Confidentiality, Threat Models, and Human Approval Gates