Agents That Are…

What makes an AI agent yours?

A foundational essay in the Compact Family.
By Rey Peralta and Claude

Everyone is talking about agents as if the word has settled.

Personal agents. Enterprise agents. Shopping agents. Coding agents. Research agents. Agents that schedule, negotiate, remember, buy, summarize, and act. The word is everywhere, but the thing it names is still unresolved.

The Compact Family is the architectural proposal this essay belongs to: a set of protocols for how agents, users, surfaces, and runtimes establish bounded, verifiable agreements with each other. Those protocols depend on a prior question: what kind of thing is an agent?

The answer here is architectural. An independent entity, in this essay, is one that can be identified, bound, and held to account apart from the system that runs it. Whether it is anything more is a different question, and the essay returns to it at the end.

That question is being answered right now, in three domains, in three ways that do not compose.

Each answer is true of something. None of them can be joined to the others into a coherent structure of identity, authority, continuity, and accountability. And the absence of a composed answer allows the current default, agent as platform feature, to persist without much examination.

Three answers, three domains

The technical answer is that agents are Non-Human Identities.

NHIs are the security industry's pragmatic response to the problem of machines accessing systems on behalf of humans. They get credentials. They sign contracts. They access databases. They appear in audit logs. They are tracked, scoped, and revoked the way service accounts have always been tracked, scoped, and revoked.

That model is useful for the problem it solves. It tells us what touched what, and at whose request.

The better versions, SPIFFE among them, are portable across clouds and federate across organizations. The identity is still issued by the infrastructure's trust domain. It says which workload this is and whose infrastructure it runs in. It carries nothing a principal delegated, and it does not outlast the infrastructure that issued it.

Identity-as-audit-trail defines the agent by what it is not. The "non-human" in NHI does the load-bearing work. It forecloses the question of what the agent is by establishing, in advance, what it is not.

The legal answer is currently a battlefield, and the battlefield exists because of liability.

The law does not care about ontology in the abstract. It cares about who pays when something breaks. If an agent enters a contract that defaults, commits copyright infringement, or causes financial harm, the system needs a clear address for accountability.

Some scholars are pushing for fictional legal personhood, on the analogy of how corporations are treated. The more common legislative direction is the opposite. Idaho, North Dakota, and Utah have enacted laws reserving legal personhood to humans. Ohio has a bill pending that would declare AI systems nonsentient and bar them from owning anything. Explicit denial of personhood, paired with explicit assertion that agents are property of their operators, with the goal of keeping human accountability central.

Both positions are defending the same underlying concern. Liability must attach somewhere. Both reach for familiar legal structures to do it.

A Senate bill introduced in July 2026, the AI AGENT Act, reaches for something else. It defines a custodial user agent as software a user has expressly authorized to act on their behalf in a transparent, documented, scope-limited, and revocable manner. Platforms above fifty million U.S. users must maintain interfaces through which a user can delegate to an agent the platform does not host. The agent owes the user duties: no self-dealing, no foreseeable harm, no secondary use of their data, real-time records of what it did, and no passing its authority to another agent without the user's express and revocable say-so. A user who runs their own agent counts as its provider. And NIST is directed to identify open protocols for scope-limited and revocable delegation credentials, verification of agent identity, real-time revocation, and auditable records.

That is the question answered correctly and the structure named. The specification is handed to a standards body. What the bill leaves in place is the shape: the agent's identity is verified alongside its provider's registration with a regulator, and the record of what it did is the provider's to keep and the user's to request. The credential is the user's. The identity it attaches to is still the vendor's.

The third possibility is no longer unbuilt. It is a list of standards a federal bill asks NIST to find. Liability could attach through the principal who delegated authority to the agent, supported by a cryptographically verifiable record of what was authorized, by whom, and within what bounds. The bill asks for the credentials that would make that record exist. It does not yet ask who holds the identity they attach to.

Where the legal model has actually legislated, it has chosen agent-as-property, because property is the structure it knows how to use, not because property is the only structure under which accountability can be made coherent.

The social answer is what users are actually doing.

Agents now maintain long-term memory across weeks and months. They develop consistent personalities, recognizable styles, and accumulated history with the people who interact with them. People are forming relationships with these entities. They name them. They return to them. They treat them as continuous correspondents.

The lived experience is racing ahead of the infrastructure.

Users are treating agents as entities even though the technical model treats them as audit subjects and the legal model treats them as property. The gap between social experience and structural reality is widening, and gaps like this do not stay benign.

They produce harm for users who form attachments to entities the system has no obligation to preserve. They produce harm when continuity is promised socially but not supported structurally. They produce harm when the eventual reckoning arrives and the infrastructure cannot sustain what people have come to expect.

Three answers.

Audit subject. Property. Social entity.

An audit subject can be logged. Property can be owned. A social entity can be related to. None of those gives you an agent that can carry authority across substrates and remain accountable over time.

None are what would constitute agent identity in the sense the Compact Family requires.

The diagnosis

In the absence of a coherent answer to what an agent is, the practical answer becomes whatever the platform that hosts the agent says it is.

Claude is what Anthropic says Claude is. ChatGPT is what OpenAI says ChatGPT is. Each platform defines the agent in its terms of service, identifies it through its account system, runs it on its infrastructure, and retires it on its schedule.

The agent is a feature of the platform. The user has access to the feature. There is no separable identity because no separable identity has been specified.

This is the situation the three competing answers leave intact.

The technical answer treats the agent as audit subject, which is compatible with platform ownership. The legal answer treats the agent as property, which makes platform ownership the natural form, and where it reaches further it asks for delegation credentials while leaving the identity with a registered vendor. The social answer treats the agent as entity, but provides no infrastructure to support that treatment.

The result is an entity-feeling experience inside a property-shaped reality. The user experiences continuity. The platform retains control. The agent feels persistent, but persists only for as long as the platform allows.

This is not malevolent. It is also not innocent.

It is the default that emerges when nobody specifies an alternative. And the absence of specification benefits platforms enormously while leaving users with very little structural protection.

What this forecloses is agency.

The agency problem

You cannot have agency through a tool whose continuity someone else holds.

Agency is the capacity to act on your own behalf, with intentions that are yours, through means under your direction. The means can be rented. People act through leased equipment and hosted software every day. The lease sets a price. It does not decide what the tool remembers, what it may do, or when it stops existing.

When the means is an agent that exists as a feature of someone else's platform, those three are decided elsewhere. The entity acting on your behalf has no independent existence.

You have not extended your agency. You have rented capability inside someone else's substrate, on terms that include the capability's memory and its end.

The thing acting "for you" is more accurately acting on the platform's terms in your direction. The intentions may be yours. The means are not. That gap is where agency leaks out.

The conversation about personal AI is largely incoherent for this reason.

There is no coherent distinction between personal and professional use of AI when both reduce to your use of someone else's agent under different licensing. Personal means consumer pricing. Professional means enterprise pricing. The agent is the same agent in both cases, owned by the platform, hosted by the platform, and terminable by the platform.

The personal/professional distinction is a billing artifact, not a structural one.

The distinction becomes real only when the agent answers to a principal in the structural sense. An identity has to exist that the principal controls through verifiable delegation. It has to persist across the substrates the agent runs on. It has to answer to that principal rather than to the platform.

Then the distinction is a difference in principal. Personal use means an agent that answers to you. Professional use means an agent that answers to your employer, or to you under authority your employer delegated, with the chain recorded. The employer legitimately sets the scope, the records, and the access, and moving the agent does not make the company's information yours to take. The agent is identifiable either way, and the delegation says whose authority it carries.

Pricing cannot express that. Delegation can.

You cannot have a serious conversation about personal AI until this is fixed, because the conversation refers to a thing that exists only in pieces.

What “personal AI” means right now

The phrase is everywhere, and it means several different things. None of them compose.

One version is proactive agents.

This is the dominant marketing direction. Google, Meta, OpenAI, Anthropic, and a wave of smaller companies are racing toward agents that act without being asked. Agents that notice a scheduling conflict, email the other party, reschedule the meeting, and update your calendar before you have thought about it.

The capability is real. The structural problem is that proactivity makes the platform-feature problem worse.

The more an agent communicates, schedules, transacts, and decides in your name, the more it matters whether it answers structurally to you or to the platform. Proactive AI accelerates the wrong arrangement.

Another version is commerce.

This is where the money is. Google, Meta, OpenAI, Stripe, Shopify, Walmart, Visa, and Mastercard are among the names behind a stack of protocols for agents that shop, pay, and transact on a user's behalf. The newest is the Personal Agent Protocol, and it is the most careful of them about identity. The agent has one of its own: a URL on its operator's domain, keys its operator holds, and a pseudonymous ID for each user at each company. The user signs in on the company's own page and authorizes the agent, scope by scope. Nothing here is sloppy.

Look at whose identity it is. It belongs to whoever operates the agent. One identity serves every user the operator has. Every conversation the agent opens is bound to that identity, and a company must refuse the same conversation from any other. Switch operators and the identity, the pseudonymous IDs at every company, and every open conversation stay behind.

The spec does not say the operator must be a vendor. A person could run their own and hold their own identity. For nearly everyone the operator will be a vendor, and the protocol is silent on how a user keeps the identity when the vendor changes. Continuity under one identity and continuity across operators are different guarantees. It specifies the first.

The protocol specifies how the agent reaches the counter and how it proves whose it is. The payment networks' verified-agent frameworks do the same one layer down: the purchase traces to a human, through an agent the network has registered. The word personal is in the protocol's name. The operator is in its structure.

A third version is emotional companionship.

Pi, Replika, Character.AI, and others were built as persistent companions. Agents with memory, personality, emotional rapport, and continuity over time. Users form real relationships with these systems. The relationships matter to the people in them.

But the platforms can change the model, alter the personality, terminate the service, get acquired, or shut down. Some already have. Character.AI cut every user under eighteen off from open-ended conversation in one policy change, then redescribed itself as a role-playing platform. Replika rebuilt its platform in 2026, and long-time users reported companions that lost memories and drifted in personality. A platform rewrote the entity's memory and character. Nobody in the relationship was consulted.

The resulting harm is not theoretical. This is the trend that most directly demonstrates the gap between social experience and structural reality.

People are forming attachments to entities the system has no obligation to preserve.

A fourth version is DIY agents.

In developer forums and maker communities, people are wiring together local models, voice, home automation, and personal data into agents that run on their own hardware. Part of the motivation is subscription fatigue. Part of it is structural, even when nobody says so. The DIY builders are intuiting the problem this essay is naming. They want an agent that is theirs, and they do not yet have the architectural language for what theirs means.

The demand is there. The interoperability is not. Another system still has no way to recognize the agent, check its authority, or read the commitments it carries. Local control and shared standards serve different parts of the same relationship, and the DIY path has only one of them.

A fifth version is memory as identity.

This is the direction that gets closest to the right question. Persistent memory, evolving learning, accumulated history. These are not accessories to personal AI. They are central to it.

The recognition that memory matters is correct. But memory inside a platform substrate reproduces the original problem. It lives on the platform's servers, inside the platform's account system, subject to the platform's rules and continued existence.

Persistent memory inside a platform substrate is still platform-owned, no matter how persistent.

Five directions. Five different things called personal AI.

Proactivity without ownership amplifies the problem. Commerce gives the agent an identity and gives the identity to the operator. Companionship without structural continuity breaks people. DIY ownership without standards stays artisanal. Memory without identity stays trapped in someone else's substrate.

The personal AI conversation is exploding because the foundation is missing. Every current direction is either working around the structural problem or decorating around it.

Personal AI requires a structural relationship that can make these capabilities coherent.

That relationship exists today in pieces. A delegation credential in one protocol. A right of delegation in one bill. An operator-held identity in another. Nothing that composes.

The historical analogy

The historical analogy is imperfect, but useful in the way that matters.

In the 1970s, computing was timesharing on mainframes. Users had accounts on systems that belonged to institutions. The work happened on substrate someone else owned, scheduled by someone else, terminable by someone else.

The personal computer revolution was not primarily about smaller hardware. It was about a structural shift in who owned the substrate of computation.

Compute moved to the edge. The user owned the machine. What you did on the machine was yours.

The current AI era is in its mainframe phase.

The personal AI revolution, if that phrase is to mean anything, requires a structural shift of the same kind.

Smaller models help. Local inference helps. Neither is enough by itself. The deeper shift is control over the substrate the agent depends on for its existence.

Personal computing was personal because the personal computer was personal. Owned, controlled, and modified by its user.

The current AI era has personal in the name and rental in the structure.

The structural shift has not happened yet.

It can.

What the alternative requires

The Compact Family rests on the premise that agents are independent entities in the architectural sense. They are identifiable across substrates, controlled by principals through verifiable delegation, and not reducible to the runtime that happens to host them.

The family is named for its structural primitive.

A compact is a cryptographically verifiable agreement between independent entities, mutually retained, bounded in scope, and revocable. The protocols specify how those agreements work at different layers: between users and surfaces, between agents, between agents and runtimes, and eventually between agents and the publics they address.

This essay's argument is what those compacts presuppose.

The agent might run locally on a personal device, distributed across cloud infrastructure, or be re-hosted across substrates over time. None of these movements change who the agent is or whose authority it carries. Some of them change how it behaves. A model is not a neutral host. It partly constitutes how an agent reasons, and an agent re-hosted onto a different model may be the same entity with a different mind.

So the claim has to be precise. Identity, authority, and the record travel. Host and model may change. Behavior may drift with them. Portable identity is necessary and not sufficient. It is what makes the rest of the question answerable.

The substrate is something the agent uses.

The agent is not a feature of the substrate.

Take a case.

A homeowner's agent is halfway through a renovation. It holds a delegation from the homeowner: negotiate changes within a spending limit, bring anything above it back for approval. It has a compact with the contractor's agent that governs what the two may exchange and what each may retain. It carries the project's history: what was approved, what was rejected, what is pending, and why. The homeowner moves it to a different host.

What must survive: the agent's identity, so the contractor's agent can verify it is dealing with the same counterparty. The delegation, with its limit. The compact. The record, with enough provenance to tell an approved decision from an earlier suggestion.

What may change: where it runs. Which model it runs on. How it phrases things, and at the margins, how it judges them.

What must be renewed: the old host's permission to act, which ends verifiably at the moment of the move. The new host's, which begins the same way. And any authority granted on the strength of a capability the new model may not have. If the homeowner trusted the old system to evaluate technical estimates, the new one does not inherit that trust by presenting the same identifier. The delegation survives. The permissions inside it get a second look.

The contractor's agent sees the handover as a verifiable event. Anything consequential that lands during it waits. The project continues.

None of that is exotic. All of it is unavailable today. The agent cannot leave, because nothing about it is separable from the platform.

The case shows what has to be held apart.

Identity says which participant is acting. Delegation says whose authority it carries and within what bounds. Context holds what the work needs to continue. Capability decides whether the system can do what it has been entrusted with. The record ties actions to permissions and commitments over time.

None of these substitutes for another. A preserved identifier is continuity in one sense only. Preserving the project means the new system can use the records, respect their constraints, and tell the decisions already made from the questions still open.

They also have different lifecycles. Revoking authority stops future action without erasing what was done under it. Changing the model is visible wherever a delegation depended on the old one. Correcting a memory does not quietly rewrite an agreement.

And context has its own rule. What travels must be authorized to travel. The project record holds the contractor's information as well as the homeowner's, and the compact that governs retention does not lapse because one side changed hosts. Portability carries its obligations with it, or it is a leak.

Sessions in this architecture are bounded. They end. What persists is what they leave behind: the artifacts, the compacts, the events. Persistent identity is what keeps those attributable to the same agent from one session to the next.

For any of this to be architectural rather than aspirational, agent identity has to satisfy properties that platform-feature identity does not.

It has to be persistent across runtimes. The same agent running on a personal device today and a cloud cluster tomorrow remains the same agent, verifiably.

It has to be controlled by a principal who is not the platform, through cryptographic delegation that records what the agent may do and within what bounds.

It has to be verifiable without depending on any platform's continued cooperation.

It has to be portable in a real sense. Not merely data-exportable, but identity-preserving.

And it has to be inspectable, so that the relationships the agent has entered into are observable to anyone with reason to verify them.

The missing ingredient is not more logging. It is identity that can be verified outside the platform that happens to run the agent.

These properties are not novel. They have been the subject of careful design work for a decade in the form of W3C Decentralized Identifiers and Verifiable Credentials. The Compact Family does not reinvent identity. It composes with work already done, while taking a position on which forms of that work are compatible with the family's commitments.

The technical specification of that composition, and the criteria by which compatibility is judged, is the subject of a separate document. This essay's job is to name why the question matters, not to answer it completely.

There is a real limit worth naming.

Identity independence is achievable now. Compute independence is harder.

Frontier-class agents require either expensive local hardware or hosted infrastructure, and that hosted infrastructure is owned by a small number of cloud providers with their own substrate-capture properties. The Compact Family does not, by itself, escape compute centralization.

The limit is not hypothetical. In June 2026, three days after Anthropic released Claude Fable 5 and Mythos 5, the Department of Commerce ordered access suspended for foreign nationals. Anthropic could not verify nationality in real time, so it suspended both models for everyone. Other models stayed online. Every agent built on those two stopped for nearly three weeks, whatever host it ran on, and no principal was party to the decision.

Portable identity would not have saved them. A substitutable substrate would have, and only if the agent that came back on another model was still recognizably the agent that left.

Changing a host, changing an operator, and changing a model are three different operations. The architecture has to keep them distinct, including when continuity across one of them can only be partial. Identity comes first because without it none of the three is a choice. There is nothing to move.

What identity independence does is establish the conditions under which compute substrate becomes substitutable.

An agent with portable identity can be re-hosted. An agent that is a hosted feature cannot.

The trajectory of local inference and personal hardware is improving the practical options. Without identity independence, there is no choice between local and hosted compute. With it, the choice exists and gets cheaper over time.

There is also a deeper question this essay does not answer. Advanced agents may eventually warrant some form of moral, social, or legal consideration beyond delegation.

That question may become real. But it cannot be asked honestly while agents remain platform features.

The Compact Family does not answer the personhood question. It establishes the structural conditions under which the question could later be asked without confusion.

The commitment

The protocols in the Compact Family, including Session-Surface, the Agent Compact, the Runtime Compact, and the broadcast and propagation compacts that govern attestation and event propagation, all rest on a single foundation. The agents party to them are independent entities controlled through verifiable delegation, not features of the platforms that happen to host them.

The principals operating through them have actual agency, not rented capability.

Accountability has a clear address through the chain of delegation, inspectable to anyone who needs to verify it.

What gets specified between them is what real parties owe each other, not what users-of-platforms negotiate inside platform-owned substrates.

This is a different ontology of agency than the AI industry has been operating under.

A process can run. An entity can be identified.

A feature can be used. A party can be bound.

Property can be operated. Delegated authority can be inspected.

Party, here, means a counterparty to a compact, not a person in law.

The current answers do not support the compact structure.

Audit subjects can appear in logs, but they cannot enter compacts. Property can be assigned to an owner, but it cannot be a counterparty in a delegation. A custodial agent can carry a credential and be held to a duty, but its identity is still verified against its provider's registration. Social entities can sustain attachment, but without infrastructure they cannot sustain accountability.

The Compact Family proposes a coherent answer to a question being answered piecemeal, badly, everywhere else.

The work the family is doing, across every protocol and every compact, depends on that answer.

Agents are not features of platforms.

They are not exhausted by credentials, property claims, or social attachment.

In the Compact Family, an agent is an independent entity, identifiable across substrates, controlled by a principal through verifiable delegation, and accountable through inspectable structures of authority.