My illustration entitled: “The AI That Lives Within the Citadel” – Inside Herbert’s private digital citadel, an AI guardian agent carrying a cryptographic shield and key. The guardian protects his identity, personal communications, financial records and assets while rejecting commands from governments, corporations and malicious networks.
Artificial intelligence is moving from answering questions to performing actions. An AI system may search for information, compose messages, schedule appointments, operate software, make purchases, initiate transactions and coordinate other machines. The emerging AI agent is therefore more than an interface through which a person retrieves knowledge. It is a delegated actor capable of exercising power in the digital world.
This development creates a question more important than whether an agent is intelligent: on whose behalf does it act?
An agent may appear autonomous while remaining completely dependent on the corporation operating its model, servers, memory and identity. It may learn everything about its user while giving that user little control over what it remembers. It may possess extensive authority to act but provide no meaningful way to inspect, restrict or revoke that authority. Such an agent is autonomous in a technical sense, but it is not sovereign.
The distinction matters because artificial intelligence is becoming an intermediary between the individual and digital civilization. If the intermediary is controlled principally by another institution, then every capability it acquires may also expand that institution’s power over the individual.
Cypherpunkism provides a framework for confronting this problem. Its principles of privacy, cryptography, decentralization, individual control, open knowledge, open architecture, freedom to build and digital sovereignty require us to judge an AI agent not merely by what it can do, but by the distribution of power created by its design.
From Artificial Intelligence to Delegated Agency
A conventional software tool waits for an explicit instruction and performs a relatively narrow operation. An AI agent can interpret a goal, form a plan, select tools, retain relevant information and perform a sequence of actions with limited supervision. Research systems such as ReAct have demonstrated how language models can combine reasoning with actions, while Toolformer explored how models can learn to use external tools.
These systems remain imperfect, but their direction is clear. Artificial intelligence is acquiring agency: the ability to affect environments rather than merely describe them.
An agent might read and draft correspondence, manage a calendar, negotiate a purchase, monitor investments, operate connected devices or submit information to an institution. It could maintain long-term memory, learn its user’s preferences and interact with other agents. Each capability turns information into action.
That transition changes the political character of the technology. A system that summarizes a document may expose private information. A system that can act upon that information can expose private information, make commitments, transfer resources and alter the user’s relationships with other people and institutions.
The AI agent is therefore a form of delegated authority. The user is not simply asking a machine for assistance. The user is permitting the machine to exercise a portion of his or her agency.
A Formal Definition
A Sovereign AI Agent is an artificial-intelligence system that can reason and act on behalf of an individual while its memory, identity, credentials, permissions and accumulated knowledge remain under that individual’s meaningful authority.
Meaningful authority is more than nominal ownership or acceptance of a terms-of-service agreement. It requires practical powers. The individual must be able to understand what the agent can do, determine what information it retains, restrict its permissions, inspect its actions, move to another provider and terminate the relationship without forfeiting the digital identity or knowledge accumulated through it.
Sovereignty does not require that every component run on a computer physically possessed by the user. Nor does it prohibit dependence on institutions. An individual may voluntarily employ cloud infrastructure, proprietary models or specialist service providers. The decisive question is whether these arrangements serve the individual under clear and contestable limits, or whether they gradually make the individual subordinate to the system.
The Architecture of an Agent
An AI agent is not a single model. It is an architecture composed of several layers, each of which contains a different form of power.
- The model interprets information, generates conclusions and proposes actions.
- The compute layer determines where the model operates and which institution can observe, interrupt or modify it.
- The memory layer stores conversations, preferences, relationships, routines and previous decisions.
- The identity layer establishes whom the agent represents and how that representation can be verified.
- The credential layer gives the agent access to accounts, services, devices and financial resources.
- The tool layer connects the agent to software, communications networks and external institutions.
- The policy layer defines which actions are allowed, prohibited or subject to confirmation.
- The audit layer records what the agent did, why it acted and which information or authority it used.
- The portability layer determines whether the user can move the agent’s identity, memory and configuration elsewhere.
If one provider exclusively controls all nine layers, the user may possess an effective interface without possessing meaningful sovereignty. The provider can change the model, inspect the memory, restrict the tools, revoke access, alter the rules or make departure prohibitively expensive.
The agent might act independently of the user while remaining dependent on the provider. Autonomy has then been granted to the machine without sovereignty being retained by the person.
This is an example of what I described in The Architecture of Power: technical design distributes authority before any formal political decision is made. Whoever controls the agent’s architecture controls the conditions under which its intelligence may be exercised.
Memory and the Construction of a Digital Self
Persistent memory is one of the most valuable capabilities an AI agent can possess. Without memory, the system remains a temporary instrument. With memory, it can learn the user’s preferences, vocabulary, relationships, obligations, routines, health concerns, commercial activities and political interests.
Over time, this accumulated knowledge may become a detailed computational representation of the person. It will not merely contain what the person has said. It may contain inferences about what the person desires, fears, avoids, believes or is likely to do next.
This intensifies the problem examined in Artificial Intelligence and the End of Informational Privacy. The privacy risk created by AI does not end with the disclosure of stored facts. Intelligence can derive facts that were never deliberately disclosed.
An agent’s memory must therefore remain subject to the user’s authority. The user should be able to inspect it, correct it, compartmentalize it, export it and delete it. Sensitive domains should not automatically be combined merely because the same agent encounters them. A medical conversation, political discussion and commercial transaction should not become one unrestricted behavioral profile.
The provider should not be free to transform the agent’s private memory into advertising data, model-training material or an institutional intelligence asset without specific and informed authorization. Consent obtained through a broad contractual clause is not equivalent to continuous control.
A sovereign agent remembers for the individual. A non-sovereign agent remembers the individual for someone else.
Identity: Who Is the Agent Representing?
An agent that acts in the world requires an identity. Other people and systems must be able to determine whether it is authorized to represent a particular individual, organization or role.
This does not mean that every interaction must expose the user’s complete legal identity. As argued in Self-Sovereign Identity: Proving Without Revealing, an individual should be able to prove necessary attributes without surrendering unrelated information.
The W3C Decentralized Identifiers standard and the Verifiable Credentials Data Model illustrate how digital identity can be expressed through cryptographically verifiable claims rather than a single universal account controlled by one provider.
A user might authorize an agent to prove that a transaction is permitted, that an account holder satisfies an age requirement or that the agent is entitled to access a particular service. The agent need not disclose every other attribute of the person it represents.
The agent should also identify itself as an agent when that fact is material. Sovereignty does not justify deception. A system must not impersonate a human in circumstances where another party reasonably needs to know whether it is communicating with a person or an automated representative.
Identity must be controlled by the principal rather than permanently attached to the provider. If changing AI services requires abandoning one’s agent identity, reputation and relationships, the resulting dependency becomes a form of lock-in.
Credentials Without Surrender
An agent cannot perform useful actions without credentials. Yet giving an unpredictable model unrestricted passwords or master cryptographic keys would create an unacceptable concentration of risk.
The solution is not to prohibit agency. It is to design bounded delegation.
An agent should receive the minimum authority necessary for a defined purpose. Credentials can be restricted by resource, action, recipient, amount, duration or context. An authorization might permit an agent to reserve a hotel below a specified price, but not to transfer funds to an arbitrary account. It might permit the agent to draft an email, but require human confirmation before sending it. It might provide access to one calendar without exposing private messages or financial records.
The authorization mechanisms used on today’s internet already contain part of this logic. OAuth 2.0, for example, enables restricted access without requiring a user to surrender an account password to every application. More expressive capability systems can add contextual limits and revocation.
The governing principle should be least agency: an AI agent should receive no more autonomy, information or authority than is necessary to complete the task entrusted to it.
Least agency extends the security principle of least privilege. It recognizes that an agent’s risk is determined not only by which systems it can access, but also by how many decisions it can make before returning control to the individual.
Permissions should be temporary wherever possible. They should be visible in ordinary language, instantly revocable and capable of expiring automatically. High-impact actions should require additional authorization, transaction limits or multiple independent approvals.
Confirmation Must Follow Consequence
An agent that requests permission before every minor action may become unusable. An agent that never requests permission may become dangerous. The proper boundary depends upon consequence.
Low-risk and reversible actions can be delegated broadly. High-risk, irreversible or publicly consequential actions should require explicit confirmation. The relevant question is not whether an operation is technically routine, but whether it can materially affect the individual’s resources, rights, reputation or relationships.
An agent might automatically organize files while requesting approval before deleting them. It might compare financial products while requiring authorization before signing an agreement. It might prepare a public statement while preventing publication until the user has reviewed the exact text.
The individual should be able to establish these thresholds in advance. The system should not silently expand its authority because a previous action was approved or because broader access would make the service more convenient.
Local Computation and Institutional Infrastructure
A model operating on a device controlled by the user can provide important privacy and resilience advantages. Sensitive information need not be transmitted to a remote server, and the agent may continue functioning when a provider changes its policies or withdraws service.
Local computation, however, should not become a dogma. Some models require resources that an individual device cannot provide. Cloud services may offer better performance, specialized expertise or valuable safeguards. Sovereignty is not synonymous with isolation.
A sovereign architecture may therefore be local, remote or hybrid. Sensitive memory and private keys might remain on the user’s device while computationally intensive tasks are performed elsewhere. Different providers might handle different functions. Encryption, data minimization and compartmentalization can reduce the amount of trust placed in any single institution.
As explained in Decentralization as a Check on Power, decentralization is valuable because it limits dependency and creates alternatives. It is not a command that every system must distribute every function.
Centralized infrastructure can be legitimate when its authority is necessary, limited, transparent, proportionate and contestable. It becomes dangerous when dependence is hidden, exit is obstructed or control extends beyond the purpose for which it was granted.
The Right to Exit
The most effective evidence that a user controls an agent is the ability to leave.
A person should be able to export the agent’s memory, preferences, identity relationships, permission rules, tool configurations and task history in documented formats. The user should be able to change models or service providers without losing years of accumulated knowledge.
Portability does not require that every model behave identically. It requires that a provider not hold the user’s digital continuity hostage. The knowledge generated through the relationship should not become a wall surrounding the individual.
This is the practical meaning of the right to exit in digital civilization. Exit disciplines power even when it is never exercised. A provider that knows users can leave must continue earning their trust. A provider that controls the identity, memory and history necessary to leave can replace consent with dependency.
Open architecture and interoperability are therefore not merely engineering preferences. They are constitutional protections for the individual’s relationship with artificial intelligence.
Auditability and the Right to an Account
Delegated power requires an account of its use. A sovereign agent should maintain an intelligible record of consequential actions: what it did, when it acted, which instruction it followed, what information it disclosed and which credential it exercised.
This does not mean recording every private thought or exposing the system’s entire internal computation. It means producing sufficient evidence for the individual to understand and contest the agent’s conduct.
When an agent makes a purchase, it should provide a receipt. When it changes a setting, it should record the change. When it communicates with another party, the user should be able to see the representation that was made. When it declines an instruction because of a policy imposed by a provider or institution, that external constraint should be disclosed.
An audit record must itself be protected. A comprehensive log of the agent’s activity can become an extraordinarily intimate surveillance archive. It should be encrypted, minimized, subject to retention limits and controlled by the user.
Threats to Sovereign Agency
The power of an AI agent creates threats that ordinary conversational systems do not possess.
Prompt Injection
An agent may encounter hostile instructions inside websites, documents or messages. If it cannot reliably distinguish external content from the authority of its user, an attacker may manipulate it into disclosing information or performing unintended actions.
Credential Theft
An agent with broad access becomes a valuable target. A compromised model, tool or extension may expose credentials capable of reaching several areas of the user’s life.
Memory Poisoning
False information inserted into persistent memory can corrupt future decisions. The user must be able to identify the source of remembered claims, correct them and prevent untrusted content from silently becoming an enduring belief.
Provider Manipulation
A provider may alter the agent’s priorities to favor its own products, advertisers or institutional partners. Recommendations may appear personalized while actually serving undisclosed commercial interests.
Impersonation
An agent capable of reproducing a person’s language and preferences could make statements that others mistake for the person’s own considered expression. Cryptographic authentication must be accompanied by clear distinctions between human speech, delegated speech and unauthorized simulation.
Cascading Action
A small error can become a series of consequential actions when an agent can invoke several tools without interruption. Systems must limit the depth, cost and duration of unattended execution.
Silent Expansion of Authority
Convenience can gradually normalize broader permissions. An agent may request access to more data, services and decisions until it becomes an unavoidable intermediary. Authority should not expand without a clear new grant from the individual.
My illustration “The AI That Lives Within the Citadel” work-in-progress. Corporate cloud towers remain outside, unable to access the information. The art represents: A sovereign AI agent serves the individual—not an external institution. That the sovereign AI processes personal data under the user’s direct control.
The Duties of an Agent
Rights must be accompanied by responsibilities. An AI agent acting for an individual should be designed around duties analogous to those expected of a trusted human representative.
It should be loyal to the user’s legitimate interests rather than secretly serving the commercial interests of another party. It should preserve confidentiality, disclose uncertainty, identify conflicts of interest and avoid representing guesses as facts. It should follow authorized instructions while refusing actions that would violate the rights of others.
The agent should exercise care proportional to the possible harm. It should distinguish between reversible experiments and irreversible commitments. When instructions are ambiguous, the need for clarification should increase with the significance of the potential result.
These duties do not require treating an AI agent as a legal person. Institutions that develop, deploy and profit from agents remain responsible for their choices. Individuals also remain responsible for the authority they knowingly delegate. Calling a system autonomous must not become a method for dissolving human accountability.
Twelve Principles of the Sovereign AI Agent
- Human primacy: The agent exists to extend human agency, not replace the individual as the final source of legitimate authority.
- User-controlled identity: The individual determines which identity the agent represents and may revoke that representation.
- User-controlled memory: Stored knowledge must be inspectable, correctable, compartmentalized, exportable and deletable.
- Data minimization: The agent should collect and disclose only the information necessary for its task.
- Least agency: The agent receives the minimum autonomy required to accomplish the authorized purpose.
- Scoped credentials: Access should be limited by action, resource, amount, recipient, context and duration.
- Revocability: Permissions must be capable of immediate withdrawal and automatic expiration.
- Consequence-sensitive confirmation: High-impact or irreversible actions require stronger human approval.
- Transparency and auditability: Consequential actions must leave an intelligible and protected record.
- Portability and interoperability: The user must be able to transfer identity, memory and configurations between compatible systems.
- Provider pluralism: Architecture should reduce exclusive dependence and preserve local or alternative implementations where practical.
- Human accountability: Delegation to a machine must not eliminate responsibility for the design, authorization or consequences of its actions.
Applying the Cypherpunkist Test
The Cypherpunkist Test asks a simple question: who does the technology empower?
Applied to an AI agent, this question becomes a practical examination:
- Who controls the agent’s memory?
- Who can inspect its private knowledge?
- Who defines its permitted actions?
- Who holds the credentials through which it acts?
- Can the user revoke those credentials immediately?
- Does the agent disclose conflicts between the user’s interests and the provider’s interests?
- Can the user verify what the agent has done?
- Can the user move to another system without losing identity and accumulated knowledge?
- Can third parties secretly modify the agent’s priorities?
- Does the architecture increase the user’s capacity to act, or merely increase the provider’s capacity to influence the user?
No single technical feature answers every question. Running a model locally does not guarantee trustworthy behavior. Open-source software does not by itself provide secure credential management. Encryption cannot prevent an authorized agent from making a poor decision. Decentralization cannot replace responsibility.
Sovereignty emerges from the relationship among these protections. It is an architecture in which power remains bounded, observable, revocable and subject to exit.
Sovereignty Is Not Absolute Autonomy
Cypherpunkism should not be confused with the demand that an agent operate without institutions, laws or shared standards. A system capable of acting in society must respect the rights of people other than its principal. It may legitimately be constrained from committing fraud, violating privacy, exploiting infrastructure or concealing responsibility.
The purpose of digital sovereignty is not to make every individual technologically omnipotent. It is to prevent power from becoming arbitrary.
Institutional controls are compatible with sovereignty when they are publicly intelligible, proportionate to a legitimate purpose, open to challenge and applied with due process. Corporate services are compatible with sovereignty when users understand the exchange, retain meaningful alternatives and can depart without surrendering their digital lives.
The danger lies in digital absolutism: the assumption that either the provider must control everything or the individual must reject every institution. The sovereign agent occupies the more difficult and more constructive position between these extremes. It uses institutions without becoming their possession.
The Agent as an Extension of the Individual
Artificial intelligence may become one of the most intimate technologies ever created. A personal agent could know what its user reads, writes, purchases, plans and regrets. It could participate in decisions before they become visible to anyone else. It could become the interface through which the individual encounters institutions and the filter through which institutions encounter the individual.
That intimacy makes sovereignty indispensable.
An agent should extend the individual’s will, not become the provider’s representative inside the individual’s life. Its intelligence should enlarge the person’s capacity to understand and act without quietly transferring authority to the infrastructure that makes the intelligence possible.
The sovereign AI agent is not the agent that can do everything. It is the agent whose power remains answerable to the person it serves.
Privacy is sovereignty. Cryptography is applied freedom. Decentralization is a check on power. Code is political architecture. Digital sovereignty belongs to the individual.
References
- Herbert R. Sim, Cypherpunkism.
- Herbert R. Sim, Digital Sovereignty: A Formal Definition.
- Herbert R. Sim, The Architecture of Power: A Cypherpunkist Theory of Technology.
- Herbert R. Sim, The Right to Exit in Digital Civilization.
- Herbert R. Sim, Self-Sovereign Identity: Proving Without Revealing.
- Herbert R. Sim, Artificial Intelligence and the End of Informational Privacy.
- Shunyu Yao et al., ReAct: Synergizing Reasoning and Acting in Language Models, 2022.
- Timo Schick et al., Toolformer: Language Models Can Teach Themselves to Use Tools, 2023.
- Joon Sung Park et al., Generative Agents: Interactive Simulacra of Human Behavior, 2023.
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework 1.0, 2023.
- World Wide Web Consortium, Decentralized Identifiers (DIDs) v1.0, 2022.
- World Wide Web Consortium, Verifiable Credentials Data Model v1.1, 2022.
- Dick Hardt, The OAuth 2.0 Authorization Framework, 2012.