permission to index everything.
+Slack public-channel discovery is configurable, while private channels require a
+manual app invite and membership sync. Meetings use their attendee audience.
+
+Hard privacy categories such as performance discussions, layoffs, compensation,
+recruiting, health accommodations, investigations, privileged legal material,
+and credentials are blocked before they become searchable content. Re-fetchable
+providers keep only a metadata receipt in quarantine. Push-only generic and
+Clips payloads use an encrypted, short-lived private quarantine store and turn
+into a suppression receipt at expiry.
+
+Without an approved privacy classifier, Brain runs in deterministic-only
+degraded mode: clearly clean, company-relevant material may proceed; ambiguous
+or sensitive-looking material is quarantined and health surfaces the setup
+warning. Configure the classifier before relying on higher-throughput ingest.
+
+`sanitizeBeforeStorage: false` only disables relevance-oriented transcript
+cleanup. Brain still runs deterministic privacy and PII scrubbing before
+persisting titles, content, metadata, safe segments, or search artifacts; the
+setting never retains raw input.
+
 ## Develop locally
 
 Scaffold your own copy and run it:

package/corpus/templates/brain/actions/approve-proposal.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import {
+  assertDerivedAudienceAccess,
   nowIso,
   parseJson,
   serializeProposal,
@@ -30,6 +31,7 @@ export default defineAction({
   run: async ({ proposalId, reviewerNotes, publishCanonical }) => {
     const access = await assertAccess("brain-proposal", proposalId, "editor");
     const proposal = access.resource;
+    await assertDerivedAudienceAccess(proposal);
     if (proposal.status !== "pending") {
       throw new Error(`Proposal ${proposalId} is already ${proposal.status}`);
     }

package/corpus/templates/brain/actions/claim-distillation.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { getDbExec } from "@agent-native/core/db";
 import { and, desc, eq } from "drizzle-orm";
 import { z } from "zod";
 
@@ -12,6 +13,8 @@ import {
   stableJson,
 } from "../server/lib/brain.js";
 
+const LEASE_MS = 15 * 60 * 1000;
+
 export default defineAction({
   description:
     "Claim a queued Brain capture distillation item before handing it to an agent worker.",
@@ -41,45 +44,39 @@ export default defineAction({
 
     const now = nowIso();
     const claimToken = nanoid(16);
+    const leaseExpiresAt = new Date(Date.parse(now) + LEASE_MS).toISOString();
     const payload = parseJson<Record<string, unknown>>(queue.payloadJson, {});
-    await db
-      .update(schema.brainIngestQueue)
-      .set({
-        status: "processing",
-        attempts: queue.attempts + 1,
-        payloadJson: stableJson({
-          ...payload,
-          claimToken,
-          claimedAt: now,
-          claimedBy: "brain-agent",
-        }),
-        error: null,
-        runAfter: null,
-        updatedAt: now,
-      })
-      .where(
-        and(
-          eq(schema.brainIngestQueue.id, queue.id),
-          eq(schema.brainIngestQueue.status, "queued"),
-        ),
-      );
+    const result = await getDbExec().execute({
+      sql: `UPDATE brain_ingest_queue
+        SET status = ?, attempts = ?, payload_json = ?, error = NULL,
+            run_after = NULL, lease_token = ?, lease_expires_at = ?, updated_at = ?
+        WHERE id = ? AND status = ? AND updated_at = ?`,
+      args: [
+        "processing",
+        queue.attempts + 1,
+        stableJson({ ...payload, claimedAt: now, claimedBy: "brain-agent" }),
+        claimToken,
+        leaseExpiresAt,
+        now,
+        queue.id,
+        "queued",
+        queue.updatedAt,
+      ],
+    });
+    if (result.rowsAffected === 0) return { claimed: false, queueItem: null };
 
     const [updated] = await db
       .select()
       .from(schema.brainIngestQueue)
       .where(eq(schema.brainIngestQueue.id, queue.id))
       .limit(1);
-    const updatedPayload = parseJson<Record<string, unknown>>(
-      updated?.payloadJson,
-      {},
-    );
     const claimed =
-      updated?.status === "processing" &&
-      updatedPayload.claimToken === claimToken;
+      updated?.status === "processing" && updated?.leaseToken === claimToken;
 
     return {
       claimed,
       queueItem: updated ? serializeDistillationQueue(updated) : null,
+      claimToken: claimed ? claimToken : null,
     };
   },
 });

package/corpus/templates/brain/actions/create-source.ts

@@ -26,7 +26,7 @@ export default defineAction({
       .string()
       .optional()
       .describe("Optional signed-ingest bearer token; stored only as a hash"),
-    visibility: z.enum(["private", "org", "public"]).default("org"),
+    visibility: z.enum(["private", "org"]).default("org"),
   }),
   run: async (args) => {
     const config = { ...args.config };

package/corpus/templates/brain/actions/get-knowledge.ts

@@ -2,7 +2,10 @@ import { defineAction } from "@agent-native/core";
 import { resolveAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 
-import { serializeKnowledge } from "../server/lib/brain.js";
+import {
+  assertDerivedAudienceAccess,
+  serializeKnowledge,
+} from "../server/lib/brain.js";
 
 export default defineAction({
   description: "Get one Brain knowledge item by ID.",
@@ -14,12 +17,13 @@ export default defineAction({
   publicAgent: {
     expose: true,
     readOnly: true,
-    requiresAuth: false,
+    requiresAuth: true,
     isConsequential: false,
   },
   run: async ({ id }) => {
     const access = await resolveAccess("brain-knowledge", id);
     if (!access) return { knowledge: null };
+    await assertDerivedAudienceAccess(access.resource);
     return {
       knowledge: serializeKnowledge(access.resource),
       accessRole: access.role,

package/corpus/templates/brain/actions/get-pilot-report.ts

@@ -1,9 +1,10 @@
 import { defineAction } from "@agent-native/core";
 import { accessFilter } from "@agent-native/core/sharing";
-import { and, desc, eq, inArray, or } from "drizzle-orm";
+import { and, desc, eq, inArray, isNull, or, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { listAccessibleAudienceIds } from "../server/lib/audiences.js";
 import {
   getAccessibleSource,
   parseJson,
@@ -451,6 +452,22 @@ export default defineAction({
   run: async ({ sourceId, targetChannel }) => {
     const access = await getAccessibleSource(sourceId);
     const db = getDb();
+    const accessibleAudienceIds = await listAccessibleAudienceIds([sourceId]);
+    const accessibleCaptureAudienceFilter = accessibleAudienceIds.length
+      ? inArray(schema.brainCaptureAudiences.audienceId, accessibleAudienceIds)
+      : sql`1=0`;
+    const accessibleDerivedAudienceFilter = or(
+      isNull(schema.brainKnowledge.captureId),
+      accessibleAudienceIds.length
+        ? inArray(schema.brainKnowledge.audienceId, accessibleAudienceIds)
+        : sql`1=0`,
+    )!;
+    const accessibleProposalAudienceFilter = or(
+      isNull(schema.brainProposals.captureId),
+      accessibleAudienceIds.length
+        ? inArray(schema.brainProposals.audienceId, accessibleAudienceIds)
+        : sql`1=0`,
+    )!;
 
     const [latestSyncRun] = await db
       .select()
@@ -465,7 +482,17 @@ export default defineAction({
         status: schema.brainRawCaptures.status,
       })
       .from(schema.brainRawCaptures)
-      .where(eq(schema.brainRawCaptures.sourceId, sourceId));
+      .innerJoin(
+        schema.brainCaptureAudiences,
+        eq(schema.brainCaptureAudiences.captureId, schema.brainRawCaptures.id),
+      )
+      .where(
+        and(
+          eq(schema.brainRawCaptures.sourceId, sourceId),
+          eq(schema.brainRawCaptures.sensitivityDisposition, "allowed"),
+          accessibleCaptureAudienceFilter,
+        ),
+      );
 
     const recentCaptureRows = await db
       .select({
@@ -480,17 +507,24 @@ export default defineAction({
         updatedAt: schema.brainRawCaptures.updatedAt,
       })
       .from(schema.brainRawCaptures)
-      .where(eq(schema.brainRawCaptures.sourceId, sourceId))
+      .innerJoin(
+        schema.brainCaptureAudiences,
+        eq(schema.brainCaptureAudiences.captureId, schema.brainRawCaptures.id),
+      )
+      .where(
+        and(
+          eq(schema.brainRawCaptures.sourceId, sourceId),
+          eq(schema.brainRawCaptures.sensitivityDisposition, "allowed"),
+          accessibleCaptureAudienceFilter,
+        ),
+      )
       .orderBy(desc(schema.brainRawCaptures.capturedAt))
       .limit(RECENT_LIMIT);
 
     const captureIds = captureRows.map((capture) => capture.id);
     const queueSourceFilter = captureIds.length
-      ? or(
-          eq(schema.brainIngestQueue.sourceId, sourceId),
-          inArray(schema.brainIngestQueue.captureId, captureIds),
-        )!
-      : eq(schema.brainIngestQueue.sourceId, sourceId);
+      ? inArray(schema.brainIngestQueue.captureId, captureIds)
+      : sql`1=0`;
 
     const queueRows = await db
       .select({
@@ -532,6 +566,7 @@ export default defineAction({
         and(
           accessFilter(schema.brainKnowledge, schema.brainKnowledgeShares),
           eq(schema.brainKnowledge.sourceId, sourceId),
+          accessibleDerivedAudienceFilter,
         ),
       )
       .orderBy(desc(schema.brainKnowledge.updatedAt));
@@ -556,6 +591,7 @@ export default defineAction({
         and(
           accessFilter(schema.brainProposals, schema.brainProposalShares),
           eq(schema.brainProposals.sourceId, sourceId),
+          accessibleProposalAudienceFilter,
         ),
       )
       .orderBy(desc(schema.brainProposals.updatedAt));

package/corpus/templates/brain/actions/import-capture.ts

@@ -2,6 +2,7 @@ import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 
 import {
+  BrainCaptureBlockedError,
   createCapture,
   ensureManualSource,
   serializeCapture,
@@ -31,15 +32,26 @@ export default defineAction({
       ? null
       : await ensureManualSource(args.sourceTitle ?? "Manual imports");
     const sourceId = args.sourceId ?? source!.id;
-    const capture = await createCapture({
-      sourceId,
-      externalId: args.externalId,
-      title: args.title,
-      kind: args.kind,
-      content: args.content,
-      capturedAt: args.capturedAt,
-      metadata: args.metadata,
-    });
+    let capture;
+    try {
+      capture = await createCapture({
+        sourceId,
+        externalId: args.externalId,
+        title: args.title,
+        kind: args.kind,
+        content: args.content,
+        capturedAt: args.capturedAt,
+        metadata: args.metadata,
+      });
+    } catch (error) {
+      if (!(error instanceof BrainCaptureBlockedError)) throw error;
+      return {
+        source: source ? serializeSource(source) : undefined,
+        capture: undefined,
+        sensitivityReceipt: error.receipt,
+        nextAction: undefined,
+      };
+    }
     return {
       source: source ? serializeSource(source) : undefined,
       capture: serializeCapture(capture),

package/corpus/templates/brain/actions/import-transcript.ts

@@ -1,7 +1,9 @@
 import { defineAction } from "@agent-native/core";
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
 import { z } from "zod";
 
 import {
+  BrainCaptureBlockedError,
   createCapture,
   ensureManualSource,
   serializeCapture,
@@ -26,23 +28,49 @@ export default defineAction({
     enqueueDistillation: z.coerce.boolean().default(true),
   }),
   run: async (args) => {
+    const importerEmail = getRequestUserEmail()?.trim().toLowerCase();
+    let participants = args.participants;
+    if (!participants.length) {
+      if (!importerEmail) {
+        throw new Error(
+          "Importing a transcript without participants requires an authenticated importer.",
+        );
+      }
+      participants = [importerEmail];
+    }
     const source = args.sourceId
       ? null
       : await ensureManualSource(args.sourceTitle);
-    const capture = await createCapture({
-      sourceId: args.sourceId ?? source!.id,
-      externalId: args.externalId,
-      title: args.title,
-      kind: "transcript",
-      content: args.transcript,
-      capturedAt: args.capturedAt,
-      metadata: {
-        ...(args.metadata ?? {}),
-        participants: args.participants,
-        sourceUrl: args.sourceUrl,
-        tags: args.tags,
-      },
-    });
+    let capture;
+    try {
+      capture = await createCapture({
+        sourceId: args.sourceId ?? source!.id,
+        externalId: args.externalId,
+        title: args.title,
+        kind: "transcript",
+        content: args.transcript,
+        capturedAt: args.capturedAt,
+        metadata: {
+          ...(args.metadata ?? {}),
+          participants,
+          sourceUrl: args.sourceUrl,
+          tags: args.tags,
+        },
+        audience: {
+          kind: "meeting",
+          memberEmails: participants,
+          upstreamRefHash: args.externalId,
+        },
+      });
+    } catch (error) {
+      if (!(error instanceof BrainCaptureBlockedError)) throw error;
+      return {
+        source: source ? serializeSource(source) : undefined,
+        capture: undefined,
+        sensitivityReceipt: error.receipt,
+        nextAction: undefined,
+      };
+    }
     return {
       source: source ? serializeSource(source) : undefined,
       capture: serializeCapture(capture),

package/corpus/templates/brain/actions/list-captures.ts

@@ -4,6 +4,7 @@ import { and, desc, eq, inArray, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { listAccessibleAudienceIds } from "../server/lib/audiences.js";
 import {
   latestDistillationQueuesForCaptures,
   parseJson,
@@ -98,9 +99,13 @@ export default defineAction({
 
     const sourceIds = sourceRows.map((source) => source.id);
     if (!sourceIds.length) return { count: 0, captures: [] };
+    const audienceIds = await listAccessibleAudienceIds(sourceIds);
+    if (!audienceIds.length) return { count: 0, captures: [] };
     const sourceMap = new Map(sourceRows.map((source) => [source.id, source]));
     const captureClauses = [
       inArray(schema.brainRawCaptures.sourceId, sourceIds),
+      eq(schema.brainRawCaptures.sensitivityDisposition, "allowed"),
+      inArray(schema.brainCaptureAudiences.audienceId, audienceIds),
     ];
     if (args.status) {
       captureClauses.push(eq(schema.brainRawCaptures.status, args.status));
@@ -118,7 +123,7 @@ export default defineAction({
       ? Math.min(args.previewLength * 4, 4000)
       : 0;
     const rows = await db
-      .select({
+      .selectDistinct({
         id: schema.brainRawCaptures.id,
         sourceId: schema.brainRawCaptures.sourceId,
         externalId: schema.brainRawCaptures.externalId,
@@ -136,6 +141,10 @@ export default defineAction({
           : {}),
       })
       .from(schema.brainRawCaptures)
+      .innerJoin(
+        schema.brainCaptureAudiences,
+        eq(schema.brainCaptureAudiences.captureId, schema.brainRawCaptures.id),
+      )
       .where(and(...captureClauses))
       .orderBy(desc(schema.brainRawCaptures.capturedAt))
       .limit(args.limit);