Beyond Locality: Feature-Boundary Auditing for OS-Integrated AI

On-device inference reduces exposure to remote infrastructure, but it does not establish privacy for an operating-system assistant that aggregates cross-application data, retains derived state, or delegates actions. We present a feature-boundary audit method for OS-integrated AI. It combines a taxonomy of six privacy-failure surfaces, a five-dimension control rubric with separate evidence grades, and explicit records for adjacent data and authority paths. We apply the method to Apple Foundation Models, Apple Private Cloud Compute, Android AICore/Gemini Nano, and Microsoft Recall using primary public documentation. The analysis distinguishes request isolation from contextual restraint, retained-state controls from non-retention, and attestation from task-appropriate disclosure. A formative comparison of two 20-item assessment records identifies ambiguities in notice, retention, path ownership, and accountability. The source-linked records identify supported controls and unresolved dependencies; we also specify a minimized event record and release comparison for fleet security triage and scoped forensic review.