This is an old revision of the document!
I ran into a situation where the director and storage systems weren't trusted by the fd client. Ie, some of the data on the client should not be available to the director. Nor should the director have rights to create or delete critical files on the client.
The approach I took was to:
The result is that bacula is used to backup selected files without trusting the bacula system. File names are still exposed but I wasn't concerned about that.