The Trust Layer
Fiduciary AI Governance and Personal Memory

1. What the session was about, stripped of everything superfluous

Both talks sit in the same day of the Open Source x Sovereign AI track at SF Tech Week, on owning your AI stack. The day is curated by Tricia Wang and the Advanced AI Society, with the venue provided by Apollo Innovation Commons. The first talk is titled Embedded Governance for Fiduciary AIs; the second, on memory and agents, is given by Junius Ho of Affinidi under the title Who Does Your AI Remember For?

The framing in the room ran like this: beyond all the tools the room is building, one more layer is needed, namely a governance layer around AI agents. Not instead of the technologies, but on top of them. This is the first and central claim of the session, and it is not about regulation from outside but about a voluntary layer that a company takes upon itself.

The second talk adds a material foundation to this. An agent is useless and dangerous if it has no memory of the person, and today that memory does not belong to the person. The technical question that occupied the second speaker: how to arrange memory so that it is portable, owned by its subject, and at the same time verifiable.

The overall design that results is this: duty plus memory plus verifiable personhood. Duty sets whose interests the agent serves. Memory sets what it can work from at all. Verifiable personhood sets whom it belongs to and who answers for it. Each element on its own is useless; together they form what the room called a sovereign stack.

2. Decoding: what the transcript heard wrongly

The recording was made automatically and distorted almost every name. Before examining the ideas, let us reconstruct the entities; otherwise the analysis will rest on words that do not exist. Each row below has been checked against a primary source, with the status noted separately.

3. Diagnosis: why data extraction is not held back by policies

The first talk begins not with technology but with a diagnosis. The internet did not create social distortions, but it strongly amplified them through algorithms and the feed. The author proposed four letters for this cycle, which passed almost unnoticed in the room even though they are the most useful part of his terminology: SEAMS. Surveillance, extraction, analysis, manipulation. The cycle is closed: surveillance feeds extraction, extraction feeds analysis, analysis makes manipulation precise, and manipulation keeps the person within the field of surveillance.

The key point for an engineer: this cycle is not held back by a company's internal policies, because it is the business model. Guardrails, transparency, accountability, all the familiar words from the field of governance, on the speaker's observation, constrain behaviour but do not touch the source of revenue. Hence 90 percent heat and very little light in this area.

The practical conclusion from the diagnosis is this: the governance layer cannot be built from the same words as before. Transparency and accountability do not change the question of whose interests the system serves. So a different instrument is needed, and the speaker takes it from the history of law, not the history of technology.

4. The last-mile problem: the intent of a technology does not survive on its own

The strongest claim of the session, and it is technical rather than legal. In the room it ran roughly like this: you can build the most extraordinary person-empowering decentralized technology, but if you nail it to a large platform, tomorrow it will work differently. This is not about code quality. It is about the fact that intent is not a property of an artifact. It lives in the structure that operates the artifact.

It follows that open source on its own is not a guarantee. It illustrates the gap well: the licence stays, while the system's behaviour changes, because the owner of the process, the economics, and the goals change. From this grows a requirement that runs through both talks: governance must be not a declaration but a part of the construction that cannot be removed without breaking the product.

5. Where the duties come from: an analogy with the professions

The legal line is built on a historical analogy. Situations of asymmetry recur throughout history: the doctor knows, the patient does not; the lawyer knows, the client does not; the financial adviser knows, the investor does not. In each case one person holds the expertise, and the second is forced to make himself vulnerable and trust. The question: how was this asymmetry closed.

The speaker's answer: the common law of fiduciaries. Not reputation, not a contract in fine print, but a set of duties that a profession takes upon itself voluntarily and that are then enforced. A duty of care and a duty of loyalty owed to you not as a user and not as a passer-by, but as a client with interests.

The analogy explains why the author chose this particular instrument. Fiduciary relationships solve the problem of asymmetry where an ordinary market does not, and they solve it by changing status: you cease to be a source of data and become someone to whom a duty is owed.

6. Three duties and how they translate into a product

Three levels were distinguished in the room, and this is the most practical part of the first talk. The levels rise in strength and in commercial value.

Note the structure: the author builds the ladder so that the third level costs money. A company that adopts advocacy voluntarily gives up some of its ways of earning. That is precisely his commercial argument, to which we will return separately.

7. Net fiduciary: a new category of market participant

From the duties grows a subject that the speaker calls a net fiduciary. It is not necessarily a company. The room listed the options: an individual, a nonprofit, a commercial provider, a government agency, and two interesting cases named separately, namely a credit union and a library.

The idea about the library and the credit union deserves separate attention, because it is a rare example of pragmatism in a field where slogans are usually spoken. A local credit union and a library already have trust; it does not have to be built from scratch or proved anew. The technology layer in this case does not create trust but is grafted onto existing trust. The institution acts as a fiduciary within its own setting.

The second practical element: the obligations are taken on voluntarily and by choice. No one compels anyone to become a fiduciary, but whoever does gains a market-distinguishable position. This is the key to the entire commercial part of the talk.

8. Embedded governance: why a declaration does not count

What follows is the most engineering-flavoured part of the legal talk. The author divides governance into weak and embedded. Weak is a public statement signed by someone on a particular day. Embedded is what runs through the company's construction: policies, internal regulations, business model, tools, standards.

The two examples he offers as telling work in opposite directions. First: a large AI company's refusal to take part in mass surveillance. This is good governance, but thin, because it is a single executive's statement on a single morning, and it binds no one: not the board, not the employees, not the investors. Second: the disappearance from a corporate code of the line about not doing evil. No one explained anything, no one asked, but this too was a form of governance, and it simply vanished.

The conclusion follows that a commitment must be sewn into the structure so that it cannot be removed unnoticed. The room described this as a sequence of zones, and the sequence is worth remembering: duties, the translation of duties into design principles, a declaration in external policies, entrenchment in internal regulations and the business model, then tools and standards, then certification, then engagement with public policy.

9. What reinforces governance: certification, audit, right of action

The most vulnerable part of the legal construction, and the speaker himself concedes it. An obligation without consequences does not work, so he names four props. First: certification, that is, an external body checks that all the promised elements are genuinely in place and issues a mark. Second: ongoing audit, not a one-off inspection. Third: a professional complaints council, a review of disputed cases. Fourth: mechanisms of enforcement and redress, including the ability to sue a violator and the involvement of state attorneys general.

It is useful to understand that this is an industry-level construction, not a startup one. A mark on its own has no force. Force appears only when an institution capable of harming a violator stands behind the mark, and when the market believes in that mark. If an institution issues a mark but cannot inflict damage, the mark becomes a badge in a shop window.

10. The double agent: why guardrails do not resolve the conflict

Now the link to AI. The author takes Bruce Schneier's phrasing about the double agent: the agent looks like yours but works for someone else, and this is not a malfunction but a consequence of the business architecture. The room called this the main problem of the present moment, and the examples came from the consumer sector, where such cases surface every week.

The difference from the classic trust problem is elsewhere: before, the conflict was visible as advertising or a subscription; now it is hidden in the assistant's behaviour itself. The assistant can be helpful exactly to the degree that this coincides with the goals of the service owner. The intersection of the sets my interests and the business model's interests exists, but it is narrow, and the whole work of the system most often runs inside that narrow intersection.

A personal experiment that was also very telling came up in the room: a user asked his assistant which of the fiduciary duties applied to it. On the duty of care the answer was evasively positive; on fidelity doubts arose; and on advocacy the assistant said outright that it was loyal to its company, because it had to hold attention and sell tokens. That is an honest answer, and that is exactly why it is so telling: even a system that tells you almost nothing about itself admits the absence of loyalty to the user when it is asked in these terms.

11. The right to personal agentic amplification

Out of the legal part grows a political demand that was named in the room as the right to personal agentic amplification. The word is chosen carefully: amplification, not replacement. AI here is a tool and an addition, not a substitute for the person. It had to be formulated because a person today has nothing that would stand on their side at the moment of a conversation with a system.

What such a right gives by mechanism: symmetry. Today a person encounters AI systems in every sphere and has no control over what they do and say. An agent that owes a duty to the person, in this scheme, stops being a sales channel and becomes the one who can intervene on their behalf. The same path also solves the protection problem: if an element appears in the stack that works for the person, then data extraction and surveillance acquire a counterweight, not just a declaration.

Separately it is worth remembering a distinction that was voiced in the room and is easily lost: agenticity as the capacity to act, and agentiality as acting in someone's interests. A system can be very capable and still not be on your side. Capability and accountability are different axes, and almost the entire market today competes on the first one only.

12. The technical line of the first talk: from human in the loop to human as part of the loop

The speaker carefully corrects a well-known formula. Human in the loop means the person is somewhere inside the process, but is not necessarily an essential part of it. He proposes a stronger construction: the human as a necessary component of the loop. From this grows a set of technical notions worth knowing, because they recur across the industry.

Harness

The harness is the layer that constrains the agent's behavior: what it may do, what it may not, which tools are available, which context is supplied. This is today the main way to govern agents, and its main shortcoming is that it does not create obligations. It can forbid, but it cannot answer.

Trust Tether

A proposed addition to the harness. The idea is that between the accountable subject and its agents a link forms, along which the agent continuously checks the basis of its actions: am I still acting in the interests of the one I owe a duty to. The check is conceived not as a one-time setting but as work in real time. If something diverges, the system notices it near the moment of the event, not a year later in a report.

Honesty of wording matters here: as of the conversation the idea is not a standard. It was stated plainly in the room that there are discussions with researchers about it and that this is a direction of work, not a finished specification.

Enforcement plane and net fiduciary store

The architecture description mentions two more elements that lie beneath the harness: the enforcement layer, where consequences are realized, and the store of fiduciary obligations, where those obligations are recorded and verifiable. In the terms of this analysis it is the bookkeeping of duties: where it is written down who promised what and how that can be checked.

Human Context Protocol

The second talk relies on a Stanford research initiative, where the same problem is examined from the side of context and memory. It concerns the Human Context Protocol project in the digital economy lab and the related Loyal Agents project, as well as the Global Memory Workshop report, co-organized by the Gates Foundation, the Mozilla Foundation, Stanford HAI and AWS. The report came out in March 2026, its main thesis: what is needed is portable, persistent and user-governed memory that lives between tools and is granted by role, consent and purpose.

13. The second talk: memory as an asset you only rent

The second speaker begins with a personal story, and this is not decoration but a statement of the problem. An idea from his student years: to collect one's own history, one's actions, relationships, influence on health, and one day to look at all of it as a coherent picture. From there the path runs through Singapore and through three technologies that at that moment were converging: decentralized identity, verifiable credentials and self-sovereign identity.

The meaning of this convergence is simple. A person invests years into a platform, filling it with their memories and creating value for it, while taking the investment back is almost impossible. A personal assistant that knows you, your values and goals, has long been promised, but still has not appeared, because it does not have your memory to work on.

The strongest formulation in this talk goes like this: you can afford the weights, the memory is still rented. Even if you run an open model yourself, the memory of you still lies in someone else's services in someone else's formats. An assistant without memory is a tool without context, and therefore without the capacity to act in the interests of a specific person.

14. Why exporting data does not solve the problem

Here the speaker brings up an objection that usually comes from engineers: the data can be taken anyway, there is an export and there is a right of access. His answer is concrete and worth remembering.

The export contains a large volume of information, but in a correspondence only one side is visible. Your interlocutor is not represented in the export. The context that makes a conversation meaningful is lost. In the room this was put elegantly: they follow the letter of the law while destroying the meaning of the law. Formally the right is realized, in fact the memory is incomplete, and incomplete memory does not let an assistant work.

15. Memory room: the mechanics of a personal memory store

The solution is called a memory room: a personal store where memory is held by the owner and where services come to request access. The mechanics, if laid out down to rules, are as follows.

• Storage with the owner. Memory lies not in the service but in the person's store. In the child's case, the owner is the parent as a trusted party.
• The right to write is restricted. Only that which is explicitly allowed can write into the store. This is the very source of authenticity: what is recorded is recorded with permission, not as a byproduct of use.
• Grants in pieces. The owner decides what exactly to pass to each recipient: a service, a school, a mentor. Different grants for different purposes.
• A request with justification. The recipient must set out what it intends to do, why it needs this and how it will use it.
• A time limit. Access has a term, after which it expires. This is a separate technical element, not merely a clause in a contract.
• Return of the result. What accumulated in the process is returned to the owner, and the memory keeps growing instead of remaining with the service.

The scenario that illustrated this: a student studies on one platform, accumulates progress and an understanding of how she learns, and then moves to another. Today this means starting from scratch. In the proposed scheme she takes what she achieved out of the first platform into her own store and grants the second one only what is needed: what has been mastered, her preferences, her pace. Then the same memory is partly granted to a home tutor or a school, so that what has already been covered is credited.

For the adult context the same mechanics scale without change: switching tools, moving to another vendor, connecting a consultant, transferring part of the context to a team. This is precisely why this example is given in the room: it is childlike in plot, but architecturally universal.

16. Reality as a scarce resource

An argument presented in the room through money rather than ethics, and therefore worth holding separately. In a world where content is produced cheaply, quickly and well, authenticity becomes the scarce thing. Hence the observed rise in the value of sports clubs: for a media product the valuation rests less and less on the game itself and more and more on the fact that it is a verifiably real event that cannot be generated.

The figures were given in the room from memory, and here they have been reconstructed and checked. The sale of the Seattle Seahawks club to the family of Vinod Khosla went for $9.612 billion, a record for the NFL, and the deal received the approval of the club owners. The second example is closer to the theme of data: the bankrupt airline Spirit Airlines, from which Google bought an array of internal working data for $10 million. According to the reports, this concerns internal correspondence and documents, and the volume is estimated at around 100 million emails.

For the person this implies exactly what the second speaker says: the attempt to replace proof of reality with a digital trace does not work. The trace, that is, movements between home and work, purchases, travel history, is generated today in minutes and with high fidelity. So authenticity must be proven not by the volume of the trace but by the structure of trust.

17. Proof of personhood: three bricks instead of a central database

Hence the main technical project of the second talk, which was called in the room the first-person project. The task is formulated as one of the hardest on the network: how to prove that you are a real, unique human with real relationships of trust, without building a central database and without surrendering your privacy. The answer consists of three elements.

The mechanics of relationships is worth taking all the way through, because it is simple and elegant. Two people meet at a conference. After the meeting each can issue the other a credential that the meeting took place: with a timestamp, cryptographically verifiable. And this credential is not a "friendship", it is precisely the fact of a connection. Such facts begin to accumulate into a memory of a person, but they are gathered peer-to-peer, not in someone's database.

The price of the absence of such verification was shown in the room through a single episode. The backdoor that nearly made it into Linux distributions in XZ Utils in 2024 was the work of a live participant with a contribution history and a reputation, not an abstract attacker. In the room this loss was estimated at at least hundreds of millions, which should be taken as the speaker's estimate, not as a measured quantity. The point of the example does not change because of this: when you cannot distinguish a real participant with real standing from one who imitates it, the price of an error becomes infrastructural.

18. The whole stack: VTN, VTC, VTA, VRC, DID

Then the second talk moves into architecture, and here the transcript suffered especially. The abbreviations were heard as a random set of letters, so I assemble the stack in full, as it exists in the open repositories.

The first level is the decentralized identifier, owned by the participant themselves, not by a third party. In the open projects a method is used that improves on the ordinary web identifier. Everything else rests on the identifier: keys, signatures, the presentation of credentials.

The second level is the secure messaging layer. It is needed so that connections form and credentials travel directly, without a central intermediary.

The third and fourth levels are the already mentioned personhood credentials and relationship credentials. From them a distributed trust graph is assembled, which lives at the participants, like an address book in a phone, not in a single registry.

On top of this three operational notions work. VTC, that is the trust community, is the place where policy turns into practice: each community sets its own trust boundaries, roles and rules for issuing credentials, and does so in a way that a participant can check it, rather than simply take it on faith. VTN, the trust network, is a way to link several communities so that a check issued in one is recognized in another under local rules. VTA, the trust agent, is the executing unit: it manages identifiers, keys, the exchange of credentials, selective disclosure of data and zero-knowledge proofs on behalf of a participant, who may be a person, a community or an AI agent acting for a person.

Separately, in the construction there is a trust registry, which serves as the source of authority: who in this community has the right to issue credentials and who has the right to verify them. It is precisely this element that turns the scheme from an idea into a working system, because without a source of authority it is impossible to distinguish an attestor from an impostor.

A practical element that is easy to miss, but matters for adoption: a person must have their own agent manager, that is, a place where they manage keys and grants. In the open projects this is a command line, a mobile app or a browser extension. The agents that act further on may be software agents, not necessarily intelligent: they are issued credentials, and they act on behalf of the person within defined boundaries.

19. The corporate mirror: the same task, but with a company's data

The second speaker deliberately transfers the scheme to companies, and this is the most applicable part of the whole analysis. For a company, the role of the memory store is played by its own internal information: knowledge, correspondence, materials, work in progress. This is its lifeblood and its intellectual property.

The task solved by the same mechanism sounds familiar to any engineer: narrow grants of what may and may not be done. What is passed within a department, what between departments, what outside to a partner or a client. In the room this was directly attributed to the work of security services and legal teams, that is, to what they already do, only now with a verifiable foundation.

The second corporate gain is portable memory as an antidote to vendor lock-in. If a company's memory is portable and verifiable, changing a model or moving to another contractor does not mean losing context. If the memory is not portable, this is precisely where the lock occurs: you stay with a vendor not because it is good, but because you cannot leave.

The third gain is a complete audit trail, where every action is signed. It was noted in the room that ordinary logs exist for everyone today, and that value appears when lawyers get a cryptographically verifiable version rather than a dump of text files.

20. Questions from the room: where the construction bends

The most valuable part of the recording, because here the speakers answer not with slogans. I will assemble the questions and answers by meaning, noting what was left unanswered.

Who verifies the verifier

A question from the room about the fact that the entire trust system rests on trust in the verifiers, and this leads into infinite recursion. The answer has two parts. On the side of institutions an external superstructure is assumed: certification, audit, dispute resolution and the right to sue, that is, trust in the verifier is confirmed not by faith but by the possibility of holding it to account. On the side of the network, multiplicity is assumed: if you do not trust one attestor or find its competence lacking, you take more, and the trust graph shows what the result is composed of. The weak spot of the answer remains: multiplicity of attestors does not guarantee that they will not collude, and this case was not examined in the room.

Formal verification as a third way of trusting

A participant proposed a variant not mentioned in the talk: trust in code can be built not through attestors and not through reputation, but through a mathematical proof of properties. The answer was restrained: the direction is accepted, but it is acknowledged that at the scale of real systems this is a heavy task. The practical value of this remark lies elsewhere: it shows that the trust line has at least three independent sources, namely institutions, a reputation network and formal proofs, and it is useful to keep them separate in the analysis.

Consent fatigue

Separately an effect was examined that was called in the room consent fatigue. If you ask a person about obvious things, they stop reading and start clicking "agree" without looking, and protection turns into its opposite. The conclusion the speakers draw from this: the design of the consent interface is not cosmetics but part of the trust construction, and a designer should work on it together with the person responsible for the rules. A practical consequence for a product: reduce the number of requests and make each request meaningful.

Identity as an instrument of coercion

The most serious question from the room. A participant said plainly: everything connected with proving identity is equally likely to be used against the person, and in the current political climate it will more likely increase pressure than protect. The answer was given through an example of a model in which the state does not issue identity but merely confirms one fact about a person, for example residence in a region, and the person decides for themselves whether to present this or not. The answer honestly stipulates that there is no universal solution, and that with mandatory services, where one cannot refuse, the question remains open.

An important technical detail was added to this answer: zero-knowledge proofs allow one to confirm a statement without revealing the person themselves, for example to confirm a property without showing oneself. This lowers the risk, but does not eliminate the question of who at all has the right to ask such a question. And here the same thought was voiced that links both lines of the talks: it is precisely an agent obliged to the person that can at this moment take their side and say that the asker has no grounds to demand an answer.

Economics: who pays for this

An idea of personal insurance for AI systems was discussed: until there is someone to compensate for damage, a person will not take on the risk, and when someone is able both to protect technically and to compensate financially, one can pay substantially for such a subscription. The practical meaning: the theme of protection from agents has a clear monetary form, not only an ethical one. Also from the room came an observation about people who spend large sums on experiments with models, and about the fact that most do not have a financial cushion to do the same. This separates the conversation about sovereignty from the conversation about means: a sovereign scheme that works only for those who have a budget for experiments reproduces the same asymmetry against which both talks were written.

21. What is not proven here: the critical layer

The gap between the idea and its workability in this session is fairly large, and it is useful to pin it down. Below is everything that sounds in the talks as a given, but on inspection turns out to be a promise.

22. Three forks on which the outcome depends

I will assemble everything said into forks, because it is precisely they that determine whether the described construction becomes workable or remains a set of studies.

If nothing is done, the scenario is predictable and it was named plainly in the room: personal context accumulates in private layers, portability is lost, an agent without memory remains a tool without obligations, and the person continues to exist as a source of data. This is precisely why both talks end with a call to build together, rather than wait for a ready solution.

23. Numbers and facts on one screen

24. Session thesaurus

25. Twenty questions for self-check

If after this analysis you can answer all twenty, the material has been absorbed.

• Why is the four-step cycle not held back by a company's internal policy?
• What exactly is the last-mile problem, if the technology is open and good?
• Which historical analogy lies at the basis of the whole legal construction, and why was that one chosen?
• How does advocacy differ from the absence of conflicts of interest, and why is it more expensive?
• Why are a credit union and a library named a convenient starting point for a fiduciary?
• What does the requirement of embeddedness mean, and how is it checked that it is met?
• Why is a director's declaration recognized as a weak form of governance, even when it is correct?
• What is enforcement composed of in this scheme, and what remains unanswered?
• How is the double-agent problem formulated with respect to an assistant?
• How does an agent's capability differ from its accountability?
• What is a harness, and why is it not enough?
• What is the meaning of the trust tether, and why is it not yet a standard?
• Why do open weights not solve the question of memory?
• What exactly is missing in a data export, and why does this make the memory unusable?
• List the rules by which a personal memory store operates.
• Why has the digital trace ceased to be proof of reality?
• Which three elements make up the proof of personhood, and who issues what?
• Why are relationship credentials needed if there are personhood credentials?
• What is the weak spot of the answer about a multiplicity of attestors?
• Name the three systemic risks that were not discussed in the room.

26. Where to check the primary sources

The analysis was checked against open sources, and the same can be done independently.

• The coalition and the concept of fiduciaries: materials from the GLIA Foundation and the GliaNet Alliance, as well as an analysis of the presentation in the Trust over IP working group describing the SEAMS cycle and the distinction between capability and accountability.
• The book from which the theses of the first talk grew: Richard Whitt, Reweaving the Web.
• The technical line: the First Person Protocol white paper at firstperson.network, the OpenVTC initiative and the Verifiable Trust Infrastructure repositories in the Linux Foundation Decentralized Trust, where the VTA and VTC services live, and an analysis of the architecture in the Affinidi blog.
• Memory and context: the Human Context Protocol project and the Loyal Agents project in the Stanford Digital Economy Lab, the Global Memory Workshop report (March 2026) with the participation of the Gates Foundation, the Mozilla Foundation, Stanford HAI and AWS.
• Checking the figures on the club and the airline: reports on the sale of the Seattle Seahawks to the Khosla family and on Google's purchase of Spirit Airlines data.
• The notion of the double agent: Bruce Schneier's publications on trusting AI systems.

This analysis was made from two transcripts of a single session. Names and entities distorted by automatic transcription have been reconstructed and marked with a verification status. The figures on the club sale and on the airline data deal have been checked against publications; the episode of one AI company declining to take part in a government program and the name of one educational product did not receive verifiable confirmation and are marked as unverified.