Planning over Private State: Local–Remote Delegation for Tool-Calling Agents

Tool-calling agents may expose raw user data to cloud model providers and cause privacy concerns due to the data collection. We introduce \textbf{DAM-Guard}, a privacy-preserving local--remote architecture that keeps raw tool observations inside a trusted local runtime while allowing a \textbf{Remote} agent to retain workflow planning and tool-use control. A trusted \textbf{Host} replaces private values with stable opaque handles, and a constrained \textbf{Local} agent performs bounded semantic computation over authorized raw observations when requested by the Remote. The Remote therefore plans from protected context without directly observing the underlying private values. We evaluate three local--remote delegation protocols, each with and without path annotation, on $\tau^2$-bench~\citep{barres2025tau2}. We measure privacy using deterministic verbatim matching and an auditor-based probe of raw-value inferability. Under the DeepSeek Remote, the best protected configuration matches the observed task-success count of unrestricted Raw execution. Path annotation shows no statistically significant task-success improvement, but it shortens execution and reduces Remote turns. Protected execution restricts direct exposure of raw private values. Moreover, it increases the auditor's confidence in inferring the true raw value by only 1.7 percentage points on average, compared with an increase from 37.0\% to 94.8\% under Raw access. Under a protocol-compliant Remote and our auditing setting, these results show that Local-Remote delegation can preserve substantial tool-calling utility while limiting both direct and inferential exposure of private tool state.