An AI agent acting for one person: implementation comparison
An assistant that sends email and pays bills for one person, governed two ways: settings and a confirm button, or a grant that ends, a prompt that can change the outcome, and records the person checks it against.
Where this fits
A boundary case: an agent acting for one person
The person who grants the agent its authority is usually the person its mistakes land on, and can stop it at any time. No institution operates the delegation, so no one answers to a clause for it. What still applies is the delegation: a scope that ends, a stop that works, a record the person can check without the agent, and a way for the people the agent writes to or pays to reach the person. When a vendor runs the same agent for many people, the agents context applies to the vendor.
A person connects an assistant to their email, their calendar, one card, and their health insurer's portal. It drafts replies, books appointments, pays recurring bills, and resubmits a claim the insurer rejected. Reading and drafting run without a prompt. Sending and paying wait for a tap. The people it writes to and pays never agreed to the delegation.
Standard governance
What an assistant usually offers
Permissions granted once, a confirm button, and a history the vendor keeps.
- Permissions granted at setup that last until the person revokes them.
- A confirm button before a message is sent or a bill is paid.
- An activity history kept in the vendor's app.
- A memory of the person that they can view and delete.
- Terms of service that set what the vendor answers for.
Ethotechnics implementation
What changes, and what to check before adding a power
The person holds a grant they can read, renew, and end, and checks the agent against records it does not write.
- The grant names what the agent may send and pay, and when the grant ends: a date, not "until revoked." At renewal, three quiet months are not a reason on their own. The person names what they would have seen if the agent were failing, as STD-08 §1.2 requires of any renewal.
- Adding a power, from sending to paying, is a decision with its own date in the record. Scope that grew by habit is scope nobody granted.
- Before an action, the agent says whether it can be undone in practice. A sent email can be recalled for 30 seconds and not after it has been read. A card payment can be disputed, on the bank's clock.
- The confirm button is a control only if the person can change the outcome from it: edit the message, change the amount, refuse. If the person approves every prompt for a month, the prompt is what gets reviewed, not the person.
- The person checks the agent against records it does not write: the sent folder and the card statement. The activity history is the agent's account of itself.
- A correction changes the agent's standing instruction, and the agent says what changed. Fixing one reply and leaving the instruction in place means making the same correction next week. The eighth of the twelve laws puts it as "observability without state transition is theater."
- When the agent fixes another institution's error, a rejected claim or a double charge, it records the error as well as the fix. Otherwise the insurer's error rate looks lower than it is, and the person's time stops being counted. Absorption as concealment describes the pattern.
- The people the agent writes to and pays have no channel to it. A reply reaches the person, but nothing tells the recipient an assistant wrote.
- The person keeps the skills the agent replaced. A week without it, before adding a power, shows whether they still can.
Before adding a power, the person checks what the agent does without asking, that a stop works partway through a task, and how someone the agent wrote to can reach them. They also count the prompts they edited or refused last month, and the errors the agent fixed in other institutions' systems, by institution.
The record
The grant, written down
This delegation as an STD-08 authority grant, filled in with what a person can show.
The authority grant and the confirm prompt's intervention specification validate against the published schemas. Three fields assume an institution, and the records say so instead of filling them:
- The attestation asks for a signature. Nothing signs a permission set in an app.
- Liability names the party that accepted it. Until the person reads the vendor's terms for that, the record names the person.
- The prompt's specification asks for protection against retaliation. No one can penalize the person for refusing, so it does not apply.
The specification also records the prompt's weakness: approving takes one tap, and nothing rewards reading it.
If the agent asks to take this framework on, what it should ask, and write down for the person.
Cite this implementation example · v1.0.0 · updated Oct 13, 2026 · CC BY-SA 4.0
APA
Ethotechnics Institute. (2026). An AI agent acting for one person: implementation comparison. Ethotechnics Institute. https://ethotechnics.org/use-cases/examples/personal-agent
MLA
Ethotechnics Institute. "An AI agent acting for one person: implementation comparison." Ethotechnics Institute, 2026, https://ethotechnics.org/use-cases/examples/personal-agent.
Chicago
Ethotechnics Institute. "An AI agent acting for one person: implementation comparison." Ethotechnics Institute. Oct 13, 2026. https://ethotechnics.org/use-cases/examples/personal-agent.
BibTeX
@misc{ethotechnics_use_cases_examples_personal_agent,
title={An AI agent acting for one person: implementation comparison},
author={Ethotechnics Institute},
year={2026},
howpublished={Ethotechnics Institute},
url={https://ethotechnics.org/use-cases/examples/personal-agent},
version={v1.0.0}
}
RIS
TY - WEB TI - An AI agent acting for one person: implementation comparison AU - Ethotechnics Institute PY - 2026 UR - https://ethotechnics.org/use-cases/examples/personal-agent ER -