Share the Answer, Not the Data

Keywords: MCP · federated learning · zero-knowledge proofs · selective disclosure · AI agents · data minimization · agent-to-agent · GDPR · digital identity wallet

---

Imagine the most boring errand in the world: opening a bank account.

You gather the passport. The proof of address. The payslips. The tax number. You upload them, or worse, you walk into a branch and hand over photocopies. Then the bank keeps those copies forever, in a drawer, or in a database waiting for its breach.

Now replay the same errand in the MCP era. You ask your agent to open the account. Your agent discovers the bank’s agent. The two talk. And the bank’s agent asks its questions: Is this person a resident? Over eighteen? Is their income above our threshold? Do they clear sanctions screening?

Here is the whole article in one sentence: your agent answers every one of those questions without handing over a single document.

The bank’s agent gets what compliance requires, certainty. Your agent gives what privacy requires, answers. The passport never leaves the drawer.

If that sounds like a nice-to-have, a privacy garnish on top of the real work, I want to convince you it is much bigger than that. It is the same architectural instinct that federated learning proved at population scale a decade ago. And it decides whether the agent economy can exist at all inside regulated industries, which is to say, whether it can exist at all.

The plumbing arrived before the manners

First, the context, because the timing matters.

In late 2024, Anthropic open-sourced the Model Context Protocol, MCP. It is a standard way for AI agents to connect to external tools and data sources. Think USB-C: before it, every device shipped its own cable; after it, one plug shape everywhere. The other major AI labs adopted it within months. Today an agent that speaks MCP can operate thousands of services, from calendars to CRMs to banking backends.

On top of that, the agent-to-agent layer is forming fast. Google’s Agent2Agent protocol went open source in 2025 and into the Linux Foundation soon after. Payment protocols for agents, AP2, ACP, x402, landed in the same year, because at some point the agents will not just talk, they will transact.

What almost nobody is designing yet is the part that matters most to you personally: what your agent is allowed to carry into those conversations.

Because every agent conversation is a data event. When your agent negotiates with a bank’s agent, an employer’s agent, a hospital’s agent, somebody’s data is in the room. Today’s default is inherited from a world of web forms: the service asks, the client uploads, the service stores. Feed that default into agents and you get the same pattern at machine speed: every agent scattering photocopies of your life across every counter it visits.

Every agent conversation is a data event. The default leaks by design. It is not the only option.

The principle already has a name

Here is the funny thing. The instinct for a better default is not new, and it is not mine. It has been running inside your phone for years.

It is called federated learning. Instead of collecting everyone’s data into one central lab, you ship the model to where the data lives, let it learn locally, and bring back only the lesson. Think of it as sending doctors to the villages instead of moving every patient to the capital. The checkup happens at home. Only the diagnosis travels.

Google has run this since 2017 to improve its phone keyboards: your phone trains the next-word model on your typing, on your device, and sends back an update, a distilled lesson, never your messages. Hospitals use the same pattern to train diagnostic models across institutions that could never legally pool patient records. Banks use it to sharpen fraud models without sharing customer data between institutions.

So when people first describe the bank-account scene, the agent that answers without disclosing, they reach for the phrase federated learning. And then ML-literate readers pounce, because strictly speaking that scene involves no learning at all. Nothing is trained. The gradient never appears. Federated learning is about training models across distributed data. The scene is about disclosure: answering questions without exposing the underlying data.

The pouncers are right about the letter. They are missing the law.

Both patterns express one architectural instinct, and the instinct is the actual discovery:

Move the question to the data. Never the data to the question.

Federated learning proved that instinct for training. The MCP era applies it to everything else. The tool changes, from gradients to proofs. The shape is identical. The data stays where it lives, and only the derived artifact, the lesson, the answer, the proof, is allowed to travel.

Keep the data where it lives. Teach the answers to travel. That is the privacy contract of the agent era, and we already have a decade of evidence that it works.

The toolbox: four ways to answer without revealing

The instinct is old. The toolbox is concrete, and most of it is not science fiction. Four tools matter.

Selective disclosure. The simplest tool: credentials that answer questions instead of being photocopied. A signed digital credential from your government or employer can carry your attributes, residency, age, income bracket, tax status, and your agent reveals only the field each counter asks for. This is not a startup pitch. The EU’s digital identity wallet, mandated under eIDAS 2.0, must be offered to every citizen by the end of 2026. The infrastructure of disclosure control is being shipped by regulators themselves.

Zero-knowledge proofs. For questions a field cannot answer, prove the predicate without revealing the value. Not “what is your income” but “is your income above 40,000 euros”, answered with cryptographic certainty and no number disclosed. Not “show me you are not on a sanctions list” but the proof itself. The mathematics goes back to David Chaum’s work in the 1980s; what is new is that agents give it a body, a piece of software that holds your credentials and negotiates on your behalf. Today it handles simple predicates well; the research frontier is rich ones. But the direction is one-way.

Secure computation. Sometimes the computation itself must happen where neither side sees everything. Multiparty computation, trusted execution environments, homomorphic encryption: a bank can run its risk score on data it never gets to read, inside hardware or protocols that guarantee the isolation. This one is earlier on the adoption curve, but it completes the picture: even the derived answer can be computed without the raw inputs changing hands.

Federated learning, proper. And where training genuinely is the task, the original pattern applies unchanged. Your agent’s personal models, your preferences, your writing style, your risk profile, improve from your own data on your own devices. Banks pool fraud signals across institutions without pooling customer records. The lesson travels. The data stays home.

Notice what these four have in common. None of them asks the service to lower its standards. The bank still gets compliance-grade certainty about who you are. What changes is the physics of the exchange: certainty arrives as an answer, not as a stack of copies.

📊 Process map: the toolbox, four tools one instinct

The tool changes, the shape does not: in every path the data stays home and only a minimal artifact travels.

Why banks will demand this first

If you want to know which industry gets forced into this pattern first, do not follow the startups. Follow the liability.

I spent years building AML compliance systems for banks, and I can tell you what compliance teams actually fear. It is not answering the regulator. It is the drawer. Every photocopy of your passport is a copy the bank must store, secure, audit, retention-limit, and eventually explain. Every stored document is breach surface and audit burden at the same time. European banks have paid real fines not for knowing too little about their customers, but for keeping too much, too long.

Data minimization is not a preference in that world. It is a legal duty, written into GDPR Article 5. And “share the answer, not the data” is what data minimization looks like when it grows into an architecture. A bank that accepts proofs instead of photocopies is not being soft on crime. It is shrinking its own attack surface and its own audit trail at the same time, while still clearing every screening obligation it has.

That reframes the bank-account scene. The bank’s agent asking for answers instead of documents is not the bank doing you a favor. It is the bank discovering that the federated pattern is cheaper than the drawer.

📊 Process map: the liability math, drawer versus proof

Same screening obligations on both sides. The proof path just has nothing left in the archive to lose, breach, or explain.

The pieces are converging on their own: MCP made agent-to-service conversation real, agent payment protocols arrived in 2025, and the EU identity wallet puts disclosure-controlled credentials in every citizen’s pocket. The institutions that learn to consume answers, proofs, and attestations, instead of demanding copies, will be the ones agents visit first. The rest will wonder why all the new accounts are opening somewhere else.

If you want to see what compliance-grade AI looks like in production today, before agents arrive, I wrote up the AML system I helped build for tier-one banks: the banking AML case study.

What is still hard

A blueprint without a failure list is a pitch. Here is mine.

Answers can leak too. Ask enough questions and you can reconstruct the data behind them; researchers call this model inversion and membership inference, and federated learning has battled both for years. The defense is discipline: rate limits, query auditing, batching, noise. “Only answers travel” is necessary, not sufficient.

A proof is only as good as its issuer. Zero-knowledge means your agent proves consistency with a credential. If the credential is weak, self-issued, bought, forged upstream, the proof is a perfectly verified lie. The trust anchor is whoever issues the credentials: governments, banks, employers. They exist. They need to issue.

Consent is a UX problem, not a checkbox. Nobody will read forty consent dialogs a day. The real product is a policy engine: you set your rules once, never reveal the income number, thresholds are fine, health data never leaves, and your agent enforces them without asking. Your privacy policy, written by you, executed at machine speed. Almost nobody has shipped this well yet.

The asymmetry problem. Your agent can refuse to over-disclose, but the bank’s agent can refuse to under-ask, and it holds the power in the negotiation. Politeness will not fix that. Regulation will: data minimization law gives your agent the legal teeth to say “the answer is all you get.”

Protocol politics. Who vouches for an agent’s identity? Who is liable when an agent lies, yours or the service that trusted it? The standards are forming in real time, MCP and A2A and the payment protocols, and identity for agents is the missing keystone. This will be argued about for years. The data-stays-home principle is stable across every variant.

Key takeaways

• MCP made agent-to-agent and agent-to-service conversation real. Every one of those conversations is a data event, and the inherited default, forms, uploads, photocopies, leaks by design.
• Federated learning proved the core instinct a decade ago: move the question to the data, never the data to the question. The agent era extends that instinct from training to everything.
• The toolbox exists today: selective disclosure credentials (the EU wallet ships by end of 2026), zero-knowledge proofs for threshold questions, secure computation, and federated learning proper for training.
• For banks, this is compliance arithmetic, not philosophy: GDPR data minimization, breach economics, and audit burden all shrink when proofs replace photocopies.
• Answers are not automatically safe: leakage, issuer quality, consent UX, and negotiation asymmetry are the open problems. Policy engines and minimization law are the teeth.

The agents are already learning to talk to each other. The design decision that matters now is not which protocol wins. It is what they are allowed to carry.

Data stays home. Answers travel.

Everything else is plumbing.

📊 Process map: the agent account-opening exchange, proofs instead of photocopies

The exchange is compliance-grade on both sides: the bank’s checklist completes with certainty, and the vault never opens. Only answers cross the bridge.

Related reading:

• Perspective AI: the federated marketplace, the sibling blueprint for intelligence that never centralizes your data.
• From Tools to Partners: what makes a machine trustworthy rather than merely useful, the relationship this design depends on.
• The Shape of the Partnership: the trust layer between human and agent, from the Not So Artificial series.
• The Internet of Agents: the infrastructure layer underneath the scene in this article.
• AI Agents, in easy words: the beginner-friendly foundation for everything above.