"what privacy guarantee actually survives" is the right question, because most of these setups quietly swap the threat model halfway through. Once multiple labs and agents are in the loop, the leakage budget usually gets eaten by metadata and orchestration before the crypto even starts.

A claim register for privacy sounds like paperwork, not a guarantee.