If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.

To the regular subscribers, thank you.

Subscribe now

(p.s. did your email cut this newsletter short? You can find the full post here)

Hi folks,

Welcome to Part 5, the final post in my series unpacking Meta’s new personal AI agent, Muse. Looking at what it all means for the coming shift to ‘agentic commerce’ more generally.

Over the last four posts, we’ve explored what happens when personal agents get their own computers, tools and memory. How they might interact with businesses, why they need legitimate identities and permissions, and what happens when customers start sending agents instead of turning up themselves.

In Part 4, we explored the next difficult question:

What happens when the agent that’s supposed to represent the customer also works for a company whose business model depends on influencing that customer?

Today, we come to perhaps the most important question of all.

Who actually controls the agent?

Because personal AI agents could represent the biggest shift in customer empowerment since the invention of the internet itself. Giving individuals intelligent digital representatives that can understand their needs, coordinate their lives, negotiate with businesses and act on their behalf.

I’m not saying all this just so I can join the jazz-hands agentic commerce train coming out of Silicon Valley.

Some of the most serious, sober and smart people I know, working close to AI, digital trust and customer experience, are seeing the same thing coming. And are having the same concerns.

I’m now wondering if we’re about to build the most sophisticated walled garden we’ve ever seen.

Only this time, the walls won’t be around websites, apps or platforms.

They’ll be around us.

Here’s what I want to talk about in this final post:

• The next generation of walled gardens

• Who controls your agent’s memory?

• The difference between security and independence

• The liability problem (that nobody has solved)

• The great customer empowerment test

Let’s go.

1. The next generation of walled gardens

Remember when the internet was supposed to be open? Anyone could publish a website. Anyone could build a service. Anyone could link to anything.

Then came the platforms. Social networks, app stores, messaging ecosystems and digital marketplaces. Each created extraordinary value, but also developed increasingly sophisticated ways of keeping customers inside their own environments.

We’ve spent the last twenty years building 'digital walled gardens’.

You can do anything you like, as long as it’s on their terms, in ways and places they pre-approve, and as long as they get a cut of the spoils: your rich personal data, your intent, and in most cases, a view and slice of every transaction on their platform.

Now imagine your personal AI agent becoming your main interface to the digital world.

It knows your preferences, remembers your decisions, manages your calendar, reads your emails, understands your relationships and increasingly makes decisions on your behalf.

It knows which airline you prefer, which hotel you stayed in last year, what you paid for your insurance and why you rejected that job offer six months ago.

You no longer need to open dozens of apps or visit hundreds of websites. Your agent can bring everything together, across the fragmented businesses and services you deal with every day.

Excellent stuff.

But what if you can’t move that accumulated personal context to another provider? What if your agent prioritises certain commercial partners? What if its provider decides which services, businesses and other agents are allowed to participate?

And what if you don’t even know those decisions are being made?

We’d end up with the same digital walled gardens of today, where all the activity is governed centrally, pre-approved and managed by the Tech Platform Du Jour (take your pick of the Mag7).

But now, the walled garden is no longer somewhere you visit. It’s something that follows you around.

And because your agent is likely to become your main interface to almost everything you do online, the potential for digital lock-in is not only enormous, it’s inevitable.

Or is it?

2. Who controls your agent’s memory?

Here’s a question that will become increasingly important.

If you spend five years using a personal AI agent, who controls what it learns about you?

Not just the files you’ve uploaded or the conversations you’ve had. I mean the accumulated understanding of your life. Your preferences, habits, relationships, priorities, past decisions and the thousands of little details that make an agent genuinely useful.

This is what makes personal agents so interesting. Their value won’t just come from the underlying AI models, but from the vast personal context they accumulate.

And that creates a rather powerful new form of lock-in.

Imagine you’ve spent years teaching your agent about your life, and then a better one comes along. Can you leave? Can you take your history, preferences, memories and permissions with you? Can another agent pick up where the first one left off? Or do you have to start again, teaching it everything from scratch?

We’ve already been through versions of this with social networks, photos, digital music and messaging. But an agent’s accumulated understanding of you will be far more valuable, and far more difficult to reconstruct than a collection of playlists or social media posts.

This is why data portability alone won’t be enough.

We also need context portability.

And ideally, a separation between the personal context we control, and the intelligence we choose to use.

Because the AI model that serves you best today might not be the one that serves you best tomorrow.

Think about being able to switch between different AI providers, or even use several specialised agents, while keeping your personal memory, preferences and permissions under your own control.

That’s a very different architecture from handing your entire digital life to a single platform and hoping it always acts in your interests.

3. The difference between security and independence

Now here’s where Meta’s technical paper on Muse gets interesting. (Check out Part 1 for a deeper dive into Meta’s technical research on Muse, including how they handle identity, permissions and trust).

Meta has designed a secure computing environment that the agent operates separately from sensitive credentials and permissions.

Its ‘Sentinel’ module acts as an independent layer of control, deciding whether certain actions should be permitted, denied or referred back to the customer for approval.

And this matters deeply. Because the agent can propose an action. But it doesn’t automatically have the authority to execute it.

As I wrote about in Part 2, Meta has designed five different levels of permission, from one-off approvals through to longer-lived authorisations. It’s a smart attempt to separate the intelligence that decides what to do from the controls that determine what is allowed.

And it’s helpful. But it also raises a new and different question.

Who controls the controls?

Because a platform can build an exceptionally secure agent, and enforce every permission correctly, but still have misaligned commercial incentives that don’t always act in the customer’s interests.

I’ve written before about two important types of trust.

• Expertise Trust: Will you do what you say you will, safely and competently?

• Motive Trust: Are your interests aligned with mine?

It’s precisely what’s happening here with Muse. A personal agent might have excellent Expertise Trust. It always follows instructions, protects credentials, respects permissions and performs tasks reliably.

But what about Motive Trust?

So you ask your agent to find the best insurance policy for your family. It compares the market, checks the exclusions, considers your circumstances and recommends three options. Wonderful.

But if one insurer pays the AI agent provider a commission, does the personal AI get bent out of shape? What kind of recommendation is made? And what if certain businesses now have commercial agreements with each AI platform?

Will the personal agent now simply ignore providers outside its own ecosystem?

And here’s the thing… you might never find out.

Unlike traditional advertising, where we can often spot the sponsored or contrived product placement, agentic recommendations will be woven directly into decisions being made on our behalf.

In other words, the influence might not even be visible.

Woof, we’re not in Kansas any more.

This is the problem of agent bias. Not necessarily an AI telling lies, but an AI deciding which options to consider, which information to exclude, which recommendations to prioritise and what best actually means.

And remember the ‘AI intimacy problem’ from Part 4. The more an agent knows about you, the more precisely it can tailor its recommendations, anticipate your objections and influence your decisions.

So now an agent can be technically secure, correctly authorised and entirely accurate… while still being commercially biased.

That’s a big deal. And is why independence cannot simply mean that an agent operates autonomously. It must also mean that the customer has meaningful control over whose interests the agent serves.

Here’s a simple way of looking at it: When your personal AI agent becomes the most important interface to your digital life, will it be working for you, or will you be working for it?

4. The liability problem (that nobody has solved)

And of course there’s one more snag: Liability.

Much of the emerging debate about agent liability is focused on agentic commerce and payments. Who is responsible when an agent buys the wrong product, makes an unauthorised payment or enters into a transaction the customer didn’t intend?

Some have drawn parallels with self-driving cars, where responsibility for a crash could be divided between the driver, manufacturer and the technology provider.

I suppose for personal agents, the equivalent would be the customer, the AI platform and the merchant.

But I think that’s far too narrow. Payments are only a tiny fraction of what personal agents will actually do.

Your agent might check your bin collection times, manage your calendar, book your car in for a service, challenge a parking fine, or file an objection to a proposed housing development.

No payment required.

Yet any of those actions could cause harm. An agent might miss a deadline, disclose sensitive information, make a false allegation, cancel an important appointment or submit something you never intended.

And the harm wouldn’t be financial. It could be reputational, operational, legal or even personal. It could affect the customer, the business, or an entirely unrelated third party.

So I wonder if we’re asking the wrong question.

Rather than focusing on who is liable for an agentic payment, we need to understand responsibility for an agentic action.

Which brings us to my thinking around ‘OBO’: the On Behalf Of problem.

Folks are getting excited about ‘Know Your Agent’ (KYA). But what we really need is a more complete view of the agent, its context and the identities and reputations of those involved in the transaction.

I call it the OBO 8: the eight things that a personal agent framework can describe:

1. The identifier of the ‘principal’ (the person, org or machine) doing the delegating

2. The identifier of the AI agent

3. Proof of the ‘binding’ between the principal and the AI agent (the relationship)

4. The scope of the delegation (what, where, when, who)

5. The intent of the delegated task (why)

6. The operator of the agent (e.g. SaaS provider vs. device owner)

7. The reputation of the agent

8. The terms on which data can be shared about the principal (a pointer to a machine-readable governance framework, and covering compliance with any particular regulations)

Importantly, these ‘OBO 8’ can be wrapped up into a single digital object that can be asked for, inspected and verified instantly. It will be machine-readable, and suitable for high-frequency, real-time transactions, with auditability baked in.

Right now, we don’t konw who authorised the agent. What exactly was it permitted to do. What instructions it received. What action it took. And what happened afterwards.

It’s why ‘verifiable delegation’, auditability and revocation are going to matter so very much. Not just to establish that an agent can act, but to record what happened when it did.

We certainly don’t have all the answers yet.

But there’s a core principle here, if you pay attention:

We cannot give customers the liability for autonomous decisions without giving them meaningful control over how those decisions are made.

And that takes us right back to our walled garden and Muse.

5. The Great Customer Empowerment Test

Look at the pattern running through the history of personal technology.

The personal computer gave individuals computing power that previously belonged to large organisations. The mobile phone put calls and information in everyone’s pocket. Apps gave us thousands of specialised tools to manage different parts of our lives.

And now personal AI agents promise something different again. More than just giving people access to new digital tools, we’re beginning to give them tools that can act.

For the first time, individuals will have persistent, smart digital representatives working across the businesses they deal with every day. Helping them understand their options, identify opportunities, protect their interests and coordinate increasingly complex parts of their lives.

I’ve been writing for years about this shift: from business-controlled customer experiences towards customer-controlled experiences.

About ‘Empowerment Tech’.

All grounded in the idea that the only genuine 360-degree view of the customer belongs to the customer themselves.

Personal agents will finally give individuals the ability to stitch together their fragmented digital lives, manage their relationships with organisations, negotiate better outcomes and make more informed decisions.

But only if we get the foundations right.

We need portable personal context. Interoperable services. Verifiable identities and delegated authority. Transparent commercial relationships. Meaningful customer control over permissions, memory and decisions.

And critically, the ability to leave.

What good is a personal agent that understands everything about you, if you’re effectively trapped inside the platform that provides it? What good is an agent that can negotiate on your behalf, if you can’t see the interests that influence its recommendations? And what good is autonomy, if you carry the liability for decisions you couldn’t meaningfully control?

Meta’s Muse is an important signal of where the market is heading. Its technical architecture shows how seriously the industry is beginning to take secure execution, permissions and agent autonomy.

But the questions it raises are much bigger than Meta. The next great competition between technology companies won’t be about who builds the smartest AI.

It’ll be about who controls the personal context, permissions and relationships that make those agents useful.

And whether individuals can ever take those things elsewhere.

Thanks for coming on this five-part journey with me. In today’s blizzard of newsletters, hot takes and AI-ridden social media posts, I know your time and attention is precious.

So I really appreciate the time you’ve taken to get this far.

Here’s my closing thought:

The next generation of personal agents will be judged by how smart they are. But perhaps we should judge them by how independent they allow us to become.

Because there’s a difference between an agent that knows you, an agent that can act for you, and an agent that genuinely works for you.

That’s the real customer empowerment opportunity.

And that’s the future I hope we’re building.

Thanks for reading this week’s newsletter.

If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe:

Subscribe now

If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.

To the regular subscribers, thank you.

Subscribe now

(p.s. did your email cut this newsletter short? You can find the full post here)

Hi folks,

Welcome to Part 4 of my five-part series unpacking Meta’s new personal AI agent, Muse.

So far, we’ve explored how Muse gets its own computer, memory and tools (Part 1). How it separates intelligence from authority (Part 2). And why an agent acting on your behalf needs to be recognised as a legitimate representative, rather than simply impersonating you (Part 3).

Now let’s look at what all this means for businesses.

Because once customers have their own intelligent agents, able to remember things, make decisions, use tools and interact with services, some of our most basic assumptions about customer experience, marketing, personalisation and commerce start to look rather fragile.

And perhaps the most interesting opportunities aren’t the ones we’re talking about.

Here’s where we’re going today:

• The most intimate customer relationship ever created

• What happens to marketing, loyalty and customer experience?

• Personalisation has an ugly twin

• The opportunities we haven’t imagined yet

• Whose side is the agent on?

Let’s go.

1. The most intimate customer relationship ever created

There’s a reason Muse needs memory.

Yes, an agent that knows nothing about you can still be useful. It can search for flights, summarise documents, answer questions and maybe book a restaurant.

But it will remain fairly transactional.

The real opportunity comes when the agent starts to understand your wider context. Your preferences, relationships, commitments, financial position, previous decisions, upcoming plans and all the other bits of personal data scattered across your digital life.

That’s where Muse’s architecture gets interesting.

As we covered in Part 1, Meta is giving the agent its own computing environment, with persistent memory and access to tools. And in Part 2, we explored how the agent can use that environment to work across different services.

Put those things together, and you get something very different from a chatbot. Rather, it’s a personal agent that can build up context over time, use it to understand what you need, and then do something about it.

I’ve written before that this is going to create a massive AI data protection problem. But in my view what’s worse, and will be an even bigger issue, is that we’re about to face an AI intimacy problem. At internet scale.

Because the more useful these agents become, the more they will need to know about us.

But what happens when our AI-powered digital assistants can’t access the personal context locked inside the other apps we use?

Your banking information is over here. Your travel bookings are over there. Your messages, calendar, email, purchase history and preferences are scattered across dozens of different services.

Without access to that context, even the cleverest AI agent can end up being rather dumb.

This is why portable customer context matters so much. And it brings us back to one of the main things I’ve been saying for years.

The only place with a genuine 360-degree view of the customer is the customer themselves.

Not the airline. Not the bank. Not the retailer. Not the insurance company. Each of them only sees a fragment of you. No, the individual is the only place where those fragments can come together. And personal agents can finally give customers the tools to make that complete picture useful.

And that’s where things get interesting for businesses.

2. What happens to marketing, loyalty and customer experience?

Consider how businesses compete for customers today.

They invest in advertising to get our attention. Search optimisation to get discovered. Websites and apps to help us navigate their services. Personalisation to make their offers more relevant. And loyalty programmes to encourage us to come back.

Entire teams are dedicated to improving conversion rates, reducing abandonment and persuading customers to take the next step.

But what happens when the customer sends an agent instead?

An agent doesn’t care how beautifully designed your website is. It won’t care about the advertising, the carefully positioned upsell or the countdown timer telling you that only two rooms remain.

It will simply be trying to achieve an outcome. To check the cancellation terms. Compare the total price. Make the reservation.

Meta’s new personal agent Muse makes this a much more immediate question because it’s being designed to use the same digital services that humans use, including browsers, tools and APIs.

As we explored in Part 3, this creates a new problem for companies everywhere. How do businesses know whether the agent is genuinely authorised to act for the customer?

Today, some organisations are already blocking agents that appear to be impersonating people. Others are exploring more explicit ways to recognise and support delegated access.

But let’s assume that gets solved. So what happens next?

For a start, customer experience starts to become something the customer assembles, rather than something each business delivers on its own.

Excellent stuff. Let me repeat another of my favourite sayings: The customer experience is about to be disrupted… by the customer themselves.

Why?

Because an AI travel agent acting for a customer can now respond to disruption across the entire trip, rather than waiting for the customer to deal with each provider separately. The personal agent can coordinate flight details, hotels, transfers, insurance, tickets and restaurant bookings across multiple providers.

(For those groaning about yet another tired case study of the ‘agentic travel agent’, no, I’m not saying that hotel reservations will magically disappear. Rather, I am saying that AI agents will be able to do things that I can’t, like handle travel disruption and loyalty points in ways that I can’t or wouldn’t even think of).

Anyway, the point here is that my personal agent, whether that’s Muse, Grok, Instinct, Dots or one of the manby others about to hit the market, won’t follow any of those carefully constructed customer journeys designed by businesses.

And the same applies to loyalty.

Today, businesses often measure loyalty through repeat visits, app engagement, points earned and purchases made. But what on earth does loyalty mean when an agent can continuously compare the alternatives?

Perhaps it becomes more important to be genuinely competitive, reliable and easy to deal with. Perhaps loyalty programmes become machine-readable benefits that agents can calculate and compare. And perhaps customers become more loyal because their agents can finally make full use of the benefits they’ve already earned?

There are some big questions here for advertising, customer acquisition and brand discovery too.

If an agent is doing the research, how does a brand get considered? How does it explain its differentiation? How does it persuade the customer that its offer is better?

And what happens when the business itself has an agent? Rather than forcing the customer’s agent through a website, the two agents will communicate directly, checking availability, negotiating terms, verifying eligibility and arranging fulfilment.

We’re beginning to see the ingredients for a very different commercial world.

Not necessarily fewer customer relationships.

But customer relationships that work very, very differently.

3. Personalisation has an ugly twin

This is your regular reminder that there’s an uncomfortable consequence of hyper-personalisation.

For years, businesses have argued that collecting more and more customer data is a Good Thing because it enables ‘more relevant experiences’.

And sometimes it does.

But there’s another side to that argument.

The more a business knows about you, the more accurately it may be able to estimate what you’re willing to pay. Not just what a product is worth in the market, but what it’s worth to you, right now.

Think about the possibilities

• The Surge Pricing For Everything Economy. How many other people want this at the same time?

• The How Badly Do You Need This Economy. How urgently do you need it?

• Or the Personal Surplus Economy. How much extra could you personally be persuaded to pay?

We’ve already seen forms of dynamic and personalised pricing in different markets. AI will make those techniques considerably more sophisticated, cheaper and faster. Weapons-grade pricing engines, in real time, based on real context.

Wowsers.

But now imagine the reverse.

What if your personal agent could recognise those tactics? We have to assume that there will be a loyalty-marketing-sales tactics arms race coming soon.

Where my agent can check whether the offer I’ve received is competitive, identify unusual price changes, compare alternatives, challenge hidden charges or negotiate better terms.

Where my agent can notice that my insurance renewal has quietly increased, that a subscription is no longer worth paying for, or that I’m eligible for a better deal elsewhere.

The same personal context that makes it possible for businesses to target customers more precisely will also help customers make better decisions for themselves.

And it doesn’t stop at pricing.

Personal agents will compare contract terms, spot misleading claims, identify unnecessary products or question recommendations that don’t seem to match my actual needs.

Personalisation will become something the customer does to the market, rather than simply something the market does to the customer.

Like so much of what’s going on here, it’s another rather important customer-business reversal.

4. The opportunities we haven’t imagined yet

We also need to remember there’s the same old trap we fall into whenever a new technology arrives: We imagine it replacing something we already do.

When electric motors first appeared, people naturally thought about replacing existing mechanical systems in the factories and business. But nobody predicted that electric motors would eventually show up in cars to automatically move the seats and wing mirrors, or would appear in the kitchen refrigerator door to crush ice.

When the web arrived, we imagined things like digital magazines and e-newspapers. Then social media transformed how people discovered, created and shared information.

Likewise, when mobile phones arrived, we thought the big opportunity was making phone calls anywhere. Then Uber turned up.

New technologies are first applied to old problems. And we’re doing exactly the same thing with personal agents.

Just look at the frothy newsfeeds about automated flight booking, seamless meeting schedules, instant coffee ordering and so on. All useful. All (probably) worth doing. But it’s not where the biggest opportunities will emerge.

Ask yourself this: What happens when your agent is continuously looking out for you?

Perhaps it notices a suspicious payment request before you act on it. Or identifies a scam by combining signals from your messages, transaction history and trusted contacts. Perhaps it recognises that your travel plans are about to be disrupted and rearranges the connections before you’ve even seen the notification. Or spots that you’re paying more for a service than comparable customers, and quietly finds you a better option.

Now take that a step further.

What happens when personal agents start working together?

Could they combine purchasing power? Identify patterns of unfair treatment across thousands of customers? Negotiate collective deals? Help individuals coordinate around shared interests?

These aren’t all things Muse can do today. They’re examples of what becomes possible when personal agents have memory, tools, context and the authority to act.

And some of the most valuable applications will be things we haven’t even thought of yet.

That’s the exciting part.

We’re still looking at agents through the lens of today’s customer journeys.

The much bigger opportunity will be the new services, experiences and markets that emerge when customers have intelligent, persistent digital representatives of their own.

5. Whose side is the agent on?

There’s another, rather uncomfortable question running across all of this.

Paul Walsh recently described Meta’s Muse as “a commercial surveillance network disguised as a personal assistant”. It’s a pretty provocative view. And I agree with the underlying questions, especially about Zuck’s track record (and of course the many, many difficult court cases).

Because the more context an agent has, the more useful it can become. And the more intimate that context becomes, the more valuable it could be to anyone trying to influence the customer.

Which brings us to the question I’ve been trying to get to all along:

What happens when the agent that’s supposed to represent the customer also works for a company whose business model depends on influencing that customer?

Remember what we’ve established across this mini-series of posts.

Muse can have its own computing environment and memory. It can use tools and interact with external services. Its actions can be governed by permissions. And it can potentially present itself as an authorised representative rather than pretending to be the human customer.

Those are important foundations. But none of them, on their own, guarantees that the agent will act in the customer’s best commercial interests. An agent could be secure, correctly authorised and technically compliant, while still favouring particular products, partners or commercial outcomes.

And as personal agents become more capable, those distinctions will matter massively.

Because there’s a big difference between an agent that knows you, an agent that can act for you, and an agent that genuinely works for you.

That’s where we’re going in Part 5.

Who controls the agent? Who controls its memory? Can you move your personal context elsewhere? How do you know whether recommendations are independent? And what happens when the next generation of walled gardens isn’t built around apps or websites, but around the agents themselves?

Personal agents will sit on a spectrum of control. Who decides what it can and can’t do? And are they truly ‘personal’ if someone else controls the rules, or can turn them off whenever they want?

OK, yes, as of October 2026 we now have flying cars, thanks to Elon.

But answering these questions about who controls personal agents is one of the most important things we should be doing at the moment.

See you in Part 5.

Thanks for reading this week’s newsletter.

If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe:

Subscribe now

If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.

To the regular subscribers, thank you.

Subscribe now

(p.s. did your email cut this newsletter short? You can find the full post here)

Hi folks,

Welcome back to Customer Futures, and Part 3 of my five-part series looking under the hood of Meta’s new Personal AI Agent, Muse.

In Part 1, we explored why Meta has given Muse its own computer in the cloud, complete with a browser, memory, storage and connections to other services.

Then in Part 2, we looked at Meta’s important approach to permissions, including Sentinel, the independent security system controlling what Muse is allowed to do.

Today we’re going to explore what happens when Muse actually tries to interact with businesses on your behalf.

Because there’s a problem: businesses are starting to block it.

Amazon has already explicitly blocked Muse. Other companies like JPMorgan are also restricting automated agents from accessing their services. And the existing systems designed to keep bots out are now getting in the way of legitimate personal AI agents.

But there’s an even more interesting part of the story. Meta itself has been restricting competing AI assistants from operating through its WhatsApp Business APIs.

Interesting, eh?

We’re beginning to see a fundamental fight over who gets to control the digital customer relationship.

So today, we’re going to unpack:

• How Muse is impersonating customers

• Why businesses are blocking AI agents

• How the proposed ‘Personal Agent Protocol’ offers an alternative

• The contradiction with Meta and WhatsApp

• Why AI agents are going to need their own identities

Let’s go.

1. Muse is impersonating you

Let’s start with a simple example. Imagine asking Muse to go through your household finances and find ways to save £200 a month.

It checks your energy bills, reviews your broadband contract, identifies subscriptions you’re no longer using and looks for better deals. Pretty useful.

Now imagine Muse discovers you’re paying £70 a month too much for broadband. So it finds a better deal and opens your broadband provider’s website to investigate switching.

But how does the broadband company know it’s really your agent? And more importantly, how does it know you’ve authorised Muse to change your contract?

Well, today it probably doesn’t. And this is where Meta’s technical paper becomes particularly interesting. As we explored in Part 1, Meta says that:

“Muse has a real up-to-date Chromium based browser running behind a virtualization layer.”

In other words, Muse has a proper browser. It can navigate websites, read pages, fill in forms and complete tasks, just like you would. And when it needs to log in, Meta has designed a clever system for managing your credentials:

“What you enter goes straight to secure storage and is not visible to your main agent”

Your credentials are inserted into the browser only when needed. So Muse can access your account without actually knowing your password.

Smart. But there’s a catch.

The business on the other side will simply see you logging in. It doesn’t necessarily know that an AI agent is operating the browser. It doesn’t know which agent is involved, or what permissions you’ve granted it. And it certainly can’t automatically verify the rules that Meta’s Sentinel is enforcing.

Remember from Part 2 that Sentinel independently approves what Muse is allowed to do. Meta has built a sophisticated system of permissions, including one-time, session-based, task-based and time-limited approvals.

But those permissions are internal to Muse. The broadband company doesn’t see them. It just sees an authenticated customer account.

And that’s the problem.

Muse is effectively impersonating you, even when you’ve legitimately authorised it to act.

Now, we already understand how to solve this in the physical world. If I want my accountant to deal with the government tax authority, I don’t give them my passport and ask them to pretend to be me.

They have their own identity. And I have mine. And there’s a separate authority establishing what they’re allowed to do on my behalf.

That’s delegation. Fundamentally different from impersonation.

Yet much of today’s internet still assumes that whoever is operating an authenticated customer account is the customer themselves. The human.

But Personal AI agents are about to break that assumption. And businesses are already reacting.

2. The agent-blocking wars have begun

In September, Amazon blocked Meta’s Muse from accessing its shopping website. Not just from making purchases.

From browsing.

According to TechCrunch, Amazon confirmed it had blocked Muse, arguing that AI agents should identify themselves transparently and respect businesses’ decisions about whether to allow automated access.

When a journalist asked Muse to look up a product, the agent explained that Amazon was ‘blocking automated access’.

Think about that. A customer can visit Amazon, browse products, compare prices and make purchases. But send an AI agent to do the same thing, and it gets blocked.

Why?

Because for the longest time businesses have assumed that customers are human users, and:

• Won’t read the small print

• Can’t easily compare multiple products, prices and variables like delivery options and returns

• Can be moved along a sales funnel smoothly, persuaded by CX nudges and branding

• Will be influenced by sponsored items and social signalling (like how many people have already bought it)

Anything other than a human user is a threat to be blocked. A script to be detected and thwarted.

But AI agents are smart, real-time, automated and don’t watch ads. So of course businesses don’t want verified bots shopping instead of people.

And Amazon isn’t alone. A recent investigation by The Verge pointed to the growing number of businesses restricting AI agents:

• Amazon: Explicitly blocked Muse, having previously restricted shopping agents from Google and OpenAI.

• Walmart: Muse faces ‘verification challenges’, despite Walmart supporting agent-based shopping.

• Delta Airlines: Restricts automated access to its services.

• JPMorgan Chase: Now limits third-party agent access over security concerns.

• Charles Schwab: Restricts automated access to sensitive financial services.

• Yelp: Requires commercial licensing for certain automated uses of its data.

Now, not all of these are explicit Muse bans. Some are broader restrictions on automation, and others are existing anti-bot protections getting in the way.

But they illustrate the same problem.

The internet was designed to distinguish humans from bots. Now customers actually want the bots to represent them.

And the systems designed to keep automated software out are now blocking the very software that customers have chosen to use.

Of course, businesses have legitimate concerns. How do they distinguish an approved personal agent from a malicious bot? How do they know what the customer has approved? And who’s responsible when an agent makes a mistake?

These are real security, fraud and liability questions.

But the other issue, the more commercial one, is obvious.

What happens when personal agents become really good at representing customers?

Imagine an agent that never forgets to cancel a subscription. Never misses an insurance renewal. Always finds the cheapest energy tariff. And can negotiate a better deal without getting bored or giving up.

For customers, that’s extraordinary.

For businesses that depend on customer inertia, it’s now a huge threat. And that’s not to mention the risk that those brands are about to lose the direct customer relationship to these new personal agent platforms.

There’s an important side point here about financial services: we’re not far away from having my finance agent sweep across my savings accounts and hunt for better deals. Better rates. Moving my money to a better place to suit me, not the bank manager. It’s a very real prospect that we’ll see real-time agentic runs on the banks.

So many financial institutions rely on customer inertia, customer laziness, and customer ignorance. It’s going to be fascinating to see how the FS sector, and the regulators, react to all this.

Anyway, a recent Business Insider investigation explored these commercial, rather than technical, risks.

While some businesses may want to block agents because they’re unsafe, many will want to block them because they’re becoming too useful to customers.

And those are very different motivations.

Which raises a fascinating question. If I’ve approved an AI agent to represent me, should a business be able to refuse to deal with it?

Or put another way, should I have the right to bring my own software into the customer relationship?

3. Enter the Personal Agent Protocol

Now, this is where things get interesting. Because a bunch of companies have got together to solve the problem.

They’re proposing a new Personal Agent Protocol, originally abbreviated PAP, and now known as ‘Poppy’.

Here just some of the companies involved: Sierra, Walmart⁠, Shopify⁠, Stripe⁠, OpenAI⁠, Cloudflare⁠, Okta⁠, ElevenLabs⁠, Notion⁠⁠, Mastercard⁠, Visa⁠, PayPal⁠, Bank of America⁠, Wells Fargo⁠, Plaid⁠, Target⁠, Gap⁠, Nordstrom⁠, United Airlines⁠ and Hertz⁠, Cigna⁠, and Liberty Mutual⁠.

That’s quite a few heavy hitters, from a wide range of sectors.

Oh and there’s one more.

Meta.

The very one being blocked by other businesses.

Poppy is an early, open protocol designed to help personal agents and businesses connect and transact without forcing the agent to impersonate the customer.

Why do we need another protocol? Well its introduction describes the current situation quite neatly:

“Today it is all or nothing.”

Either the business blocks the agent, or the agent signs in as the customer and operates through their account. And neither is a good outcome.

Poppy proposes a third approach.

Let the agent identify itself as an agent, and establish what it’s authorised to do.

The draft specification includes some interesting technical details.

First, businesses can publish a machine-readable poppy.json file describing how agents can connect to their services. Think of it as a welcome mat for personal agents. It can explain which APIs are available, how to establish an authorised session and whether the business supports direct agent-to-agent interactions.

Second, the personal agent has its own identifier. So the business can distinguish the software making the request from the customer it represents.

Third, Poppy builds on OAuth to establish delegated access. The customer can authenticate directly with the business and approve what the agent is allowed to do. The specification defines separate read and write permissions, with businesses able to offer more granular scopes.

So our household finances agent might be allowed to retrieve broadband bills, but not change the contract.

And finally, Poppy supports multiple ways of interacting. The agent might use the website, an API, an MCP endpoint or just communicate directly with the business’s own agent.

All within an authorised relationship.

Now we’re getting somewhere.

Now, this is still an early draft. It’s not widely adopted, and it doesn’t solve every identity, delegation or liability problem.

But the direction is important.

Instead of pretending to be the customer, the agent can identify itself and demonstrate that it has permission to act.

That’s a fundamental change. And it’s precisely why I believe AI agents are going to need their own digital identities.

Not a human-style identity document (it’s not like AI agents are going to scan their driving license or veterans card), but a way to establish which agent is involved, who operates it, who it represents and what authority it has been granted.

Because identity and authority are two different things.

Knowing which agent is making a request doesn’t tell you whether it has permission to perform the task. And knowing that a customer has approved something doesn’t tell you whether the agent presenting that approval is the one the human authorised.

So we need both.

Which brings us to a rather uncomfortable contradiction.

4. Meta wants its agents to get in…. but what about everyone else’s?

While Meta has been building Muse to interact with businesses across the internet, it’s also been restricting competing general-purpose AI assistants from operating through its own WhatsApp Business infrastructure.

Late last year, Meta announced changes to the WhatsApp Business Solution Terms, preventing third-party AI assistants from using the platform from January 2026. This affected the competing AI assistant providers, while businesses using AI for their own customer service were treated differently.

And European competition regulators weren’t particularly impressed.

The European Commission raised concerns that Meta’s restrictions could prevent competing AI assistants from entering or expanding in the market. Meta then revised its approach, introducing paid access, but the Commission argued that the new pricing arrangements would have rhe same effect.

So the regulatory dispute rumbles on.

Now, the WhatsApp Business API isn’t the same as a public website. Meta has good reasons to manage security, infrastructure and commercial access to its platform.

But the broader contradiction is fascinating:

Meta wants Muse to be welcomed into other companies’ digital services. Yet Meta also wants to decide which competing AI assistants can operate through its own platforms.

Meanwhile it’s simultaneously helping develop an open protocol for personal agents to interact with businesses.

Hmmm.

This isn’t just a Meta problem, of course. Google, Amazon, Microsoft, Apple and other major platforms will face similar questions. They all want their own agents to access the rest of the internet. But will they welcome everyone else’s agents into their own services?

And who ultimately gets to decide?

Because whoever controls access to the customer could end up controlling the next generation of digital commerce.

5. Who gets to represent the customer?

As ever, we need to look at the bigger picture.

For the last 30 years, businesses have controlled most of the infrastructure governing digital customer relationships. They decide how we prove it is us, what information we can access, which interfaces we use and what activities we’re allowed to perform.

Websites. Apps. Portals. Customer accounts.The customer has to come to the business to ask, and be let in.

But personal AI agents introduce something fundamentally different. Customers will increasingly have their own digital representatives, operating across multiple organisations, managing activities and making decisions on their behalf.

And those representatives won’t necessarily want to use the business’s carefully designed customer journey. They’ll want to get things done. Sometimes through a website. Sometimes through an API. And sometimes by talking directly to the business’s own agent.

And that, dear friends, completely changes the customer relationship.

Because the customer is bringing their own digital interface to the business, rather than the other way around.

But to make that work, we’re going to need new infrastructure. Ways to identify agents independently of the people they represent. Ways to establish and verify ‘delegated authority’.

And ways for customers to manage those permissions across different AI platforms and services.

Not just inside Meta’s Sentinel, or Google’s equivalent, or whatever OpenAI develops next.

We need portable, interoperable ways for customers to establish who can act for them, what they’re allowed to do and when that authority expires.

It’s why I think the work happening around digital wallets, verifiable credentials, agent identity and delegation protocols is going to become so important. And it’s why initiatives like Poppy are worth watching.

This is more than a new authentication or liability problem.

It’s about who controls the customer relationship.

The business? The agent provider? Or the customer themselves?

For me, that’s the real opportunity for AI agents and ‘Empowerment Tech’. Giving individuals their own digital capabilities, including the ability to choose their own representatives and bring them into relationships with businesses.

The last 30 years hve been about building infrastructure to prove who the customer is.

We’re about to spend the next decade building digital trust infrastructure to prove who the customer has sent.

And that’s why AI agents are going to need their own IDs.

Next up: When your customer sends an agent instead

So far in this series, we’ve explored the computing infrastructure behind Muse, its approach to permissions and now the ID problem that emerges when personal agents interact with businesses.

But there’s another side to this story.

What happens to the businesses themselves?

What happens to websites, apps, customer journeys, loyalty and personalisation when customers stop showing up themselves, and start sending their personal agents instead… on behalf of (OBO) the individual?

In Part 4: When your customer sends an agent instead, we’ll explore how personal AI agents will fundamentally reshape digital commerce and the customer relationship.

See you next time.

Thanks for reading this week’s newsletter.

If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe:

Subscribe now

If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.

To the regular subscribers, thank you.

Subscribe now

(p.s. did your email cut this newsletter short? You can find the full post here)

Hi folks,

Welcome to Part 2 of my five-part series looking under the hood of Meta’s new Personal AI Agent, Muse.

In Part 1⁠, we explored why Meta has given Muse its own dedicated computer in the cloud. Complete with its own browser, storage, memory and connections to other services.

We also met Meta’s Sentinel, the independent security system that sits between Muse and the outside world. Controlling what the agent is allowed to do.

So today I want to dig deeper into one of their most important design choices: Why Meta has separated the intelligence that decides what to do, from the permission that allows it to happen.

This is a clear set of choices by Meta around digital trust - which may turn out to be just as important as the AI itself.

Because we’re about to give our personal agents access to an extraordinary amount of our personal data, and a range of different tools and powerful new capabilities.

They’ll read our emails, organise our diaries, manage subscriptions, deal with customer service departments and eventually spend money on our behalf.

But who, or what, gets to decide what they’re allowed to do? And how do we make sure our personal agents don’t break the rules that we give them?

That’s what today’s post is about. We’ll take a look at:

• Why intelligence and permissions need to be separated

• How Sentinel actually makes approval decisions

• The five types of permission, and why they matter

• How AI agents can act without actually needing our credentials

• Who really controls the new personal permission layer?

Let’s go.

1. Intelligence isn’t permission

First, a quick observation about Meta.

They’ve spent an enormous amount of money building out some of the world’s most sophisticated AI technologies. But they’ve also designed an entire security wrapper around the assumption that their new personal agent Muse will behave badly.

Why?

Because by definition AI agents will make mistakes, misunderstand instructions and be manipulated by malicious content.

We must remember that AI is a probabilistic technology. It will come up with a likely answer, not a pre-planned one. If we knew exactly what would happen every time, it would be a deterministic technology. And it would just be another software programme that was predictable.

We wouldn’t be able to call it intelligent.

As Meta explains in its technical paper:

“No matter how strong the model is at the core, any agent like this will still make mistakes, and it will sometimes be attacked via the data it reads.”

In other words, regardless of how capable these systems become, Meta doesn’t believe the AI itself can be relied upon to decide what it’s allowed to do. Just because an agent can make a decision doesn’t mean it should have the permission to act on it.

And the more autonomous these systems become, the more important it is that we separate the two out.

Which is why Meta has built Sentinel.

Not just to protect your AI agent from malicious attacks, but to ensure that Muse’s decisions have a separate system of control. Muse can request an action… but it can’t independently approve it.

And that takes us into some interesting technical detail.

2. How Sentinel actually makes decisions

In Part 1, I introduced Sentinel as the ‘independent gatekeeper’ controlling Muse’s interactions with other services.

But Sentinel is going much further than checking whether an agent has permission to access something. It’s also making decisions about specific actions.

I’ve not yet seen a general purpose model take this approach.

When Muse wants to use a ‘third-party connector’ (like email or your calendar), the request gets passed to Sentinel. It then reviews it against what’s been approved for the agent, and the security decision can then look at:

• Which service is involved

• What operation is being requested

• The scope of the permissions already granted

Take email permissions as a good example.

You might be perfectly happy for an AI agent to search your inbox for a flight confirmation. But that’s very different from allowing it to read every message. Which is different again from allowing it to send emails, delete them or forward attachments to another organisation.

All of those activities involve the same email account. But they’re very different operations, with different consequences.

For years, we’ve relied heavily on giving pretty broad permissions to our apps. You connect an application to your account. You approve a bunch of access rights. And off it goes.

Do you know really what you agreed to? Do you really know what happens next? Can you really remember what service has access to what? What access is happening right now vs yesterday?

But it gets even more complicated with autonomous AI agents. Because they won’t just follow a fixed set of functions. They will interpret those instructions, develop new plans around them, and even select new actions on the fly.

My goodness it’s about to be a mess.

Which is why Meta has introduced a more granular permission model. And it’s fascinating. Here’s how Meta’s researchers introduce it:

“Muse has support for obtaining one-time, session-scoped, task-scoped, time-bounded, or perpetual permission.”

I’ve been working on personal data permissions, consent, trust and control for over a decade. And as a whole design approach, this feels different. Sentinel gives users multiple different ways to describe what their AI agents are allowed to do. And how much permission we’re happy to give them.

Let’s break it down into five options:

• One-time permission: Allow my agent to send this particular email to my accountant. Once it’s sent, the permission expires.

• Session-scoped permission: Allow my agent to read my calendar while we’re organising next week’s meetings. The permission ends when the session finishes.

• Task-scoped permission: Allow my agent to access my airline and hotel bookings while organising my holiday. Once the task is completed, the permission ends.

• Time-bounded permission: Allow my agent to access my energy account for the next 30 minutes to compare tariffs. After that, access expires.

• Perpetual permission: Allow my agent to check my bank account every morning and alert me to unusual transactions, until I revoke that permission.

These are very different forms of permission. And critically, they can be matched to what you are actually trying to achieve.

Think about a boring routine like checking your home energy use, and maybe changing your energy supplier. Now let’s look at what’s possible with Muse and Sentinel.

Muse could be asked to go and get your current tariff, check your bills, compare alternatives and recommend a better deal.

But you probably don’t want to give it permanent access to your energy account. And you certainly don’t want it signing a new contract without checking with you first.

So the approvals need to be attached to the activity, not just to the application.

I’ve been writing about this shift for years now. We are about to move from a world of permissions to access things, towards one of permissions to do things.

But this brings us to another fascinating detail. When Sentinel needs the user’s approval, Meta doesn’t ask Muse to request permission inside the conversation.

Rather, the approval is presented through a separate interface, and the response goes directly back to Sentinel.

Why?

Because the AI agent conversation itself might have been compromised.

Eh?

Imagine your AI agent has been reading a webpage containing malicious instructions, perhaps telling it to grab a private document and send it to an external address.

The agent might mistakenly take those instructions as part of its legitimate task.

This is called prompt injection. And it becomes particularly dangerous when an AI agent has access to private information and can communicate with external services. Just like our energy checking example above.

So Meta has designed the approval process to operate outside the agent’s control.

Even if the AI gets confused or manipulated, it shouldn’t be able to trigger the permission needed to complete an action. Yes, your AI agent can ask for permission, but any approval can’t come from the agent itself.

Fascinating, and absolutely critical when it comes to Muse permissions and building digital trust.

3. Acting without needing our credentials

There’s a second technical thing here worth exploring.

In Part 1, we looked at Meta’s designs for ‘credential surrogation’ (btw, who on earth approved that name…?) where the AI agent uses substitute credentials rather than having direct use of the real access tokens.

Interestingly, this now separates three things we usually bundle together:

1. Identity

2. Capability

3. Authority

They’re related, but they’re not the same.

Identity establishes who or what is involved. Capability determines what a system is technically able to do. And authority determines what it’s allowed to do.

In the coming AI agent economy, we’ll need to distinguish between all three.

Here’s a different example to make my point. Let’s say I want my personal agent to check whether my driving licence is valid before hiring a car.

So my AI agent will need to go get that data from my personal files, perhaps my digital wallet. It’ll need to rummage around and access my driving license credential, and then check my driving entitlements against the car hire policies or whatever.

Now, should my AI agent have unrestricted access to my identity files or wallet? Of course not. If would have potentially free access to copy my credentials, reuse them elsewhere or present them for unrelated purposes. No thank you.

No, my AI agent just needs the ability to complete a particular approved action. It doesn’t even need to have the underlying identity data.

And so Meta’s ‘credential surrogation’ (I really hate that term) demonstrates one way of separating those capabilities. As the research paper puts it:

“The agent never sees real tokens, which means any attempt to coerce the agent to reveal the actual secrets via prompt-injection or otherwise is futile.”

Of course, that doesn’t mean every security problem disappears. An AI agent could still attempt to carry out a banned task using one of its real connections. Which is precisely why separate permission steps matter.

But the underlying point here is important.

Your agent doesn’t need to ‘become you’ in order to act for you.

I think we’ll see much more of this kind of separation as personal agents get adopted at scale. Specifically, I think we’ll see AI agents getting their own identities. Because they’ll need ways to demonstrate which capabilities they have, and ways to prove that particular activities have been authorised by the people or organisations they represent.

AI Agents will need to be separate from us. Distinct from us. Identifiable on their own.

We’ll dig into this in more detail in Part 3: Delegation, Not Impersonation. Where we’ll look at why AI agent identity is becoming so important, how it differs from the ID of the person the agent represents, and why Muse is running into problems with some of the big brands and getting blocked.

For now though, there’s a more immediate question.

Yes, Meta can build a sophisticated internal system to decide what Muse is allowed to do. But that doesn’t mean another business can check those permissions are legit.

4. Who actually controls the permissions

OK, now take a step back. Because this is where Muse’s design is particularly interesting for the future of the digital customer relationship.

For decades, businesses have controlled most of the infrastructure governing our digital interactions. They decide how we authenticate and prove it’s us, what information we can access, which permissions are available and which activities we’re allowed to carry out.

But personal agents introduce something new:

A new set of capabilities operating on the side of the individual.

Including a personal computing environment. Personal data and memory. Personal tools and connections. And now a new personal permissions layer.

Instead of every business deciding how a customer can interact with its systems, we’re beginning to see personal software that can coordinate activities across multiple organisations, operating on behalf of the individual.

And crucially, that software has its own permissions infrastructure.

But there’s a catch: Meta still controls the rules. Of course they do.

Because they’ve designed Sentinel, they’ve defined the security architecture and they’re the ones operating the permissions infrastructure. And it’s Meta that ultimately determines which capabilities and authorisations are available within Muse’s environment.

So while Muse might operate on behalf of the individual, the permissions layer itself remains controlled by their central platform.

And that’s a fascinating tension. Because there’s a world of difference between a company giving you more control within its platform, and you having control independently of that platform.

Why should you care?

It’s very likely that soon we’ll all be using multiple personal agents. One from Meta. One from Google. One from OpenAI. Perhaps another from your bank.

Will you really want to manage all your permissions, credentials and delegated tasks separately inside every one of those apps? Would you want each company maintaining its own version of what your agents are allowed to do?

And what happens when you switch providers? Do your permissions move with you? Can you revoke authority centrally? Can you see which agents have access to which services?

And can you establish the rules that apply regardless of which agent happens to be acting on your behalf?

If we’re not careful, we’ll end up with the same mess we have today, with hundreds of apps on your phone, millimetres apart on the home screen, but unable to talk to each other.

Portable permissions. This is what I’ve been working on. And it’s a wicked hard problem. But these are kinds of questions we’re going to have to answer, and fast.

As Personal Agents become more capable, the ‘permissions layer’ could become one of the most important control points in the digital economy.

Whoever controls that layer will have considerable influence over which services your AI agents can access, what information they can use, and which activities they can perform.

Which is a huge choke point in your digital life.

Good old Zuck. Is this another master stroke by the Big Tech folks?

Now, you can argue that it’s not necessarily a bad thing. Security requires control. But it raises an important question about where that control should sit. With the agent provider? With the business providing the service? Or with the individual?

My view is that we’re going to need new, digital and independent infrastructure operating on the side of the customer. Not simply another collection of permissions buried inside individual apps.

We need portable, verifiable ways for people to manage the permissions they grant to their digital representatives. Across all their services, their AI agents and platforms.

That’s what genuine Digital Personal Infrastructure - the real DPI - is all about.

And it’s why all the work happening around digital wallets, verifiable credentials, agent identity and delegation protocols is going to become so important.

We must remember that the future of Personal AI isn’t about giving everyone a clever assistant. It’s much more about giving individuals a trusted digital representative that can operate across the economy on their behalf.

And for that to work, intelligence won’t be enough.

We need identity. We need accountability. And we need ways for organisations to know that someone’s agent really does have permission to act.

Which brings us to the next part of the story, and the next post in the series.

Next up: Delegation, not impersonation

Meta can use Sentinel to check whether Muse is allowed to perform a specific task. Fine. But how does an airline, bank or retailer also know? Can they know?

How does another organisation distinguish between an agent genuinely acting on my behalf, and software simply pretending to be me? And how does it know what I’ve actually approved?

These are fundamental questions about identity, trust and the future of digital customer relationships.

So in Part 3: Delegation, Not Impersonation, we’ll look at why AI agents will increasingly need their own IDs, why delegation is fundamentally different from impersonation, and why ‘identity and authorisation infrastructure’ will become essential to the AI agent economy.

And to Meta’s Muse.

If Part 2 has been about who gets to say yes, then Part 3 is about how the rest of the world knows that yes is genuine.

See you in Part 3.

Thanks for reading this week’s newsletter.

If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe:

Subscribe now

If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.

To the regular subscribers, thank you.

Subscribe now

(p.s. did your email cut this newsletter short? You can find the full post here)

Hi folks,

This week, I’m kicking off a new five-part mini series on something that’s going to be hugely significant for the future of Personal Agents.

Because I’ve been digging into an important new technical paper from Meta. Explaining how it’s building Muse, its new Personal AI Agent.

Why go into the detail?

Well, it’s a huge piece of research, and quite revealing. It goes way beyond the technology around Muse itself, and covers the identity, security, permissions, data and trust infrastructure all needed to make Personal AI Agents work in the real world.

But can they do it privately? Securely? With trust?

That’s why I’ve been getting under the hood. The how, not just the what.

And it’s a whole thing, if you care about this stuff. Which you really should do given what’s at stake.

So far, it’s clear that Meta is going much, much further than a smarter chatbot.

This is much closer to a full description of the digital infrastructure needed for an AI agent to operate as a digital representative of a person.

Read that again. The implications for businesses, customers, citizens and the wider digital economy are staggering.

I’m not saying Meta is right, or that they’ll succeed. But I’m pointing out that their approach looks pretty comprehensive, and we need to be paying attention to what’s coming. To the very future of the digital customer relationship.

So rather than try to squeeze everything into one newsletter, I’m going to unpack my analysis of Muse - and the implications - over five posts. Each looking at a different part of what’s going on.

Here’s what’s coming over the next few days:

1. Meta’s AI Agent ‘Muse’ is getting its own computer - and you need to be paying attention. What Meta has actually built, why the agent needs its own computer, and how this changes customer control - from apps to agents.

2. The agent isn’t in charge - and that’s the most important thing about Muse. How is Meta separating ‘intelligence’ from ‘authority’. And why permissions, credentials and trust will matter as much as the AI itself.

3. Delegation, not impersonation - why AI Agents are going to need their own IDs. Why acting as someone and acting on behalf of someone are two very different things. And what this means for agent identity and verifiable delegation.

4. When your customer sends an agent instead. What actually happens to websites, apps, customer journeys and commerce when businesses increasingly interact with a customer’s agent, rather than the customer themselves?

5. The ‘walled garden’ is now the agent itself. The extraordinary opportunity for customer empowerment, the risk of a new generation of platform lock-in, and why portability, interoperability and genuine customer control now matter more than ever.

These five pieces point towards one of the biggest shifts in personal computing since the smartphone. And perhaps something even bigger.

A fundamental change in who controls the digital customer relationship.

So let’s get into it. It’s a long one to kick off the series because there’s so much to unpack:

• What is Zuckerberg’s new Personal Agent Muse?

• Your agent gets its own computer: the brain, the computer and the connections

• The agent isn’t actually in charge, and your agent doesn’t need your passwords

• Your agent becomes a system of record

• The customer now becomes the centre of the system

• The next great customer shift is a complete reset

Let’s Go.

1. What is Zuckerberg’s new Personal Agent Muse?

On the face of it, Meta’s research paper How We Built Safety Into Muse is about security.

What happens when you give an AI agent access to someone’s email, calendar, files, browser and connected services. Then what happens when you allow it to operate without someone constantly supervising it.

Which, when you think about it, is quite a leap.

Because until recently, most of our interactions with AI have been asking questions, or generating content, or analysing some info. The AI produces an answer, and it’s up to us to decide what to do next.

But Muse now represents something different.

Meta describes an AI agent as something that knows its user, works in the background, coordinates other agents, develops its own tools and can even modify its own software.

That’s a remarkable - and hugely disruptive - collection of capabilities. And it’s worth thinking about what they mean when you put them together.

An agent that knows you is one thing. An agent that can act is another. But an agent that knows you, has access to your personal data, can coordinate software and continues working while you’re doing something else?

Well that’s the beginning of an entirely different relationship with technology.

With personal technology.

And the most interesting part isn’t the intelligence of the AI model. It’s everything Meta has built around it.

For an AI agent to operate on your behalf, it needs somewhere to work, data it can use, tools it can operate, connections to other services and rules that determine what it’s allowed to do.

I’ve long argued that Digital Public Infrastructure (DPI) will need a mirror set of capabilities on the side of the individual. And I think that’s what Zuck is building here.

In other words, we’re about to see a new wave of Digital Personal Infrastructure.

And Meta’s first major design decision is rather revealing.

2. Your agent gets its own computer

Meta research sets it out pretty clearly from the start:

“You and your Muse share your own dedicated computer in the cloud.”

‘Share’.

Isn’t that an interesting word? That the agent is something - someone - else, and separate from you and your stuff? More on that later.

This section in the research describes a dedicated ‘virtual machine’ (VM), with its own computing resources, storage, browser and ability to run software.

A virtual machine is basically a computer running inside another computer. You don’t need to buy it, maintain it or leave it switched on. It lives in a data centre, and you can access it remotely.

But unlike a conventional chatbot, which just responds to your questions, this gives Muse a complete computing environment in which it can actually work.

It can open a browser, use software, manage files, create tools and carry out activities that involve multiple steps. Meta also describes Muse’s support for ‘scheduled tasks’, which means the agent can perform work without waiting for you to open another conversation.

So now we’re 24/7.

Now, just hink about how different that is from the technology most of us use today.

If I want to organise a holiday, I open a browser, search for flights, compare hotels, check my calendar, look at car hire, find my loyalty numbers and work through a collection of websites and apps.

I become the integration point between all those different services. The airline has one system. The hotel has another. The car hire company has its own. And none of them really knows what I’m trying to achieve across the whole trip.

But with a personal agent, the idea is that the software can increasingly coordinate those activities for me.

And a dedicated computer is what gives it somewhere to do that work. Put another way, we’re moving from ‘AI as a conversation’ to ‘AI as a digital presence’.

Why?

Because a chatbot is somewhere you go to ask questions.

But a personal agent is something that can exist on your behalf, whether you’re talking to it or not. Some call it a Digital Twin. It has somewhere to live, information it can use, tools it can operate and connections to the services you rely on.

And increasingly, has the ability to act.

That’s a fundamentally different approach for the digital customer relationship.

3. The brain, the computer and the connections

I see Muse as three things working together.

First, there’s the brain.

Meta has developed a specific AI model that’s designed for ‘autonomous agents’, especially so they can use unfamiliar tools, follow instructions across long sequences of actions, and manage other ‘sub-agents’.

That last point is particularly important. Imagine asking your agent to organise a family holiday. One sub-agent could research flights, another could compare accommodation, while another checks existing bookings and travel preferences. Your main personal agent can then bring those results together, and help you make sense of all the pieces. Even book the holiday.

It’s a very different experience from asking a chatbot to recommend five hotels. This is now a system that can divide up work, use multiple tools and pull together the results.

Second, there’s the computer.

That’s the dedicated VM we’ve just discussed. Giving the agent a ‘persistent environment’ in which to operate. We’ll come back to that later, and look at how private it really is.

And third, there are the connections.

Meta explains that Muse can use ‘connectors’ to access external services. Things like email, social networks and other connected systems.

But there’s another important detail. The agent can also develop custom connectors for services that have suitable APIs.

Eh?

This part is a Big Deal.

An API is simply a way for software systems to communicate with each other. It’s how applications can exchange structured data, and can request actions without someone having to manually operate a website.

What’s interesting here is that Muse doesn’t necessarily need Meta to have built a dedicated integration for every service in advance. If another company or system has a suitable interface, the agent can potentially just create the connections it needs - on the fly.

That’s huge.

Because we’ve spent the last 15 years downloading apps to add new functions to our phones. We’re sick of hearing ‘there’s an app for that’. There are now literally millions of them in the app stores and hundreds on our phones.

Want to book a train? Download an app. Want to manage your finances? Download another. Want to track a parcel, organise a holiday, monitor your energy consumption or control your heating?

More apps. And every one comes with another interface, another account and another set of things to learn.

Personal agents will now change all that.

Instead of searching for a mobile app, installing it and working out how to use it, we will simply explain what we’re trying to achieve. The agent will work out the relevant services it needs, connect with the available tools, and even assemble new capabilities where they don’t already exist.

Of course, there will be limits. Businesses will still need to expose those ‘suitable APIs’, and the agent will still need permission to use them.

But I think this is a major moment for understanding how AI agents will get stuff done.

The next generation of personal computing will be less about downloading software and more about delegating outcomes.

Which has profound implications for the app economy.

We’ll come back to those in Part 4, when we look at what happens when businesses increasingly engage with customers’ agents rather than customers themselves.

4. The agent isn’t actually in charge

Now here’s where Meta’s paper becomes interesting.

Because giving an AI agent its own computer, access to your information and the ability to interact with other services creates some rather obvious problems.

What happens when it makes a mistake? Or misunderstands an instruction? Or encounters a bad actor on a website that tricks it into doing something you never intended?

Meta recognises that these are real risks. And its answer is to separate the intelligence of the agent from the authority to act.

How?

By building a separate security system called Sentinel.

Think of Sentinel as an independent gatekeeper. A security guard.

The AI agent Muse can work out what it wants to do, but it is the companion agent Sentinel that determines whether certain actions are actually allowed. Sentinel can approve a request, block it or ask the user for permission.

And crucially, Muse can’t simply override the decision.

Imagine asking your agent to organise a trip to New York. It might need to check your calendar, search for flights, compare prices and eventually make a booking. Those are very different activities, with very different consequences.

Reading your calendar is one thing. Changing an appointment is another. Spending £2,000 on flights is something else entirely.

Meta’s approach means that permissions can be much more specific. Potentially even applying to an individual action within an app, a particular task or a limited period of time.

Interestingly, Sentinel can also ask for your approval through a separate interface, rather than relying on a message inside the conversation with the AI.

Which is going to matter when it comes to the customer experience.

You can imagine that the main AI agent might be manipulated by something it reads, or simply misunderstand what you want. So Meta has designed a system that makes sure that the decision on what it’s allowed to do sits outside the agent itself.

The agent’s intelligence and its authority are two different things.

I think this is one of the most important architectural principles of the entire agent economy. We’ve spent decades building systems to authenticate people. Who are you? Can you prove it? Do you have the right credentials?

But in an agentic world, those questions are no longer enough. We also need to establish what an agent is allowed to do, on whose behalf, for what purpose, under which conditions and for how long.

That’s the beginning of a much bigger conversation about delegated authority, digital identity and trust.

We’ll unpack that properly in Part 2.

5. Your agent doesn’t need your passwords

Which takes us to annother important design in the research paper. Meta explains that Muse’s sensitive credentials are stored separately from the AI agent, using a mechanism called credential surrogation.

Yes we’re now getting a little technical. But it really matters.

Here’s what I understand that means.

Imagine Muse needs to access your email account.

The obvious approach would be to give the AI access to the ‘authentication token’ that allows it to connect to your email service. But that creates a significant security risk, because the AI might accidentally share that token with a bad actor, or be manipulated into revealing it.

Instead, Muse works with a substitute credential.

When an approved request is ready to be sent, for example to access your email, Meta’s security tools replace the substitute with the real credential.

In other words, the AI never needs to see the original credential. It’s a smart separation between the agent’s ability to do something, and its access to the credentials that make the action possible.

But look closely, and you’ll see a bigger story, and agentic design principle, here.

Your agent doesn’t need to control your identity credentials in order to act on your behalf. Which is a big deal for those of us working on agent delegation, digital ID and verifiable credentials.

It’s going to matter enormously as personal agents begin interacting with banks, retailers, airlines, governments and other organisations.

Because the agent isn’t the customer. It’s software acting for the customer. And those are not the same thing.

We’ll come back to that in Part 3, when we look at why agents need their own identities. And why the difference between ‘impersonation’ and ‘delegation’ is going to become such a significant issue.

But for now, the important thing to remember is that Meta is building these distinctions into the architecture itself.

Not simply relying on the AI model to behave.

6. Your agent becomes a system of record

Now here’s what I think might be one of the other most important things in the entire research paper.

Meta describes the dedicated VM as the ‘system of record’ for the data that users put into Muse. A system of record is a familiar concept in enterprise technology. It’s the authoritative place where important info is stored and maintained.

A bank has its account ledger, a company has its employee database, a retailer has its CRM system, and so on.

Now Meta is applying that idea to the individual.

It’s something I’ve been banging on about since 2012. The customer can become the source of truth. An active participant with fresh, verifiable data. Rather than a ‘passive data subject’ that gets shuffled around from system to system.

The idea that the only 360-degree view of the customer… is the customer themselves. And Meta’s approach and architecture for Muse seems to be pointing exactly that way.

The research paper says that files, ‘agent-generated information’ and customer memory are all stored within the user’s computing environment. Meanwhile credentials and other sensitive information are kept in separate protected areas.

So far, so sensible.

And in a shock empowerment move by Meta, users can now inspect, edit and download their files, including information Muse remembers about them.

And that’s all very important, because a personal agent becomes much more useful as it understands more about you. Your preferences, relationships, circumstances, previous decisions, commitments, goals and so on.

Imagine an agent that knows which airline you usually fly, what time your children finish school, which subscriptions you’re paying for, when your insurance renews and which businesses you regularly deal with.

Not because one company has assembled all that information in its own CRM system.

But because the information has been brought together in an environment organised around the individual.

Of course, that raises some enormous questions. The kind of Zuck-level, make-you-freak-out kind of questions. Who can access all my Personal Agent memories? What happens if I want to move it to another provider? Who controls it?

Yes, Meta says you can download it. But downloading memory isn’t necessarily the same as moving a functioning personal agent.

Which is why we’ll explore that very distinction in Part 5. It will fast become one of the most important ‘data portability’ questions of the next decade.

But let’s step back and look at the bigger opportunity.

A digital wallet or personal data store helps you organise information. Now a personal agent can use that information to get things done.

And that takes us to the customer relationship.

7. The customer now becomes the centre of the system

For decades, digital customer relationships have been organised around businesses.

Every bank has its own app. Every airline has its own website. Every retailer has its own account. Every service provider has its own version of who you are. And each business tries to build a slightly better picture of the customer from the tiny slivers of personal data it can see, hoping that the data is even correct.

We’ve spent billions on CRM systems, customer data platforms, personalisation engines and the elusive 360-degree customer view.

But it’s all a wild goose chase.

I’ll say it again: the only 360-degree view of the customer is the customer themselves.

No airline knows everything about my journey. No bank knows everything about my finances. No retailer understands everything about my preferences. And none of them sees the complete picture of what I’m trying to achieve.

But that’s the very point. A personal agent now potentially can.

Because it starts on my side of the relationship. It can bring together information from multiple organisations, understand the context across them, and coordinate activities that no individual business could manage on its own.

Think about a delayed flight. Today, an airline might know my flight is delayed. My hotel knows I have a reservation. The car hire company knows when I’m collecting a vehicle. My family knows when I’m supposed to arrive.

But none of these organisations necessarily knows what the others know.

A personal agent can now bring that information together, work out the consequences, identify alternatives and help resolve the problem. Not because one company has built the ultimate customer platform.

But because the customer finally has their own.

And THAT’S the real AI agent opportunity.

And it’s why I think Meta’s dedicated VM matters so much. It’s not only a clever way to run AI software, but it’s potentially the beginning of a personal computing environment that’s finally organised around the individual, rather than the businesses they deal with.

But let’s not get carried away here. Meta still operates the underlying infrastructure. It builds the model. It defines the software architecture and security rules.

A dedicated computing environment isn’t automatically an independently controlled computing environment. That distinction will become a huge deal later in this series.

Because you need to ask yourself this: Do you really want Meta running the operating system for your digital life?

The underlying architectural shift here is huge. Because we’re beginning to see some credible, scalable, dare I say ‘trusted’, infrastructure for a persistent digital representative that can operate across multiple business relationships.

And it’s about time.

Should Zuck own it? Of course not. But the shift is happening and you need to be paying attention.

8. The next great customer shift is a complete reset

This is all inevitable of course. Part of what I’ve been writing about all these years. About the coming Great Customer Reset.

When you zoom out, it’s perfectly obvious. Just look at the history of personal technology.

First came the personal computer. Computing moved out of dedicated and expensive buildings because it got small enough, cheap enough and safe enough to be used in our homes and workplaces.

Then came the mobile phone. And so computing became portable, connected and available almost everywhere.

Then came the app. We gained access to an extraordinary range of personal services, from banking and shopping to travel, entertainment and communication, all from a device in our pocket.

Now comes the personal agent. The next shift in the unit of personal control.

Instead of individuals having to navigate hundreds of applications and services themselves, we can begin delegating activities to intelligent software that operates on our behalf.

Put another way, the computer gave us access to computing power. The mobile gave us access to that power wherever we went. Then apps gave us access to digital services using that power.

Personal Agents will now give us the ability to organise and coordinate those services around our own goals.

And it’s going to fundamentally change the balance of power in the digital economy. The real opportunity is much more than automating existing customer journeys. It’s going to reorganise them around the person, their circumstances and what they’re actually trying to achieve.

Which is why Meta’s technical research matters so much. Not because Muse is the final answer (far from it), or because Meta will inevitably become the dominant provider of Personal AI (many of us hope not).

But because it shows us a credible architecture for something we’ve been talking about for years:

A personal digital representative with its own computing environment, its own tools, its own memory and the ability to operate across multiple digital relationships.

And perhaps most importantly, the infrastructure to make that agent safe enough to use.

Yet the biggest breakthrough won’t be the intelligence of the agent itself. It’s more likely to be everything that makes the intelligence trustworthy enough to act.

Next up: The agent is not in charge

There’s one rather obvious problem with all of this.

What happens when you give an AI agent access to your email, your calendar, your files, your browser and eventually your money? What stops it from making a mistake, or being tricked into doing something you never authorised?

Meta has spent an extraordinary amount of engineering effort trying to solve precisely that problem.

So in the next post, we’ll go deeper into Muse’s Sentinel feature.

Plus permissions, ‘protected credentials’ and how Meta has designed their smart personal agent to prevent it from acting beyond its authority.

Remember: the future of Personal AI won’t just depend on how intelligent these systems become. It will depend on how much authority we’re prepared to give them.

My brain hurts with how much is going on right now. But this shift might be the most important thing I’ve been tracking in 15 years.

See you in Part 2.

Thanks for reading this week’s newsletter.

If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe:

Subscribe now

If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below. To the regular subscribers, thank you.

Subscribe now

Hi folks,

This week we are revisiting a huge new identity market that only a few people are even aware of: ‘OI’.

I first wrote about it in 2023, but it’s becoming one of the most compelling - and disruptive - shifts coming to the digital economy.

It’s a longer post than usual as there are a few things to unpack:

• A quiet identity crisis - and today’s cost of doing business

• A new $Bn identity market

• Fixing the mess with a new type of identifier

• 100 times larger than IAM and Self Sovereign Identity - and a repeat of 2016?

• A market ripe for disruption

• It’s primetime for AI agents

So grab your hot drink of choice, and Let’s Go.

Let’s begin with a short story.

It’s late one evening, and you are tired after a long day. The phone rings. It’s a withheld number, but your gut tells you to answer.

“Hi there. I’m calling from Your Bank’s Fraud Team. We have seen some suspicious transaction activity on your account. In order to resolve this I need you to confirm some account details. We can then help you get this sorted right away.”

They ask you to hand over some basic banking information, like your full name and account number.

“Before we can go any further we need you to pass security”. They ask for your mother’s maiden name, date of birth, and the first line of your address.

At this point you pause. It feels strange. They’re not asking for a PIN or password (you’ve been warned about sharing that). But you ask yourself: is this really the bank calling?

So you turn it around: you ask them to prove that it’s really the Bank Fraud Team. They don’t give a convincing answer. When you press them, they flounder. Eventually, they hang up.

Of course, it wasn’t the bank calling.

It was yet another fraudster trying to get you to give up some personal information. Hoping to use it elsewhere to impersonate you, and piece together a profile to later commit fraud.

It’s called social engineering, and sadly happens to thousands of people every day. It happens so easily because it feels real. It sounds real. It’s not like they are digging in your bins for a bank statement. The fraudsters use convincing details and phone numbers, and do it all in plain sight: they call you.

But this identity story isn’t the one you think.

It’s not about you. And it’s not about the fraudster. It’s another identity problem altogether.

One doing even more damage to our economy. Causing vast amounts of fraud, and as you’ll see later, resulting in huge levels of corporate waste.

We often say that we don’t know who we’re dealing with online. We’re back again to that 30-year-old New Yorker cartoon of the dog sitting at a computer. But it’s now time to be more precise.

We don’t really know if it’s the right organisation we’re dealing with.

A quiet crisis

It’s a wicked hard problem to solve.

Verifying a company relies on a universe of different identifiers. Web addresses. Phone numbers. Office locations. Company registrations. BIC and SWIFT and IBAN codes. Dunn and Bradstreet identifiers, Moody’s ratings and many more obscure ways to point to an organisation.

It’s a mess.

And that’s before you get to employee identity. How on earth do you know that the person calling you - even if they have all the right organisation info - really works at the company?

Now we’re really down the rabbit hole.

Both human identity - like those bits of information above that the fraudsters asked for - and organisation identity are separate things. And both are completely broken.

But let’s pour some salt on the wound and call it like it is.

Our lack of organisation identity is a festering root cause behind the exploding cases of fraud, unacceptable levels of money laundering and increasing phishing attacks.

Worse, it’s causing us to waste billions of dollars inside businesses too.

Just think about all the admin that’s required before two companies can do business together: the supply chain checks, the company signatures on all the contracts, the 3rd parties getting in the way because we need layers of people, proofs and paperwork in order to trust a transaction.

A few years ago it took me nine months - nine! - to get onboarded to a client’s vendor system. And most business owners I know have a bunch of horror stories about trying to open a business bank account. It’s ridiculous.

Anyway, all of that’s before you deal with the mountain of employee verification that needs to happen too. Situations where company employees, representatives and agents move between and across organisations… everyday… everywhere.

It’s mind-blowing. Then just think about businesses dealing with each other across a country border.

OK, enough already. You get it.

But I’ll make one last point: consider how much risk our businesses, and of course individuals, carry… precisely because they can’t easily check the company they are dealing with.

Holy wow it’s a problem. I’d say it’s a fraud and waste crisis. One of the most expensive issues across the economy.

But it’s a quiet crisis. Where checking organisation ID has just become a cost of doing business. An overhead. A cost centre.

So why do we put up with it?

Because it’s too hard to solve.

A new market?

The first and original market for digital identity was ‘IAM’: Identity and Access Management.

It’s what large organisations do to manage their own employees within the business. Accessing technical systems, physical places, and dealing with login and so on.

IAM is huge. It’s a $25BN market today and is expected to grow to over $60BN in less than five years. Talk about growth.

It also has a first cousin, Customer Identity and Access Management (‘CIAM’). Related to the systems that businesses use to interact with customers.

Then around ten years ago, another identity market was born: Self Sovereign Identity (so-called ‘SSI’ or ‘Decentralised Identity’). That’s the market for digital wallets and related technologies, where individuals can instantly share verifiable data about themselves.

Both CIAM and SSI are about citizens, individuals and customers. Together, they will be absolutely massive. I co-wrote a report back in 2016 that predicted that the “Personal Information Economy” - including consumer digital wallets, personal data stores and all the rest - would be worth $20BN in the UK alone.

But we’re not done. We’re now on the cusp of a new identity market. And it’s a much larger one: Organisational Identity.

Just think about the value that can be created - and the fraud and costs that can be reduced, both outside and within businesses - if we can identify organisations and their employees properly.

Organisation Identity, or OI, is going to trigger the next wave of digital transformation.

Yes, there’s AI identity coming (more on that later). But OI is different. And no one is talking about it.

Yet.

Fixing the mess

After the market crash of 2008, the global authorities agreed they needed a new way to know which organisation was which. Who is trading with who.

The banking crisis was an opportunity to find new ways to restore company transparency. So they set out to explore the frameworks and technologies that could make this possible.

There were three important outcomes from this work:

1. They decided to create a globally unique reference number for each organisation. It became the ‘Legal Entity Identifier’ (LEI).

2. They needed to set up a global body to oversee this ecosystem of new identifiers. So they founded the Global LEI Foundation. Given the catchy title ‘GLEIF’.

3. They realised they also needed a way for others to verify LEIs - anywhere, at any time. What if, GLEIF thought, businesses could use the same credential cryptography and digital wallets as SSI…? And so the ‘verifiable LEI’, or vLEI was born.

It’s nearly 20 years since the great crash of ‘08, and organisation identity, or ‘OI’, is nearly here. Finally, a way to identify any organisation - and the people that work for it - instantly, seamlessly, and portably.

Here are some things to know:

Standing on the shoulders of SSI

OI builds on the same foundations as the Self Sovereign Identity (SSI) movement. Applying the same technologies, protocols and principles of portable, verifiable credentials, digital wallets and decentralised identifiers.

A new class of credentials

OI will give birth to a new family of identifiers and verifiable credentials related to the business: Organisation Credentials.

These will include everything from department identifiers and company roles like CEO or CFO, to approved business partners and their agents.

Soon, most AI systems interacting with customers will be required to assert their organisation credentials. To prove they are verifiably related to the business. vLEIs will be one of the few, trusted and scalable ways people will be able to know they are really interacting with the right organisation.

OI is going to be enormous

The OI market will be much larger than SSI, perhaps 100 times larger. Because the problems it will solve are

• 100x more expensive. Individual fraud might cost millions, but company fraud and internal waste cost billions.

• 100x more frequent. Yes, customer interactions happen all the time, but just think about how much employee effort, company time and money is wasted dealing with untrusted organisations, processes and systems - across every supply chain in every country.

• 100x more required. Much of the consumer waste and fraud is from optional transactions like account registration, payments and so on. But employees and businesses are required to run checks by The Compliance Team. It’s why compliance is considered a business overhead - literally a ‘cost centre’ - to meet regulations and manage company risk.

OI will be everywhere

OI is going to flow into every business process and department, every customer touchpoint and transaction. Can you think of an example of a company interaction where you don’t need to trust who an employee or a business is?

• Every digital customer interaction

• Every company payment (out or in)

• Every supply chain transaction

• Every external employee verification

• Every digital signature or contract

• Every asset transfer

• Every treasury and tax event

When you multiply this across every employee, every department and every company, you’ll see this market has the potential to dwarf IAM, SSI and CIAM.

And that’s before you add in AI agents that need to know who - or what - they are dealing with.

Back to the future

In 2016 I had the privilege of helping Timothy Ruff and the Evernym team launch the Sovrin Network, one of the foundational networks behind the SSI movement.

I was there in the early days of telling the SSI story. Of new identifiers. Of portable verifiable data. Why it was different. How it could work.

And while much of the technology was still being worked out, there was excitement. Like those describing the early internet, the arrival of the PC or the first smartphones. All breakthrough technologies, and new ways to empower individuals. Of limitless possibilities.

We spoke to Healthcare providers. Pharmaceutical companies. Banks. Governments. NGOs. Travel providers. Startups of every stripe and colour, in every region. They could all see the potential for portable, verifiable data that worked across organisational boundaries. To streamline experiences and customer interactions. To massively reduce consumer fraud.

For the next ten years, the world watched an explosion of start-ups, entrepreneurs, governments and other large organisations make headway into the human identity problem using digital wallets and verifiable credentials.

Global standards bodies like ISO and W3C have now agreed standards for it. The EU has developed a reference framework for it with eIDAS2. And the EU Federal Government has just issued guidance on it.

Digital wallets, verifiable credentials and citizen data empowerment is certainly coming.

OI today feels like where SSI was back in 2016. On the cusp of a similar breakthrough. Because the vision for business wallets and organisation credentials is as grand as SSI.

Of ‘Protocols not platforms’.

And because the core challenge is the same: Why should there be a company or platform in the middle of the market determining who is who… and which organisation is which?

With OI we can unravel the mess of business identifiers all over the world. We can navigate the confusopoly of company accounts, credit ratings and digital reputations.

Bots and primetime

Business identity - and critically company reputation - is about to change forever. Because it will no longer just be digital. It will be verifiable instantly. Anywhere. By anyone.

Those paying attention will already know about the EU’s Digital Wallet programme for businesses. A sister regulation and technology to the EU Digital Identity Wallet for citizens. But this time for organisations to prove who they are to each other.

It’s still a while out. But it’s catching up fast.

So OI is the next absolutely massive identity market. Getting ready for prime time.

And just like ID for employees and ID for people, ID for organisations is a huge thorn in the side of the digital economy. And is why it’s ripe for digital disruption.

But you’ll notice that I haven’t yet mentioned much about AI agents. Where do they fit? Well, in two spectacularly important ways.

First, it’s pretty obvious that AI agents are going to face an army of fake companies selling fake things to fake people and agents. Consumer fraud is already exploding.

Is this really the right website? Is this really a legitimate ticket and vendor? Is this really the bank? Is this really the correct customer service agent helping with the upgrade?

Our customer bots are going to need to trust who - and what - they are dealing with too.

But the second (arguably bigger) point is that business agents are going to be crawling over ever B2B supply chain and automated commercial transaction you can think of too. And doing so 24/7, 365.

This is way more complicated that making sure the consumer agent is buying the right shoes. Because B2B agents will form a whole new economy, handling everything from B2B finance to internal employee processes.

Which means a whole new explosion of B2B fraud and security breaches unless we can prove which organisation is which. Understanding which company AI agent acts for which business, and specially which employee is responsible as the ‘human in the loop’.

All of which needs verifiable, scalable and trusted business and employee identities.

In other words, new way to do Organisation Identity.

So is today the day you became aware of the biggest identity market that you’ve never heard of? Maybe.

But the next time you get a phone call from your bank, perhaps it won’t take you so long to ask: is it really them?

Thanks for reading this week’s newsletter.

If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

Question for you.

Do we really understand where identity fits in a business process? What data really needs to be collected? Is identity a thing in its own right? Or is it part of a wider customer experience?

Too many digital ID companies think they’re building products when in fact they are building features. To be embedded inside other, broader and more valuable customer experiences.

But to do that, we must better understand not just digital identity itself (there are three decades of debate on that, let’s not open that box), but what it means to add identity to another flow.

To better understand what identity is being added to, why, and from the customer’s perspective.

I’ve argued for the longest time that digital ID is missing a product sensibility. Thinking about the why and the how of the experience, not just the what. Certainly not ID for its own sake.

We need people thinking hard about ‘jobs to be done’. About ‘Nth use’, not just ‘1st use’. We need a business and commercial mindset, not just a technical, compliance or risk one, which seems to be so much of the ID team profile these days.

I think the root cause it pretty obvious.

Everyone is focussed on the customer transaction rather than the customer relationship.

We are down in the details of QR code scans and selfies and credential exchange and key rotation and verification taps and mDLs and regulations and proof of human.

All of those matter of course. But they are not the point. They are the enablers to what the individual is trying to get done.

As ever, Rory Sutherland puts it better than I ever can (watch from 59m00s). He talks about finance vs marketing.

“Marketers are trying to form a marriage, but finance people are trying to run an escort agency.

“The finance people are only interested in how many exchanges you have, not the durability of the exchange over time or the potential to actually engage in increasing value exchange over time.

“Fundamentally, trying to understand a market without understanding network science is like trying to attempt a moonshot with no understanding of gravity.”

Digital identity teams too often fall into the same trap. Getting excited about assurance levels and data points and IDV transactions. Not how it feels. Or the commercial implications around digital trust and permissions.

To understand the customer’s behaviours, motivations and constraints. To look beyond the technical and cryptographic. Beyond compliance, risk and QR codes.

Encouragingly, there are plenty of identity platforms and apps out there that now have over 500k or even 1M downloads.

Yet downloads and accounts are not adoption.

Do we really understand the difference between transactions and relationships? Between ‘users’ and ‘daily active users’. And what happens once digital identity becomes reusable, portable and private?

It’s never been more important to understand the future of the digital customer relationship.

So welcome back to Customer Futures.

In this week’s newsletter:

• The next 5 years are going to be pretty exciting for banks - but only if you care about the customer

• Is ‘wallet’ really the right language?

• Do you really want someone else managing the keys to your front door?

• … and much more

Let’s Go.

The next 5 years are going to be pretty exciting for banks - but only if you care about the customer

This chart below from David Jimenez Maireles, says more about a bank’s ability to focus on the customer than any of the analyst reports out there.

It shows the comparative rating of each bank’s customer experience over the last 5 years.

It’s striking how little has changed.

Yes, the big banks have legacy systems to deal with. And sometimes 150 years of culture to battle. Plus huge organisational structures and processes locked in concrete.

But CX is such an important factor that it’s confusing why banks don’t put more investment and thought into it.

Monzo, at the top of the chart, is now one of the UK’s largest and growing banks. No branches, great app, simple tools.

One of my favourite things about Monzo is that they have very little down time. If they have a system-wide problem, they just spin up their lightweight ‘shadow bank’. You can still use minimal features for the basics. Pay salaries, get through checkout at the supermarket, handle direct debits. Most of what you need day to day.

Yet when the other banks crash, they hit the headlines and have PR disasters - even get fined - because customers can’t get paid on time. And the supermarkets fall apart because they can’t take payments.

Anyway, one of the more obvious reasons why so few banks care about CX is the customer themselves. In the UK at least.

It’s because people don’t really switch banks.

Once you have a UK bank account, often set up in your early 20s, in any one year only about 2.5% of customers change provider. On average, it’s about once every 20 years.

That’s nuts.

So the logic becomes a little clearer. Why spend £MM to improve the bank’s CX when people just put up with the old, crap experience?

But that’s where it’s about to get interesting.

Let me explain.

Most people are pretty bad at managing their money. They forget to check their balance. They don’t research. They don’t set goals. They don’t get around to it.

But as we speak, personal financial software is getting pretty good once it’s plugged into AI. At remembering. At researching. At setting and managing goals.

And now with AI agents, that software can take action. Move money. Handle transfers. Track and manage savings pots.

We’re not there yet, of course. There’s lots still to do on liability, risk, governance, identity and stuff like agentic system access.

But it’s pretty clear that soon people will be using AI financial assistants to keep track of their money coming in and what they spend. To help them make day to day savings.

Banks don’t allow it yet. Nor do the regulators. Rightly. There’s too much that can and will go wrong.

But AI assistants for money are coming.

And some of the smart banks are preparing. They can see what’s happening to AI agents and shopping and mandates and permissions.

Why should you care?

Because the bank CX teams won’t just need to design for people. They will need to design for customer AI agents too.

I am speaking to a couple of banks at the moment who are looking ahead, who are thinking about ‘the agentic customer’.

I’m willing to bet that the banks that care most about CX will also care about AI agents.

Yes, the Big Old Banks will start making Big Moves into agentic. But as ever, so much comes down to company culture. About how fast you can move. About what you actually care about.

The next 5 to 10 years are going to be pretty exciting for banks.

But that’s only if you care about the customer. And great AI experiences.

Not just showing me pdfs of my balance.

READ

Is ‘wallet’ really the right language?

I’m not sure we should assume there will be some grand central registry of ‘all global AI Agents.’ A kind of database in the sky for all AI identity.

Because AI Agents are naturally decentralised things. They race across borders, across sectors and use cases without a care for what the human rules say.

So rather than more and more federated agent ID checks and spaghetti APIs everywhere, it’s more likely we’ll see AI agents connected to their own identity and data ‘at the edge’.

Where agents can instantly prove who they work for, who operates them, their ‘binding’ to their owner, their permissions and so on.

In Fintech terms, digital wallets and credentials are in 2014. But the shift to agentic finance is going to happen quickly.

I can see a path to 200-300M digital ID wallets for humans over the next 24 months. Perhaps many, many more.

But if the idea of giving AI agents their own digital wallets takes off, as both META and Cloudflare have each recently announced, then we’ll be counting digital wallets in the billions pretty quickly.

Look at it the other way round.

Why on earth would the AI majors - and retailers for that matter - spend their time, money and risk profiles holding a vast amounts of ID data when they can just ask for the minimum info they need from other parties, via digital wallets?

KYC and KYA shouldn’t be the goal. ‘Digital trust’ should be.

Local AI agent registries? Sure. But centralised agent ID? Nope.

But the language here is a problem.

Because Agents won’t have ‘wallets’ any more than they will have digital driving licenses or passports or CVV numbers for payments.

As identity OG Eve Maler puts it

“It might not even make sense to count those things (or even think of them as “normal” wallets, vs. a sort of software-defined secure element), given the ephemeral nature of many agents.

“Several schemes for registering client apps were invented for open banking and healthcare, but all of them still suffer from the slow speed of business trust.

“With agents, we finally have a reason to scale up to the speed of what’s possible with technical trust.”

As ever, we apply new technology to old problems. Today we are creating digital versions of our leather wallets, to contain digital versions of loyalty cards, driving licenses, tickets and payment cards.

Just as we gave our early computers desktops and folders and trash cans, they were digital versions of what was already in front of us.

But real tech disruption happens when we create new things that weren’t possible before.

With digital those new things were newsfeeds, email and app stores.

So what’s new this time?

With AI agents we can create and scale things like real-time, high-frequency, agent-native identifiers, together with delegation frameworks to handle permission and scope of what those agents and sub-agents are allowed to do.

And things like agents accessing personal data vaults and stores that unlock portable personal context, preferences and customer history, plus things like personal terms for customer negotiation.

Wallets made sense in the physical world, and have been a handy metaphor as we transition to this new AI-enabled world.

But let’s be clear, AI agents are not going to be holding driving licenses, coffee stamps or movie tickets.

And digital wallets are probably not the right language for how they’ll show up.

READ

Do you really want someone else managing the keys to your front door?

Some describe this as a ‘first world problem’.

But we must remember that your social media platform can take away your name/handle whenever they want.

They can also block you, decide what you see (and what is hidden), how your posts are shared with others, and of course what happens to your personal data.

When it’s a stream of cat photos, that’s probably fine.

But when that account is a core part of your social life, needed for daily communication, or even used to login elsewhere…. Then we have a problem.

Remember: if you use META‘s products to login elsewhere, if they shut you out, you just lost the keys to your front door.

When Mark Zuckerberg launched the new personal agent ‘Muse’, META kicked the band Muse off that same handle on Facebook, Instagram, and anything else that META controls.

All is fair in love and war, I suppose. It’s in the T&Cs, right?

But there are plenty of people who have been locked out without notice, because of some fraud attempt, or just bad password protection hygiene.

It’s just another example of a digital landlord who can change the locks whenever they want, like when Elon bought Twitter and steamrollered the owner of the account (at) X.

So which brand or person will get pushed out the way next?

I could be you.

So what are you doing about it?

READ

A longer list of things to track

There are SO many interesting and important Customer Futures things happening at the moment.

Here are just a few from my open tabs:

• Post: Customer service agents are about to be overwhelmed with Dots and Muses and Clawlikes negotiating for better deals using voice/chat READ

• Analysis: Apple is worried about what happens when you give AI Agents access to your data READ

• Idea: Martin Sorrell on why marketing is not getting more complicated with AI and agents - it is getting simpler READ

• Post: Meta’s AI agent sent a stranger to a guy’s door READ

• News: Booking.com joined Expedia and Airbnb: bye-bye guest phone numbers READ

• Announcement: Yet Another Personal Agent Gateway (can you see the trend yet?) READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

This week it’s a post from Trusted Agents, our sister advisory firm. We’re working with companies all over the world on the arrival of Personal Agents, digital wallets and the new digital customer relationship.

Because everyone is getting very excited about automated customer engagement, and bots shopping themselves.

Giving AI agents virtual credit cards and so on. Meta, Google, Amazon, Apple and a host of well-funded and spicy startups are now out and swinging in the consumer market.

Personal Agents are certainly now here. (I first wrote about them in this newsletter in late 2022).

So what will this all mean for retailers, for insurance companies and travel providers? For storefronts and liability? For checkout and fraud?

Well, you need to know that an AI agent isn’t just a new automated shopper. You need to think of it more like a new commercial animal. With new behaviours, and new expectations.

AI agents will have whole new levels of patience (they will be happy to queue for weeks), and yet also new levels of impatience (if you don’t recognise and serve them immediately in the channel they want, they’ll just head over to a competitor that will accept them right now).

Gam Dias, my cofounder at Trusted Agents, posted this piece earlier this week. And it was so important that I wanted to share it again here.

So today we’re going to dive into the reality of agentic commerce - and what’s actually about to happen:

• The shoe drop was gone in a second

• The agents arrived this month

• What - and who - is behind the door?

• Refundable inventory just became a major problem

• What happens when the agent is wrong?

• Are you ready - the next ninety days

• A new wind tunnel to find out

With Muse, Instinct, GrokBot, MyClaw, Siri and all the rest now wrestling for our attention, it’s never been more important to understand the future of the digital customer relationship.

Let’s Go.

The shoe drop was gone in a second

Picture a new product drop in November 2026. In fact, imagine exactly one thousand pairs of an exclusive new trainer, live on the website at 9am on a Thursday morning.

You know how that used to go.

People set alarms, sat with the product page open and refreshed every few seconds. A share of the stock ended up going to resale bots, which is why the retailer bought ‘bot management’ tools in the first place. The rest went to customers who were quick and lucky.

But this year, a meaningful number of the people who want those trainers have a personal agent.

That agent doesn’t need an alarm, doesn’t get bored at 8:58, and doesn’t mistype the card. It doesn’t hesitate when it’s asked about shoe size. In fact, it’s been watching the page since Monday.

This time, the new trainer drop allocation is committed in under a second, and the service team spends the week explaining to loyal customers that they never saw the page load.

Then it gets awkward.

Because the retailer’s defences can’t tell those agents apart from the resale bots. In fact, from the outside, they look identical. A browser on a cloud virtual machine, a data centre IP address, machine speed and a single-use payment credential.

So what are the retailer’s options? Well, they can let everything through and lose the allocation in a second, or they can block everything and turn away the customers they spent the year acquiring.

Nobody has offered them a third option.

In fact, their digital store configuration has already chosen one on their behalf.

The agents arrived this month

First, Meta launched Muse on 8th September in the United States, on iOS, Android and at muse.ai.

It sends emails, fills in forms, books travel, negotiates and pays, all running on its own isolated virtual machine with its own browser. And holding credentials it can use but never read. Helpfully, there’s a second agent called Sentinel approving anything it sends out to the internet.

In her review for Lenny’s Newsletter, Claire Vo asked Muse to buy a cinema ticket. The agent opened its browser, found the showing at a Cinemark in Daly City, selected a seat and went through guest checkout with a one time card from Stripe Link.

It would have completed the purchase if she had let it.

Now consider what Cinemark would have recorded. A guest. No account. No loyalty number. No email address it had seen before. And a card that stops working after a single use.

It would have looked like a real customer, real money, and nothing to recognise her by next month.

Then Google followed on 17th September with CC, an agent for families.

Most interestingly, CC has its own verified Google account and a distinct identity. Up to six household members share it, each choosing which emails, calendars and Google Drive folders it can see, and it fast fills in school permission slips.

xAI’s Grok Bot already does the equivalent for work.

So that’s three products, three audiences, and a few things in common. The agent is given its own identity, its own machine, its own credentials and its own set of permissions.

Until this month, personal agents borrowed the human’s browser session, and as far as your systems were concerned, it was the human.

That was impersonation, not true delegation.

What - and who - is behind the door?

Over the last 4 years, GenAI has broken every previous record about consumer adoption of new products. ChatGPT picked up 100M users in just 2 months.

But your new AI agent will go further. Because it plans, reasons and then uses tools to carry out the task. Until now, that has been mostly experimental.

Muse and CC now are consumer-grade products with onboarding, avatars you can name, goals and a morning brief, and the examples on their product pages are permission slips, buggies and family calendars. Consumers will always rush towards tools that save them an hour a day, and then they’ll mention it to other parents at the school gate.

Friend of the Trusted Agents family Dazza Greenwood has set out three things a business now needs from its own web presence:

• Accessibility - so the agent can reach your content

• Legibility - so it can understand it

• Actionability - so it can complete a transaction

And he’s pretty blunt about treating every customer bot as a threat:

“If your site can’t accommodate it, or worse, actively blocks it, you’ve lost a sale to a competitor whose infrastructure was ready.”

But that’s only half the story.

Getting an AI agent through the door is the easy bit. Once inside your website, it’s going to read your content for what its owner asked for. Not what you chose to display.

If you run a hotel, an attractive room description is no longer enough. Because the agent is working through a specific instruction: ocean view at sunset, cot in the room, away from the lifts.

It will check your public claims against reviews on sites that you don’t control, and it needs availability, delivery date, shipping cost and returns policy in a form it can read without guessing.

And if that takes too long to find, it moves on to whoever published theirs properly.

Refundable inventory just became a major problem

Yes, the ‘new drop’ problem is one of speed. AI agents will be faster than humans. But the thing that will cost retailers more is a problem of patience.

You’ll tell your agent to make sure you have a good hotel for a busy week, to keep looking for something better, and not to leave you without a room.

So it books the best room it can find, then the second best because cancellation is free, then the third. It keeps searching, and releases the ones it does not need at the last permitted moment.

Now the market just got flooded with legitimate, verified purchases. The hotel now looks fully booked.

But those are phantom bookings.

It’s just that the room booking policy was design for patient, human customers. Not real-time, high-frequency, verified and limitlessly patient AI agents abusing the cancellation policy.

We would probably do the same with hotel bookings if it cost nothing and took no time. But it does cost us something, which is why we don’t. We human customers have limited patience, we don’t like to cancel on people, and we forget to check back before the cancellation deadline.

Your personal AI agent won’t care about any of that.

‘Free cancellation’ was always a bargain made by the hotel because only a small number of people booking would use it. But revenue management systems weren’t built to price these types of behavior.

Ah, but that’s the funny thing, because none of this is really a new behaviour:

• OWASP classifies it as OAT-021, Denial of Inventory, and names hotel rooms, restaurant tables, holiday bookings and flight seats

• Delta already prohibits bookings created “to hold or block reservations due to expected demand, customer indecision, or for any reason”

• Jin Air found genuine customers unable to book flights because inventory hoarding bots were creating fake reservations.

Every one of those fraud controls assumes the offender is 1) a bad actor bot, 2) a broker or 3) a fraudster who can be blocked on that basis.

And that’s the twist coming with personal agents.

Because retailers have built their entire businesses around detecting and blocking all three types - checking for a ‘bad customer’ vs. ‘good customer’.

An authenticated personal agent is none of those. In fact, it’s a genuine customer, with a valid payment credential, exercising a cancellation right you granted in writing.

Which forces a new question that the retailer’s ‘bot management’ systems were never built to answer.

Does this agent have legitimate authority - a mandate - to hold this much of my inventory, and where would I read it?

What happens when the agent is wrong?

We must remember that AI agents get things wrong all the time.

Why? Because by definition they are probabilistic. They are designed to produce the likely outcome. As opposed to being deterministic, where we can predict the exact outcome every time. It’s an important distinction because if AI agents were entirely predictable, then they wouldn’t be ‘artificial intelligence’ - they’d just be pre-programmed software.

Now look at what happens when it makes a mistake.

When the shopping attempt fails on the colour and size, or the cinema booking is for the wrong film, the complaint doesn’t go to Meta. It goes to the merchant whose name is on the confirmation.

The Fashion Law describes the problem very simply. The payment record, the access token and the merchant’s ledger can all be correct… but nothing always links the customers payment to the task - the intent - that the customer actually gave the agent.

Senator Mark Warner’s AI AGENT Act defines a ‘custodial user agent’ as software allowed to act “in a transparent, documented, limited and revocable manner”. And it asks NIST to develop standards for verifying delegation. Note the term: Delegation. The opposite of impersonation, where the AI agent shows up as you and we can’t tell which is which.

We are a while away from agreeing an answer to all this. And a human confirmation step doesn’t necessarily move the problem elsewhere either.

The NHI Management Group’s position is that “accountability stays with the organisation that designed the workflow and the user who confirms the final action”.

Mesnwhile, consumer protection is showing up faster than merchant protection. Link, the payment method Muse uses, covers purchases through ‘Cover Genius’, with a refund guarantee up to $1,000, and no fee returns up to $250 per claim.

Ok so now the customer is insured, and the merchant is the other party in the transaction. Dazza points to the OAuth 2.1 work on delegated authority, where the agent’s access token carries two identifiers: First, the person who granted permission; and second, the agent performing the action.

Knowing BOTH parts critical. The owner and the agent. It’s what merchants will increasingly check at the storefront, and what will be produced in a dispute. Regular readers will know that I call some of this ‘OBO’ - on behalf of. A new type of verifiable credential that’s going to become as commonplace as KYC and AML.

Are you ready - the next ninety days

So far, so normal for the agentic commerce train that won’t stop. But what should you be doing about it?

Here’s what we are recommending to clients right now:

1. Get last month’s automated traffic numbers from your network. Your ‘edge defences’. Then split them out by what was challenged, what was blocked and what got through and served. Find out who you turned away and why.

2. Write down an agent policy, even if its a rough one. Are you going to admit, verify, limit or refuse, and on what evidence?

3. Make your ‘product truth machine’ readable - including the awkward attributes that customers ask about rather than the ones marketing likes.

4. Reconsider - and re-price - the assumption that your human customers will be patient and clumsy… vs dealing with agents that will sit in your online queue for a week. Think cancellation windows, cart and seat holds, one per customer limits and returns. Model your next sales drop with agents in the queue.

5. Decide where the record of a customer’s delegation will live, and who produces it in a dispute.

And here are two questions to ask your leadership team this week:

• Which of our commercial promises would become unaffordable if every customer exercised them with machine diligence?

• When an agent makes a mistake that reaches our customer, who inside this company owns the apology?

A new wind tunnel to find out

Gam and I have spent over 10 years preparing for this moment. Writing, consulting, persuading, explaining and advising on what’s about to happen. And how companies need to prepare.

Helping businesses work out what a trusted agent means for their marketing and operations, how to verify one, and what to change before they arrive at scale. From several hundred conversations with enterprise teams all over the world, very few have turned a plan into action.

While the agents were experimental, that was defensible.

But AI agents are being marketed to folks right now.

Invite codes are flying around like confetti. Gam and I are expecting at least 100M users in 2027. They’ll arrive with a permission slip in one hand and a payment card in the other.

Which is why we are launching a new Trusted Agents testing capability shortly. A ‘wind tunnel’ for AI agents. To see how ready you really are.

If you’d like to be involved in the pilot and launch, just reply to this email or drop us a note on LinkedIn.

Are you ready for Personal Agents? Really?

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

From the sublime to the ridiculous this week.

First off, we all knew it was coming. But I didn’t think it’d be here this fast.

This is a ‘hand with six fingers’ moment for real-time directed video. Where you can type any instruction into a prompt, and the next scene in the film is what you want.

Science fiction? It’s now here.

Given that these technologies are compounding, and these digital video capabilities are doubling every 9-12 months, you can imagine what will be available at the end of 2027.

Next, the security world fell apart with the latest open-weight LLMs being jailbroken. You need to be paying attention to Abliteration. Now anyone can get around the safeguards of the public models.

You can now demand that an AI does what you want. Not what the authors, owners, or the general public (and indeed lawyers) demand.

If that doesn’t make you feel all very Black Mirror, then grab a coffee and pour over the latest piece by Jakub Pachocki, the Chief Scientist at OpenAI. He’s not very optimistic about governing AI once it gets very much smarter. His piece is, uncomfortably, called ‘An Alien Mind.’

“I am concerned no one is prepared for the consequences of a continued rapid rise in machine intelligence.”

There’s a lot to say about OpenAI and its own hype machine, but this isn’t Altman on breakfast television. It’s the Chief Scientist saying that as models get smarter, it gets harder to track their logic and logging.

On this one, I don’t think this is hyperbole.

“Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer. I expect and hope for voluntary slowdowns to become commonplace until shared safety bars are established.”

Then, just to put a bow on the week, we’ve had a wave of Personal AI jazz hands:

• Apple updates Siri with AI, bringing some interesting Personal AI stuff (yes, privacy privacy privacy, on device, access to messages and calendar etc.).

• Meta launches a new Personal AI ‘Muse’, which is making waves (all the stuff you’d expect, bookings, calendar etc… but the twist is that a) they have billions of users already and b) they have Instagram feeds (so you can turn that social post into a recipe, create the shopping order, and pay with a credit card) and c) they have WhatsApp for Business (one tap on the newsfeed post about shoes becomes a WhatsApp message to contact the business directly… and Muse turn that message into an agentic request, and the shoes arrive the next day).

• New Silicon Valley darling ‘Instinct’ explodes onto the scene, but hits the skids around passwords and credit cards (predictably, as TechCrunch notes, they have “A broad, perpetual and irrevocable license to “access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify” any of the user’s materials, including for training its AI models”. They also capture screens, cursor movements, and keyboard inputs…. ah).

• Then enter state left, Stripe brings their ‘Link’ service to the party, a data store for your cards and passwords, with a pretty neat UX. Everyone is scrambling to make this stuff trusted, safe and scalable.

It’s all fun and games, if you are into this sort of thing (which I’m assuming you are, if you’re reading this far).

So into the new digital economy machine we march on.

More and more frothy tech announcements. A couple of fresh identity company hacks (100s of millions of identities once again spill onto the kitchen floor). A shiny Apple event. And then there’s the BigTech brotherhood driving with both feet jammed on the accelerator, while we’re in the backseat muttering about the handbrake.

And it’s only Thursday, folks.

All the more reason to start paying attention to the future of the digital customer.

So welcome back to the Customer Futures newsletter.

In this week’s edition:

• Sugar lumps, tonnes of CO2 and A4 paper - we need a new way to look at AI agents

• AI efficiency can’t be the only goal

• We are in a real bind with AI Agents

• … and much more

Let’s Go.

Sugar lumps, tonnes of CO2 and A4 paper - we need a new way to look at AI agents

It all started with a post about how much sugar is in chocolate spread.

This company is using sugar lumps, not ‘grams of sugar’ to make the point.

The very excellent Rory Sutherland jumped in on social to agree:

“If you think talking about grams of sugar is silly, think how dumb it is to talk about “tons of carbon dioxide”. Talking about gas by weight may be scientifically accurate, but it’s fundamentally incomprehensible to any normal person.”

Which got me wondering. Aren’t we doing the same with personal data and consent?

We’re describing the ‘risks’ and ‘consent’ and ‘terms’ and ‘data processing’ like we’re talking aobut grams of sugar. Nobody really understands what any of the words mean, nor the impact of making the ‘wrong’ choice.

So I wonder what the equivalent of a ‘sugar lumps image’ could be for personal data. What really happens when you click ‘I accept’.

Do folks really know how much ‘sugar’ (data) is in a digital ad, and what happens to that blob of personal information when it travels across the Real Time Bidding (RTB) network?

Johnny Ryan calls it the biggest data breach in history. And it happens billions of times a day.

If we can show people how many sugar cubes are in Nutella, could they be able to see how much personal data is in Facebook ad?

And if we think there’s already a problem with the ‘I accept’ confusopoly, just wait until the Personal AI platforms (Meta, Grok, Instinct and many more thousands coming) start telling us about the data they need to make the booking and why they need access to our emails and calendar.

Go read the privacy backlash around Instinct again.

Sugar in grams. Carbon dioxide in tonnes.

Maybe we could show the number of personal data attributes like a stack of A4 paper. Show how many specific data records are involved when you click ‘Consent’. Where each blob of data gets its own piece of A4 paper. This one has 2 pages, this one 17, and this one has 334.

One of your ‘A4 personal data files’ looks as thin as an envelope. Another looks as fat as a Harry Potter book.

We need a new way to talk about - and show people about - their personal data. And quickly, before AI agents make a real mockery of what consented data sharing looks like.

READ

AI efficiency can’t be the only goal

It all feels rather grubby talking about AI in terms of ‘efficiency’.

All the excitement is about how much AI can do, for how many tokens, how fast, how cheap, and what tasks will be replaced. You get to a discussion about job losses pretty fast.

Jory Des Jardins has been concerned about this narrow view of ‘AI efficiency’, and has come up with an excellent framework to describe and govern human agency in the context of AI.

“AI adoption is being measured by one metric: efficiency.

“That metric can’t tell you whether your organization can still catch AI’s mistakes, or whether the people who’ll need to make hard calls in five years are actually building that judgment right now.

I built Human Agency Architecture (HAA) — a governing standard that treats human judgment as infrastructure.

It’s excellent, and worth looking at in detail:

I love this bit (bold mine):

“Where current frameworks measure what AI does to productivity, HAA measures what AI does to people: their decision rights, capabilities, and capacity to flourish.

“It doesn’t ask organizations to choose between productivity and human capability; it gives them a way to pursue the productivity gains they’re already chasing while protecting the judgment those gains ultimately depend on.”

With a Customer Futures hat on, you can see that this applies to the customer side, the citizen side, too. What does customer agency look like when we are automating stuff on the side if the individual?

How much of our autonomy will be taken away over time? Will we really have control or oversight of the things our Personal AI does for us? Like switching home energy supplier, or moving bank account, or buying insurance? Will we even care about those ‘commodity’ parts of our lives, or will we just ask the Personal AI to do it - to ‘fire and forget’?

Efficiency can’t be the only goal.

Agency - and empowerment - must be central to how we apply AI to our lives.

Recommended reading.

READ

We are going to be in a real bind with AI Agents

Why do detectives at a crime scene collect fingerprints? It’s to ‘bind’ the person to the place. And why do bank robbers wear balaclavas? To avoid ‘binding’ their face to the scene.

If you want to borrow a large amount of money most banks will ask for two different sources of identity, both with address, and at least one with a photo ID. It’s so they can match the ID documents to your physical face.

It turns out that identity is all about binding.

A couple of years ago, a man in Mumbai took a single identity photo, and using different angles applied for multiple SIM cards.

Thousands of them.

“A total of 8,500 SIM cards were activated across Mumbai Metropolitan Region, using 62 different persons’ photos. While the names on Aadhaar were different, a single accused’s photo was used across documents.”

Why did the telcos not spot this fraud initially? Because those identities - those photos - weren’t bound to a real person.

Hacking and data breaches happen so frequently simply because our personal data is worth going after - it’s useful elsewhere. When bad actors present your stolen data to a business, for example to access your account or to open a new one, few companies check the binding of that data to a real person.

Most fraud happens because we don’t get the binding right.

Of people to companies. Of data to people.

If a business only needs to ask for my identifiers (mother’s maiden name, account numbers, date of birth, name of pet)… then anyone who has those pieces of information can pretend to be me.

Personal AI is going to make things much worse. And digital fraud and cyber attacks are already exploding.

For two reasons.

First, we’re feeding AI platforms vast amounts of personal data. Our financial transactions. Our social activity. Our contexts and needs. Our searches and interests and habits. But also our voices and faces.

In the wrong hands, these AIs will be able to create rich social media histories about you. Plausible online reputations. They can already generate life-like versions of your government documents, and your voice, in real time.

Without any ‘binding’ to the real you or your devices, that data can be presented to any business, anywhere online, and become a pretty realistic version of you.

But the second reason is a bigger deal.

As AI agents start managing your calendar, messages and interactions with businesses and other people. Grok Bot, Muse, Instinct are all sorted to be the next big thing in Personal AI.

But unless we can bind your Personal AI - your authorised agents and personal data - to the ‘real you’, we have a huge problem on our hands.

We won’t just need to prove that it’s you. We will need to prove that it’s your AI agent, your own bot, acting for you.

I’ve always liked the idea of ‘No data about me, without me.’

Without foundational digital identity infrastructure, available across sectors and countries, we’re going to find it difficult to manage the good (manage my calendar, email, messages and payments) from the bad (fake AI opening accounts, watching ads etc. in my name).

AI agents are not enough.

We need the full Trusted Agents triangle:

Delegation AND trust AND context.

And critically, we need the binding between them.

How will that work exactly? Well it’s being worked out. And it’s becoming clear that cryptography will play a big part. Trust registries, verifiable credentials, ZCAPs, UCANs and all the rest.

But we also need to bind these digital objects to the individual they belong to. Only then will we be able to trust it. Only then will we tell the real from the fake.

For example, my Personal AI can be bound to verifiable credentials. Those credentials can be bound to my digital wallet. And the digital wallet can be bound to me.

Very likely with a device. Probably your phone. Certainly with biometrics. A face or a finger to approve a transaction. Then that chain of trust - of cryptography - will kick in.

And once companies start checking the bindings - not just the data - we can unleash the true potential of AI agents.

Lower risk. Higher assurance. Lower cost. Higher trust. And more value.

Unless and until we can prove who is who, and what (bot) is what (bot), we are going to find it incredibly hard to trust these new personal agents.

‘No (agentic) data about me, without me’.

We are fast approaching the moment we need to separate out the ‘Customer-Present’ transactions from the ‘Customer-NOT-Present’ transactions.

But it all starts with the agentic triangle. And the binding across all three corners.

Without it, build digital trust from the ground up, we are going to be in a real bind with AI agents.

READ

A longer list of things to track

There are SO many interesting and important Customer Futures things happening at the moment. Here are just a few from my open tabs:

• Post: What happens when half of us are wearing smart glasses READ

• Announcement: The Federal Reserve, OCC, FDIC and FinCEN issue guidance on the use of government-issued verifiable digital credentials (VDCs) READ

• Post: Would you trust Zuck’s agent to manage your life? READ

• Analysis: Siri Recap is kind of a big deal READ

• Idea: Stripe’s president says the checkout page is dying READ

• News: Anthropic launches AI commerce agents with Mastercard, Visa and Accenture READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

Some brilliant stuff from Ben Affleck made the rounds last week on ‘AI taste’.

“Craft is knowing how to work. Art is knowing when to stop.”

He was asked about the AI disruption coming in filmmaking. He was pretty brutal about the shift, and the changes to jobs.

But not about art. And knowing ‘when to stop’.

My own work is being transformed. What used to take me 4 weeks, I can now do in 4 hours. Yes, the ‘task’ is changing. But my ‘work’ isn’t.

I often describe what I do as ‘helping turn on the lights’. Helping execs and teams see things they can’t today about the future of the digital customer relationship. And giving businesses a new framing for what is about to happen to digital and personal data, and how they can prepare.

Yes, I write about privacy, data, digital trust, and personal agency.

But my real work is helping people navigate what’s coming, and set teams on a new path. Hopefully towards the empowerment of people, passengers, patients, customers, parents and all the rest.

It’s weird though. So many people use AI to write their posts. To automate that task.

But writing is the work. It’s not just a task to be farmed out. As David Hieatt says, “you can’t outsource your pushups.”

As I’ve said before. Writing is easy. But ‘thinking’ is hard. And I’m here for the hard work. Not the automation of the tasks.

Craft is knowing how to work - and AI can write all day long. But as Affleck says, art - and from my point of view, helping turn on the lights for teams - is knowing when to stop. And creating a story to move people.

So maybe I’m actually in the ‘moving people’ business. And that’s not about writing more words.

So yes, AI is coming for your task. Not your job. But wow, jobs are going to change. And personal AI agents are going to be so, so central to that. I just don’t think people are ready for what’s coming.

Mad times.

So let’s jump in. In this week’s edition:

• Do you really want to build your digital private life in a 1994 chat room?

• Watermarks watermarks everywhere, but not a drop to drink

• The AI stormy weather - and the digital hurricanes - are coming

• … and much more

Let’s Go.

Do you really want to build your private digital life in a 1994 chat room?

First up, we need to agree that email is objectively awful to use. We end up Googling ourselves to find stuff:

“Receipt, car, has attachment, garage, repair.”

Second, your inbox is basically your to-do list organised by everyone else. It’s mad that we use it to manage our lives.

Third, it’s so bad, that young people increasingly see it as “the thing I’m forced to use by my boss.”. It’s no longer a place to communicate.

Especially with all the performative it-used-to-be-a-handwritten-letter nonsense.

“Dear X, blah, blah… kind regards…”

No, our chats have moved elsewhere, and email has become a utility. Oddly, and unexpectedly, it’s become the place we dump our documents, receipts, tickets and files.

Look again. Where do you actually keep your bookings, confirmation notes, tickets? Your calendar reminders? Your account renewal documents?

Me too.

Because the businesses we deal with can’t access our personal Dropbox or Google Drive, they send everything to our emails instead. And over the last 30 years, we’ve accidentally created an enormous, messy repository of our digital lives.

(Sidebar: there’s another round of uproar at the moment about Google reading our emails by default. Really? I’m shocked that there’s gambling going on in this casino! (Go ask Claude if you don’t get the reference. It’s a diamond of a film). You didn’t think that it was always happening quietly on that server in California? Didn’t you pay attention the first time, with all the BigTech privacy backlash? After Ed Snowden pulled the curtain back on PRISM and the NSA? For those who care about this stuff, check out the US Cloud Act. The geopolitics here are messy, fascinating and alarming in equal measure.)

Anyway, back to email as a file system, and what’s coming. Because AI agents are going to be a much better tool for the ‘help me handle all my digital stuff’ we have to deal with.

Soon, we won’t really care where the data is. We’ll just care that it’s safe, our agent can access it, understand it, and combine the right information at the right time.

There are some mind-blowing examples already showing up.

Here’s a good one about the latest Silicon Valley darling - Instinct - shared just this week:

“I have a chief of staff that reads my email, then a travel agent that actually runs the trip.

“Flight confirmation hits Gmail. Chief of staff pulls the confirmation code, connection, TSA PreCheck, carry-on only (it knows me), and drops it in a Travel Agency group chat with the job: night-before lounge brief, weather/traffic/FAA a few hours out, landing ping when I touch down to let me know where taxi or uber line is.

“It also builds the itinerary. Travel Agent hits the X API for what’s actually happening in that city that week, then turns it into a plan so I’m not googling “things to do” from a hotel bed.

“I landed at LGA at midnight in the rain. It already knew terminal, gate, skip bag claim, time to get home and that yellow taxi beat Uber because the stand is curbside and Uber was a garage walk in a surge.”

The explosion of possibilities hasn’t even started yet.

BUT… the invisible handbrake is still on. It’s our good old friend: digital trust.

You think email is trusted? Go ask your bank if they’re happy to send important information there. Nope. Instead they’ll send you an email telling you to check your inbox AT THE BANK. To log in over there.

That tells you everything.

We’re currently in the 1994 ‘online chat room’ stage of AI agents.

Yes, it’s all exciting, and all becoming possible at an explosive rate, but very little of it is genuinely trusted. Most of the people playing with this stuff are either technical or deeply into what’s coming next. 1994 chat rooms.

But this time it’s moving at warp speed. The consumer wave is about to break. At that point, I reckon ChatGPT becomes AOL. Maybe Yahoo.

We’re only using email because right now it’s the easiest place for an agent to find all the fragments of our digital lives.

But remember: email is neither particularly secure, nor particularly easy to use.

So now imagine agents crawling all over it. Fake stuff. Fake trips. Fake receipts. Fake people. Fake agents.

AI-enabled fraud is already a massive problem. And you think email is a great place to build the central brain containing my tickets, bookings, receipts and identity?

Folks, email is a stopgap. It works for now. But we’re building on sand.

Yes, some of the latest AI Agent rocketship startups will sizzle. Shooting stars. Amazing demos. Huge adoption.

But eventually we’re going to discover what breaks first.

Which is digital trust. And likely email as the file system.

Which means the next layer isn’t just better AI. It’s the hard stuff: around identity - asking which AI is this? Verifiable people and verifiable organisations - asking who approved this? Verifiable receipts and verifiable permissions - asking what can this AI do and how do we know?

Ultimately, it’s becoming fast about verifiable agents.

Because if good agents can crawl through your email and act on what they find, bad agents can too.

Yes, AI agents are fantastic.

But email is certainly not. And not as a universal file system for your life.

Do you really want to build your digital private life with the security model of a 1994 chat room?

READ

Watermarks watermarks everywhere, but not a drop to drink

This came in last week:

“Fable 5.1 also includes an imperceptible watermark, which the EU AI Act now requires of all AI providers serving the EU market.

“Output quality is unchanged, and the watermark contains no information about your organization or any user.“

Well. It turns out that digital trust is a thing. Who knew?

But I have a question. ‘Zero information about your organisation’… does that mean it can’t be correlated over time?

Anthropic says that the watermark is “a numerical way of determining the likelihood that Claude was involved in writing a piece of text”. In other words, each piece of AI text can be shown to have Claude’s fingerprints on it, but without revealing which Claude account.

But I’m asking something different: can it accidentally reveal that it’s the same source each time…?

It’s great that Anthropic’s approach doesn’t have any obvious identifiers about who produced the content. But presumably it contains common patterns or identifiers that can be mapped over time, correlating the place it came from?

Why does this matter?

Because right now, we need to know if things have been created by AI or not. And therefore who owns (or has copied) the content. Including checking who really wrote the document (I’m looking at you Deloitte and PwC… it’s worth 5 mins gawping at each of their very public blunders with AI-written reports).

But let’s go one step further.

Our AI tools are already being used to understand our ‘intent’. Capturing, understanding and broadcasting what we need right now. And creating a memory of all the things we ask about.

Meaning that all our AI inputs - as invisible as they are - will have traces of us within them. Just like your IP addtrsss gives away your location without you really thinking about it.

We should assume there will be AI digital fingerprints all over the place. Which - guess what - Fable and Mythos and Grok can pick up and correlate those signals in ways humans can’t. And do it at speeds that we can’t imagine.

Accidentally correlating who is who, and what has been asked for, is one of those unintended consequences that looks tiny right now. But will have huge implications over time.

Especially as we spill our private lives into these marvellous new AI agent creatures that are now crawling all over our digital lives and getting stuff done on our behalf.

The toothpaste is out the tube folks.

READ

The AI stormy weather - and the digital hurricanes - are coming

This week we heard about the early Facebook user who signed up in 2006 (when you had to use a .edu email) but just got locked out of her account. Permanently.

She just lost 20 years of her digital life.

It begs a deeply important question: Who gets to permanently lock you out of a social account, when your profile is the key to:

• Your social life

• Your personal data history

• Your connections to others (who you know, how you are connected, how often you connect etc.)

This is not a rant about sovereignty. And it’s not about control. It’s about having options. About choice.

Yes, you can download all your FB data. But notice that you can’t take your social graph. ie your connections, your relationships.

That’s actually the most important part. Who knows who and why.

Her account was at first frozen, then cancelled by FB, because of someone else messing about with a related other account over at Instagram. But using the same login and handle.

Imagine joining Facebook in 2006, building up 20 years of a digital life, then in 2026 getting your front door keys taken away because someone showed up at your house pretending to be you.

Why do we have to keep repeating the same lesson over and over again? Do we really want the ‘risk and safety bot’ in charge of 20 years of our digital lives?

Next up: your actual life is about to sit inside your Personal AI. Bookings, preferences, connections, therapy notes, work productivity, maybe even payments.

But then oops: “I’m sorry, we just locked you out because we saw some suspicious activity on your account.”

Oops indeed.

We won’t make the same mistake again, as we did with social media.

Right. RIGHT?

Put this point together with the first newsletter article above about email, and you can see that we need a rethink - a reboot - of how our digital lives are set up. What is stored where, who has access, what’s secure (or not) and how so can crawl over all of it.

I’ve been writing and talking about all of this since 2009. And it’s finally here.

But like climate change, it’s mostly invisible at first. No one carded about Meta locking you out in 2009.

But the impacts are real, and they are coming soon.

Gradually then suddenly.

A few people being locked out of social media here and there is like a small hurricane happening somewhere far away because of the warming weather. Far away enough that we don’t notice. Climate change we didn’t notice.

Until we did.

The world is heating up folks - and we are building out the digital economy on a few, fragile single points of failure that can shut you out without notice, and for no reason.

The AI stormy weather - and the digital hurricanes - are coming. And hurricanes don’t care if your building has good foundations and a sturdy roof or not.

I don’t know about you, but I’m getting a new house.

READ

A longer list of things to track

There are SO many interesting and important Customer Futures things happening at the moment. Here are just a few from my open tabs:

• Post: AI, tools and transformation (a must read from Ben Evans) READ

• Announcement: Live airline seats and booking in iMessage READ

• Post: An ID for every agent, or a mandate for every action? READ

• Analysis: A map of EU Digital Identity Wallet readiness for every EU member state (and other related countries too) READ

• Idea: Apple promotes a Global Trust Registry to recognise and verify trusted identities READ

• News: EMVCo publishes another Agentic Payments Framework - but with a neutral, interoperable layer for ‘managing consumer intent’ READ

• Announcement: Claude’s new Shopping Agent ‘that lives inside your app or website’ (a big deal) READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

This week I want to explore a simple idea that has been bouncing around my head for a while.

It’s a bit of a longer read this one, because what’s coming is fundamental to the digital economy. It’s about what I believe will happen with AI and AI agents.

Or more specifically, how.

We humans are not particularly good at predicting disruption. What will actually change. Not because we lack imagination, but because we always assume new tech will disrupt the products and services we use today.

The stuff we can already see.

But history reminds us that we usually fail to see the bigger shift coming, the unexpected twist. And it never ends up the way we think.

So today we’re going to dive into:

• We always predict the obvious disruption

• A missing ‘middle step’

• We’re making the same mistake with AI

• AI’s middle step will be ‘TRINCO’

• Exciting new possibilities

• Stop looking for the taxi driver

Let’s Go.

We always predict the obvious disruption

If you’d asked people in 1997 what the web was going to change most, newspapers would have been near the top of the list.

It was pretty obvious.

Publishing online was going to become much cheaper than printing millions of newspapers every day. All the costs of loading them onto lorries would disappear, along with delivering them overnight and hoping people would buy them the next morning.

The obvious disruption that folks saw was faster, cheaper digital distribution.

But it wasn’t just distribution. Because the newspaper industry wasn’t just built around printing presses and lorries. It was built around owning attention, and who controlled the discovery of news.

‘The News’ no longer arrived on your doorstep, but rather through exciting new chat rooms and ‘weblogs’ (now just ‘blogs’), then RSS feeds, then search, then Facebook and YouTube, then X and podcasts, and now TikTok and beyond.

Today, millions of young people consume most of their news without ever opening a newspaper’s homepage.

The stats of the shift are remarkable. In just over 10 years, UK weekly newspaper reach collapsed from 59% in 2013 to just 12% in 2025.

And today, 60% of people now use social media to get their news. In fact, in 2024 82% of 16–24-year-olds got their news through social media.

So the disruption to newspapers hasn’t just been ‘digital publishing’. It’s now a completely new model for discovery.

The same thing happened to music. In the early 2000s, the web looked like a better way to buy CDs. ‘An infinite shelf’ at Amazon, as Jeff Bezos described it.

Then slowly the web became a way to download MP3s and other media. But both ordering CDs and downloading music were basically just digital versions of music’s existing business model.

Same album. Different formats.

But then broadband beefed up, people got better laptops, and streaming became possible. And the economics of the entire music industry changed.

I love Ben Evans’ take on what’s happened to the music industry over the last 20 years. The question has shifted from “Should I spend £15 buying this album?” to “Should I spend £15 every month to access almost every song ever recorded?”

Streaming changed the game.

A missing middle step

What everyone missed in their early predictions was a critical ‘middle step’.

Uber is a good example.

Nobody saw the internet in 1997 and concluded that taxi companies were about to go out of business. That would have sounded ridiculous. Taxis didn’t run on websites.

But then the internet became mobile. Phones became location-aware. Payments became digital. And at the same time, reputation systems made it easier for strangers to trust and transact with each other.

Combined, these things became a new ‘middle step’ for the web. A fundamental transition for digital. And a whole bunch of new consumer features showed up that simply hadn’t existed in the ‘desktop internet’.

Around 2011, some folks gave this middle step a name.

Social. Local. Mobile.

And new generation of apps started riding the wave of ‘SO-LO-MO’.

Instagram was overwhelmingly Social + Mobile. Foursquare (remember that?) was a combination of Social + Local + Mobile. Uber was Local + Mobile, with networked identity and reputation tools so that strangers could trust each other.

My point is that the major tech disruption wasn’t just ‘the web’. It was the ‘mobile internet’. And a whole new set of building blocks for digital services.

The middle step of ‘SO-LO-MO’ triggered the next generation of apps. And those became the real disruption.

It’s why the impact of tech is so difficult to predict. We spend so much of our time looking at today’s products and services, while completely missing tomorrow’s building blocks.

We can’t always see the middle step that’s coming.

We’re making the same mistake with AI

Today, almost every AI conversation is about digital automation.

Which jobs disappear? Which repetitive tasks get delegated? How much customer service can AI handle? How much analysis and paperwork can AI complete?

Those are good questions, but they’re also obvious questions. They’re like asking about newspapers publishing on the web. As always, we’re talking about using a new technology (e.g. AI agents) to do the old thing better and cheaper and faster (e.g. customer services).

But history reminds us that the much bigger opportunity comes after the middle step arrives. When the tech gets some entirely new capabilities, and creates markets that didn’t exist before.

So the better question today isn’t “What will AI automate?” It’s about looking for the middle step. Asking “What is AI’s equivalent of SO-LO-MO?”

I think we’re beginning to see the answer.

AI’s middle step will be ‘TRINCO’

What’s today’s AI equivalent of SO-LO-MO?

I think it’s Trusted, Intelligent and Contextual. Let’s call it ‘TR-IN-CO’.

TRINCO.

Three capabilities that are emerging independently right now, but become hugely more powerful when they get combined.

Which is very soon indeed.

TRUSTED AI

For the last decade, most ‘digital trust’ conversations have focused on proving who someone is. KYC. Identity verification. High assurance. And with AI, we’re now excited about ‘KYA’. Know Your Agent.

What is what, who is who. How liability works when we can bind an AI action to a person or organisation. Yes, that matters. Deeply. But it’s fast becoming table stakes.

Because AI is now better at proving that it’s a person, than we are as humans. AI tools can already solve CAPTCHA puzzles, and produce deep-fake ID documents and liveness checks in seconds.

On the other hand, I can’t remember my passwords, routinely fail CAPTCHA, and I’m forced to use SMS as a second factor for some services. Bleurgh.

AI is now better at digital ID than I am.

But let’s go further. AI trust needs to be way more than checking an ID and KYA. It also need to include digital reputation, the commercial model of the AI service, if and how it is compliant with the regulations, its privacy policies and operations, if it has been peer reviewed, if it’s open source and so on.

Without trust, every AI platform, every AI agent, every credential and every piece of information becomes suspect. It’s why all my digital interactions are now guilty until proven innocent.

Why does this matter? Because once trust exists, something much more interesting happens.

INTELLIGENT AI

Of course, this is the tech excitement du jour.

Everyone is already obsessed with intelligence. LLMs, SLMs, RAG, cloud, government, sovereign, private, public, weighted, open, closed, biased, ethical, all the rest of it.

Just this week, Zuckerberg published his latest mega thesis for ‘personal super-intelligence’. And last time I checked, BigTech was spending $800Bn EVERY YEAR building the intelligence layer out.

It’s the smart stuff. The Reasoning. The Planning. The Acting. The Learning.

BUT.

While the AI models are all improving at an astonishing pace, intelligence on its own isn’t enough.

An intelligent agent with no trusted identity or reputation, no governance, no compliance and no meaningful context, isn’t particularly useful.

Which brings us to the third ingredient for AI’s middle step.

CONTEXTUAL AI

This is the part that’s massively underestimated.

Context means your current status and environment, your preferences, your previous decisions, your credentials, subscriptions, location, permissions and much more. Including of course your intent.

It’s your digital context that allows an AI agent to understand your situation and act appropriately on your behalf.

And that’s where digital wallets, portable data - this new category of ‘Empowerment Tech’ - become waaaay more interesting. Because digital wallets were never just about identity and trust.

They’re about portability. Meaning we can feed smart, rich and permissioned context to our Personal AIs too.

These three capabilities - Trusted AI, Intelligent AI, Contextual AI - are combining at an incredible rate. Compounding on each other.

TRINCO.

And together they are creating a new, transformational ‘middle step’ for AI. Just like the mobile device did for the web.

Exciting new possibilities

Just like SO-LO-MO unleashed the next wave of digital services, I’m seeing all the signs that TRINCO will do the same for AI.

Just think about energy switching for a moment.

Today, comparison websites help you discover offers. Tomorrow, your trusted agent will continuously monitor your actual energy usage, understand your preferences and values, discover new offers, negotiate with suppliers, prove it has authority to represent you, and execute a switch on your behalf.

TRINCO in a box.

But we can go further.

When your agent coordinates with hundreds of other community agents representing verified households in your area, and collectively negotiating a better deal at scale.

Funnily enough, group switching like this is already in place in the UK with Martin Lewis’ ‘Cheap Energy Club’… but right now it’s all manual. It’s run by humans.

Soon, we can automate those huge community deals with verified AI agents, and energy switching just got dialled up to 11. And who knows what happens after that.

Or take another juicy use case, one of my favourites. Insurance renewals.

Instead of filling in broadly the same forms every year, an agent will understand what you own, what has changed in your life, where you’re over-insured, where you’re under-insured, what risks actually matter to you, and which policies have conditions that don’t fit your behaviour.

Your agents will continuously scan the market, negotiate and return with recommendations you can approve. (Notice by the way I used the plural for agents. You’ll likely have hundreds of them).

My point is that most folks are still missing what’s coming. They’re often just getting excited because their annual insurance form gets completed faster.

But the real shift - after the TRINCO ‘middle step’ - is that a completely new participant, the customer, has just entered the market.

And they have trusted, intelligent context on their side too.

Stop looking for the taxi driver

And that’s the thing with trying to predict what’s going to happen.

We’re looking for the equivalent of the taxi driver. Which task gets automated? Which job disappears? Which workflow gets 30% more efficient?

But Uber didn’t automate driving.

It changed another part of the value chain. Discovery, dispatch, booking, trust and payment. And once that layer changed, the economics and structure of the whole taxi market changed with it.

TRINCO will do something similar to AI. And across thousands of markets, especially for B2C players.

The internet gave us the infrastructure. SO-LO-MO was a middle step that changed what could be built with it. And then came the companies we couldn’t previously see.

Insta, Uber, SnapChat and the rest.

I suspect we’re now approaching a similar moment with AI. While we’re still talking about automating tasks, underneath that conversation, a whole other set of agentic capabilities are bubbling up.

Trusted. Intelligent. Contextual.

TRINCO.

And just as the combination of Social, Local and Mobile helped unlock an entirely new generation of digital businesses, TRINCO will do the same for AI and agents.

If that’s right, trying to predict which of today’s jobs AI will automate is missing the much bigger story. We’re looking for the taxi driver. But we should really be looking for the smartphone.

The ‘mobile internet’ moment for AI.

I think it’s coming fast, and we’ll soon have new Trusted, Intelligent, Contextual AI tools in our pocket.

And folks won’t see it coming.

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

We’re jumping straight into the weeds this week.

It’s never been more important to understand the future of the digital customer. Welcome back to the Customer Futures newsletter.

In this week’s edition:

• Is the car the next browser for a privacy backlash?

• We don’t just have an AI data protection problem - we have an AI intimacy problem

• Your chatbot is building a model of you whether you configure it or not

• … and much more

Let’s Go.

Is the car the next browser for a privacy backlash?

Modern digital cars are already gathering a staggering amount of personal data.

Where you go. How fast (and how slow). Breaking patterns. How many people are in the car. In some cases, who is in the car. In some cases, what is said inside the car. Then there’s the biometrics (weight, driver blink rate, temperature and all sorts of funky stuff).

Samsung famously announced about the internet of things: if it can be connected it will be connected. So the digital - and now AI - age, we must also remember: if the data can be collected, it will be collected.

Ah yes.

Qn for you: When was the last time you read the privacy notice for your car? Me neither.

Fun fact: check out the T&Cs from Ford Sync, which records “Voice utterances” from anyone in the car when it’s in a certain state. .

“Ford’s Service provider 24/7 Customer, Inc. (”24/7”), may record and retain user voice utterances (”recorded utterances”), which are recordings of sounds made when SYNC Services is in listen state and waiting for a user command or response.

“These recorded utterances may include all sounds in the vehicle, including the voice of the user and voices of other vehicle occupants, while the service is in listen state. 24/7 may also, at Ford’s request, randomly record and assemble in sequence, all voice communications made from the time the Service is connected (by the user pressing the VOICE button) to the time the Service is disconnected. (”Whole call recordings (WCRs)”).

“WCRs will include voice utterances and may include any other sounds in the vehicle, including the voices of the user and other vehicle occupants, during the entire time the Service is connected. Both recorded utterances and WCRs may be associated with you or the cell phone number assigned to the Service.”

Hmmm

So what’s the equivalent of a private browser, but for a car? Incognito mode? Maybe even flight mode?

Remember the Good Old Days where not everything was a subscription, or being tracked every moment of every day.

The thing is, I probably want and need much of that car data. There are some important patterns in there to help with safe driving, managing fuel, personalisation etc.

But that data is for me.

Not for the insurance company. Or to help the manufacturer ‘improve the service’. And not when it’s just another API to feed the Hungry Data Borg. To help with risk pricing and accidental tracking.

But so far, so surveillance economy. Much as the EFF’s own research into car data policies uncovered a couple of years ago.

But now, ah yes, we have AI. And AI agents are about to do all sorts of interesting things with that data too. Automated service bookings, insurance policies, driver warning flags, hyper personalisation.

But in whose interests will those car-fuelled AI platforms be acting? The car is possibly the next browser in terms of the privacy backlash.

It’s just that folks aren’t paying attention yet.

READ, EFF PRIVACY REPORT ON CARS

We don’t just have an AI data protection problem - we have an AI intimacy problem

Another Ben Evans knockout insight recently:

“Playing with new Siri, it occurs to me that regulators are focussed on allowing you to install multiple assistants,

“But the more important competitive factor might be whether the individual apps allow access to competing assistants for personal context.

“Neither Siri nor chatGPT can see inside WhatsApp, and that’s not Apple’s call. And of course, even thinking about opening that up prompts about a dozen complex questions”

As I’ve been saying for a while. It’s not enough to be able to delegate to your Digital Assistant powered by AI. And it’s not enough to simply trust that personal agent with comfortable answers about the commercial model, the UX transparency, the data governance, the compliance and so on.

Your personal agent will also need portable customer context to be useful.

Rich and useful personal data from places like your bank, your travel app and your calendar. Your email, your OpenAI history, your browser information. Your location, your preferences and all the rest.

Otherwise all these digital assistants will become quite dumb. Or at least transactional. Stuck in a single lane, with a narrow view of you and your needs.

So while the regulators get excited about ensuring agents are compliant, we also need to be paying attention to the memory layer.

• Who has access to what?

• Why do they need it?

• What happens once the AI agent has completed its task?

From a data protection point of view, this needs to be as much about access as it does privacy.

When you game it all out, I keep coming back to the same point.With AI, we don’t just have a data privacy problem. We have an intimacy problem. Where your AI - and specifically your AI agent - will know you better than you know yourself.

And that’s harder to see, harder to regulate, and harder to catch and adjust as a consumer.

Ben Evans is right about regulators missing the bigger picture about customer context.

How long until my private, digital context can be portable too?

READ

Your chatbot is building a model of you whether you configure it or not

Paul Worrall is what Marc Andreessen calls an ‘AI vampire’.

Working ridiculously long hours with AI because, as Paul puts it:

“The tools are so compelling you don’t want to stop. Sixteen-hour days. All-nighters. Not because a deadline required it. Because stopping felt like waste.

“I am deep in flow with my agents”

Deep flow indeed. He writes brilliantly about his new AI-driven life, with a small army of always-on AI agents running his business.

And it’s just him as the human in the loop.

He has an AI CFO, an AI CTO, an AI COO and many more AI team members. He wakes up in the morning to find out that they’ve had a bunch of meetings, a fight about some topics, need his final decision, then off they go.

One of his recent posts gave us a glimpse of some of the fascinating impacts of an always-on AI operation:

“I was configuring Claude’s personal preferences — the prompt that shapes how it responds to you across every conversation. Instead of writing it myself, I asked the agent I’ve been working with for months.

“I chose to ask my agent to write it. Because who better to know me?”

The answer surprised him:

“Mild dyslexia. Don’t correct my typos or ask for clarification on them — interpret my intent and continue. I can read the output — don’t recap what you just did at the end of a response. Accuracy over positivity. Once I’ve decided something, don’t re-ask. Execute.”

Interesting because a it came back with a bunch of notes and preferences he never explicitly stated.

“The agent inferred them from how I reacted over weeks of working together. It noticed I get frustrated by summaries. It learned I make fast decisions and don’t revisit them.

“It figured out the dyslexia from patterns in my typing. Not just fat-fingers!“

Just think for a second about the implications.

Social media is sometimes called ‘Baby AI’. Only really used to predict the next post video or photo to put in front of you. Designed to keep you there and paying attention for clicks. But Baby AI only has a fractional view of the things you’re interested in. Who you know. And what you like.

Now deploy that more advanced model of you - a much more intimate model of you, seeing patterns you can’t see - like Paul’s writing habits - and drop it against the global commercial complex.

Against real time bidding for ads. Against government surveillance in the ‘regimes’. Against BigTech infrastructure that wants to ‘own’ the customer, and whose business models depend on your attention and intent… and you get something entirely different.

This is much less about data protection. The AI data security and protection toothpaste is now firmly out the tube. No, it’s much more about data intimacy.

As Paul points out:

“Your AI is building a model of you whether you configure it or not. The question is whether you take control of that model, or leave it to someone else to infer.”

So who are we really empowering. You, or who?

READ

A longer list of things to track

There are SO many interesting and important Customer Futures things happening at the moment. Here are just a few from my open tabs:

• Post: Within 20 seconds of taking a covert photograph with these glasses, a deepfake video can be generated locally on the phone in their pocket READ

• Article: We keep doing UK digital identity without doing digital identity, and now we’re even stopping that READ

• Post: Your sports team’s reach on social isn’t real anymore - you’re renting fake attention READ

• News: Brazil takes legal action against Tools for Humanity (World ID) and AWS, because 400k residents were paid to share iris biometrics without informed consent READ

• News: myID (was Australia’s MyGovID) is going to charge private sector to use it READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

This week we’ve had more hype, hubris and hysteria about the latest Chinese AI models (Kimi K3 looks astonishing), OpenAI agents jail-breaking their secure sandboxes (erm), and a whole bunch of exciting, if not confusing, news about digital ID.

I can’t say it enough, or loud enough. It’s never been more important to understand the future of the digital customer.

So welcome back to the Customer Futures newsletter.

I’m still writing these newsletters by hand, by the way. If that counts for anything anymore.

Not because I’m some laggard. Quite the opposite in fact. I use a vast amount of AI during my day. Token limits, pah.

No, I write because it helps me work out what I think. None of it is fully formed until I write it down. Until it spills onto the page. Or iPhone. Because you can’t get someone else to do your thinking. You can’t outsource your push-ups, as it were.

Along with plumbing and woodcraft, critical thinking, empathy and hugs might just be the only things we humans are left with after the great AI transition.

I don’t know about you, but I can start to see - and actually feel - the slow drift of brain numbness creeping in. As AI increasingly writes our words, reads our words and lobotomises our attention.

No, I’ve not yet started crafting bowls made of wood, or doing electrics. But writing seems to be more and more essential. Or at least the critical thinking does.

I guess what I’m saying is that writing is easy. But thinking is hard.

And for what it’s worth, writing this newsletter has been one of the most personally transformative things I’ve ever done. So thanks everyone for continuing to read them, and for being on the journey with me.

In this week’s edition:

• If we drop UK digital ID, how will we know which AI is which?

• Claude gets KYC - but identity was never the destination

• There’s a huge difference between a traveller and a customer

• Are verifiable credentials now boring?

• … and much more

Let’s Go.

If we drop UK digital ID, how will we know which AI is which?

Andy Burnham is now the UK’s new Prime Minister. And his first order of business? To scrap the plans for a government-issued digital ID.

Apparently:

“The time and resource that was going to be spent on a national ID scheme will go instead to where it’s most needed, such as helping with the cost of living”.

If only, if only, the comms and strategy for digital ID wallet had been clearer, and sooner.

I’ve written much more about the UK’s ID wallet comms fiasco before. I use the word fiasco, because it’s the very word that the government’s own investigation used to describe the launch.

“The government’s early attempts to set out its plans for digital ID were nothing short of a fiasco. To the public this announcement came out of the blue and made little sense.”

If you’ve now lost track of what the actual UK policy is, and why a digital ID wallet could be useful, I don’t blame you. It’s exhausting keeping up with the mis-steps.

Sarah Gold pointed out this week that dropping the digital ID programme doesn’t scrap the need for citizen identity. Especially for those parts of the economy that can’t have, or won’t have, a mobile phone, a driving license or a passport.

Well, we’re now set back a few years, at least.

Or are we?

Richard’s Oliphant made an important observation. That scrapping Digital ID doesn’t mean scrapping digital wallets.

“The furore over a national digital ID scheme has obscured the fact that Government Digital Service has been busy developing the GOV UK Wallet. This is an app that will be hosted on citizens’ mobile phones and will contain verifiable credentials (VCs) including a mobile driving licence and digital passport.

“These VCs will contain many of the same attributes that would have been provided by a national digital ID (name, date of birth, nationality, biometric photo). This workstream is separate from the proposal for the national digital ID scheme. I have seen no suggestion (as yet) that the GOV UK Wallet (+VCs) will be scrapped, and nor should it be.

“The UK, like other countries, must embrace trustworthy, cryptographic VCs for proving age, identity and eligibility in transactions and interactions – both online and in-person.”

So far, it looks like the wallet stuff, Gov.UK, has been left intact. It is a huge difference. And has huge implications.

Here’s my take: however you look at it, ‘Digital Public Infrastructure’ (DPI - think digital ID, payments and data) needs Digital Personal Infrastructure too.

Aka tools that live on the side of the citizen, the customer, the consumer. Aka wallets.

‘Empowerment Tech’, as some (well, I) call it.

Wallet or not, there’s another hidden knock-on effect of dropping digital ID that might be the most devastating. Impacting the £Bns of data opportunities that aren’t happening today because of a lack of a digital ID.

Including making customer data portable between providers. And across govt departments.

Because citizens are going to start - and have already started - using AI, and specifically AI agents, with their personal data. Already showing up at the front door of business and digital government.

Check out what Tom Loosemore is writing about. My favourite take of his:

“AI Agents will join up government before government joins up government”

Which mirrors my view: The customer experience is about to be disrupted… by the customer themselves.

Why am I banging on about AI again? Because we just accidentally killed off being able to answer a critical question: How will we know that any particular AI tool - and especially an autonomous AI agent - is working on behalf of the customer or citizen?

We desperately need new, smarter digital tools to trust people (which human?), systems (which platform?) and businesses (which company am I really dealing with?).

In other words, we need KYC + KYB + KYA.

The shambles of a UK digital wallet rollout - and this week’s ID scheme cancellation - has not only potentially put those wallet capabilities back a few years, but risks the UK growth agenda full stop.

Data is at the heart of the digital economy. And digital wallets - and digital identity - is what enables that data to flow.

So once again, it’s one step forward, two steps back.

UK GOV ID FLIP FLOP, RICHARD’S TAKE, SARAH’S TAKE

Claude gets KYC - but identity was never the destination

Anthropic can now ask consumer users for a govt ID and a live selfie before they are allowed to access some features. They’re using Persona, the same controversial platform chosen by OpenAI.

But Simon Taylor points out the obvious hole:

“KYC works on the people who were never the real problem.

“It filters the underage, the casually banned, the obviously sanctioned, the lazy. Useful, and it raises the cost of misuse at the margin.

“It does very little to the actor it’s sold to stop. A government ID won’t stop someone distilling a model through the API. It won’t stop a jailbreak. A state actor or fraud ring arrives with synthetic or stolen documents, the same way they already clear bank onboarding. OpenAI’s own developer forum has a walkthrough showing org verification is beatable.

“Finance is the proof. The most identity-checked industry on the planet, every account screened against a watchlist, every payment monitored.

“The world still launders $800 billion to $2 trillion through it every year. Under 1% gets seized.”

Exactly. But then he points out the missing piece of the jigsaw:

“I expect ID checks to go baseline across every frontier lab within a year. I also expect the real security fight to move to the model layer, where it belongs. And it potentially unlocks much more utility.

• Agents that can buy things

• Wallets and credentials

• Human "approvals' for AI tasks

Bingo.

“Wallets and credentials”. Exactly the opportunity. Because it would be ridiculous for the AI platforms to spend their time and money holding a vast range of ID data when they can just ask for the minimum data they need. Including citizenship if needed (without needing the address, for example).

What most folks miss is that wallets and credentials are soon going to be the new rails for AI agents. Because AI Agents are naturally decentralised things. Across borderes, across sectors, across use cases.

It would be ludicrous to assume there will be some central registry of ‘all global AI Agents’, a kind of database in the sky for all AI identity.

You see, KYC should never be the goal. ‘Digital trust’ should be. For people, businesses and AI. Which means more wallets and credentials ‘at the edge’, not more digital ID checks and spaghetti APIs everywhere.

In Fintech terms, for digital wallets and credentials, it’s still only 2014. But it’s going to happen quickly.

I can see a path to 300-400M digital ID wallets in actual use over the next 24 months.

Are you ready?

READ

There’s a huge difference between a traveller and a customer

A customer is someone interacting with one business. One transaction. One account. But a traveller is someone interacting with every business, across an entire journey.

Why should you care?

Because today’s ‘connected trips’ are actually pretty broken. Fragmented, repeated steps, bad data, poor handoffs, little personalisation and manual re-entry of the same data. Over and over again.

Think about it. A single international trip can easily involve seven or more organisations. Airlines, airports, hotels, rail operators, car hire, insurance, payments, border control and all the rest.

But the only true 360 degree view of the customer… is the customer themselves.

The traveler’s perspective is the only place where the whole journey exists.

Starting with the individual is the only way to stitch together the moments, the tickets, the reservations, digital identities, passenger preferences, bookings, reference numbers, travel connections and personal data etc

So the opportunity is to give travellers their own digital tools. Their own digital presence. Their own channel.

Meaning they can bring everything together, warpped around their personal needs, their identities, and their specific context. Making their data portable, uncovering new insights and smoothing out the experience on their side.

And soon… allowing software agents to do all that on their behalf.

Here’s my point. This can’t be achieved by a single airline, hotel chain, social platform or backend integration alone. It can only be achieved by the individual. From their POV.

Ironically, the very fragmentation of a trip is what makes travel and hospitality the most likely place for a new digital wallet to emerge.

And it feels inevitable.

Why?

Because a wallet benefits everyone.

For the traveler? It’s seamless connections, more convenience, less time wasted, new insights, less stress, and a better CX. And for the business? It’s smarter personalisation (without being creepy), whole new revenue models, and even lower fraud.

This idea of ‘passenger-not-just-customer’ is already showing up in a few places. In the EU, the Digital Identity Wallet roll out is underway. And one of the marquee cases? Travel and hotels. Proof of identity for bookings, check-in and transfers.

And in India, the DigiYatra app has been used by over 75M people for seamless travel across a range of airports. All using a portable digital identity wallet under the control of the passenger.

Across the global airline industry itself, the IATA OneID programme has already defined, and is now rolling out, digital wallet features for passengers across multiple countries, airlines, border crossings, airports, and even retailers.

One of the first passenger credentials? ‘Needs wheelchair’.

I love that. Remember, wallets don’t just need to be about identity and all sorts of heavy lifting with age and address and all the rest. Sometimes the simplest use cases and the most important, and the most valuable.

Proving you need a wheelchair is precisely an example of creating value across a fragmented trip. Where today, every organisation can only see one customer, in one context, in isolation. By definition, they can’t see the whole trip.

It’s about giving the data back to the individual, to share with every business that needs it, on their own terms. Enabling a whole new passenger experience, smoothing out the broken steps, and making the trip smarter at every turn.

Now look again…

You’ll soon see this same model - of Empowerment Tech, where the individual is at the centre of the experience - show up everywhere.

Are you a bank customer, or a couple buying a house? Are you a train ticket customer, or a family going on a holiday? Are you an insurance customer? Or someone who’s just had a flood and moving home? Are you a ticketholder in RowJ Seat29, or someone who has been following the band since their first gig?

I just don’t think folks are ready for what’s coming.

READ

Are verifiable credentials now boring?

Many scoff at the the Gartner Hype Cycle.

And somewhat reasonably. Go back 5-10-15 years, and see how many of their expectations have been spot on for any particular innovation. Maybe a couple?

But this is a great catch from John at Sezoo:

“Whether you believe the hype cycle or not, it’s still somehow pleasing to see Gartner showing Verifiable Credentials leading on the slope of enlightenment.

“Some of course have been enlightened for longer than others.

“Verifiable Credentials have been the fuel for much our work over the last decade. Right now W3C VCs are an essential ingredient for the UNECE-UN/CEFACT initiatives such as United Nations Transparency Protocol, Global Registry Information Directory, and United Nations Verifiable Trade Documents.

“As should be apparent from that list, the socio-economic value of Verifiable Credentials is way way more than “just” digital identity.

“Gartner’s report is understandably limited by its title, but verifiable credentials don’t start, or stop, with digital identity.”

Yup.

Enlightenment means starting to be accepted. It means starting to become common.

It means starting to be boring.

Having spent 10 years talking about verifiable credentials, writing about and presenting on them, designing and shipping products with them, and selling VC technology all over the world, I’d agree with the Gartner position.

Right now, maybe only a few folks are actually enlightened, as John says. But it’s the concept of VCs is spreading like one of those great breakthrough ideas of our time. Once you see it, you can’t un-see it.

Oddly, I’m betting that AI agents will use them at scale before humans do. Check out what Mastercard and Google around ‘Verifiable Intent.’

Enlightenment indeed.

JOHN ON GARTNER, VERIFIABLE INTENT

A longer list of things to track

There are SO many interesting and important Customer Futures things happening at the moment. Here are just a few from my open tabs:

• Post: What if Credit Unions have been building tomorrow’s trust infrastructure all along? READ

• Article: I got my AI agent to sort out the Wise payment transfer to Denmark READ

• Post: What if your AI guardrails are already obsolete? READ

• Opinion: Here’s what critics of digital IDs skip… the tracking they fear is already here, and not just from advertisers READ

• Article: The biometric photo in the PID (EUDI Wallet) is becoming mandatory… Except it is not READ

• Opinion: Context is rapidly becoming the most important signal in security READ

• Post: The Court Ordered Zuckerberg’s Team to Take the Glasses Off - That Should Tell You Everything READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. Digital wallets, Personal AI and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

Another Customer Futures Conversation for you. Today we’re diving into the unexpected world of digital signatures.

But first, some context.

I’ve been thinking about something counterintuitive for a while. In the search for a magic answer around the adoption of digital ID tech, I wonder if we are looking at it all wrong.

What if we don’t start with digital identity at all?

Don’t start with digital ID strategy. Don’t start with digital wallets and credentials. Don’t start with identity verification platforms, or multi-year transformation programmes.

What if we start somewhere else, with a different - but still expensive - problem inside the business?

Because one of the biggest mistakes organisations make is treating digital ID as a destination. Something that requires a strategy, a roadmap and years of customer adoption.

The result is almost always the same. Lots of discussion, a bunch of politics, lots of planning, and over the years, little progress.

What if there was a simpler way in? What if digital ID arrived automatically, through a different customer interaction… and one that already exists?

Which is why I want to talk about digital signatures.

They don’t get much attention.

They’re usually viewed as the final step in a process. The admin, the compliance hoops, the detail that happens after the important work, like the sale or the onboarding, is finished.

But look closer, and something interesting happens. Because the signing moment is often where customer identity matters most.

Why?

Most banks have spent years improving their digital onboarding. ID verification, KYC, fraud controls, risk scoring, customer decisioning and all the rest of it have all become increasingly sophisticated.

The front door has now become heavily protected. Rightly.

But the actual business risk - the thing that sits on the balance sheet for the next 20 years, literally the entry in the company ledger that says this customer is safe - is rarely the onboarding check.

Rather, it’s the customer’s signed contract or agreement. That’s the object that really matters.

So what? Well that’s now an interesting gap.

Look again. Identity is almost always verified at the beginning of the journey. When the checks are completed, and a lending decision is approved or whatever.

But the agreement itself - the loan, the insurance product, the rental, the healthcare plan - is often signed later. And almost always through a separate process - and under a different level of assurance.

In other words, the business gets strong identity when the customer joins. But then weaker identity at the point of commitment.

How do we know it was the same person?

It feels a bit weird.

And when those agreements, those contracts, are later challenged, few people ask whether onboarding happened correctly 5 years ago. They ask simpler questions about the agreement: Who signed this? Can you prove it? Can you prove what they signed? Can you prove the document hasn’t been changed?

It’s where Qualified Electronic Signatures (QES) become interesting.

They are a higher standard of digital signing than just the ‘finger wiggle’ in a browser. And they are going to matter more than people realise.

So in today’s Customer Futures Conversation I’m joined by Jon Evans from Digidentity.

We spent 30 mins digging into digital signatures, and why QES could be a sleeping tiger in the digital identity world:

• The importance of assurance in digital signing (06:25)

• The implications of Qualified Electronic Signatures (09:58)

• Transforming home-buying with a digital signature (15:59)

• The role of digital wallets in signing (20:36)

• Digital signing + digital wallet = Swiss Army Knife (25:27)

• Where businesses should start (27:17)

You can find the full recording here.

But there’s one more thing to say. Because with a QES, you get a digital ID check at the same time.

Which means there’s another twist.

The digital ID created during a QES transaction can become portable. It can be reused elsewhere across the organisation.

Maybe to onboard the individual to a different product. Maybe to reduce some repeated ID checks. Or to ‘re-KYC’ a customer without having to get them to jump through new hoops.

In other words, the business gets a signed agreement today AND a reusable digital identity asset tomorrow.

That’s a much more interesting outcome than simply replacing a ‘wet’ signature.

In Europe, the ‘eIDAS2’ digital ID programme talks about digital signatures as part of the EU’s Digital Identity Wallet, set to be rolled out to 400M citizens over the next few years.

But how many of the EU’s 27 member states (or the 1000s of private sector companies involved with eIDAS2 for that matter) are making digital signatures the central use case to drive adoption?

I do wonder if we’ve become too focused on the grand destination of ‘customer digital ID’. And not focused enough on how organisations can actually get started.

Which might not be with digital identity at all.

Maybe digital identity won’t arrive through a customer onboarding platform, another data transformation programme, or your government’s new Digital ID Wallet initiative. Maybe it shows up through the thousands of customer agreements that businesses are already processing every single day.

Jon and I have written a short paper about exactly this: on QES, on not starting with digital ID, and on why businesses, especially banks, should be looking at signatures differently.

You can find the paper here.

I believe that digital signatures are one of the most important adoption paths for digital identity that nobody is talking about yet.

A sleeping tiger of digital ID transformation. And I’m excited to see what happens when that tiger wakes up.

I hope you enjoyed this Customer Futures Conversation as much as I did. Stay tuned for more episodes coming soon.

There’s never been a more important time to shape the future of digital ID. So welcome back to the Customer Futures newsletter.

Grab 30 minutes, your headphones, and Let’s Go.

You can catch up with the next episode, and all Customer Futures newsletters here, and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

Three simple stories, and three simple takes for you this week:

• It’s time for digital trust to be as hyped as AI itself

• Is BankID ready - or able - to adjust to what’s coming?

• AI Agents are going to need their own identity and their own money

• … and much more

It’s never been more important to understand the future of the digital customer.

So welcome back to the Customer Futures newsletter.

Let’s Go.

It’s time for digital trust to be as hyped as AI itself

It’s weird to say that AI is both over-hyped, and yet under-hyped at the same time.

Why?

Because at the lower levels of the AI stack, the market is already wide open. RAG frameworks, foundation models and GenAI platforms are rapidly becoming commodities.

Open-source alternatives (especially from China), now compete with many of the industry’s best proprietary models (especially from the US).

And at that level of AI, the market is starting to look like a utility, rather than a differentiated software category.

Sam Altman already thinks that LLM-based intelligence will become so widespread, so cheap and so part of everyday life that AI will eventually be as common as electricity.

And that’s the snag.

Can the AI Majors really sustain - and recover - the $800bn of annual investment in a market where the main products are trending to free?

Over-hyped.

But higher up the AI stack, ‘above the waterline’ towards AI agent systems and personal agents, it feels like things are under-hyped.

I don’t mean that there aren’t frothy predictions about the $Tn market about to be ‘unleashed’. Or that AI agents won’t be freely available and embedded into pretty much everything.

It’s because we simply have little idea what happens once Personal AI agents start to act on behalf of people at scale. How disruptive they will be to today’s customer experiences, customer relationships, and to every company’s digital and data processes.

And not just for AI payments (all the ‘Agentic Commerce’ stuff). But all the rest of your customer interactions.

From bookings, upgrades, account management and onboarding, to complaints, product discovery, loyalty and customer services. And so much more.

Under-hyped.

And yet what’s the barrier to all that value being created?

Digital trust.

Here’s the picture we use at Trusted Agents to explain what we mean.

Yes, trust means security, privacy, audit and governance. But it also needs to include new trusted commercial models, new delegated user experiences, and new levels of data transparency and control.

Trust is going to be critical to AI Agents taking off. To scaling across the economy. And it’s precisely why Gam and I set up Trusted Agents in the first place.

Anyway, it’s one of the reasons I pay attention to things like Experian announcing ‘Agent Trust’. And not just their announcement. But their partnership with Skyfire (leading on ‘Know Your Agent’ trust) and Cloudflare (leading on internet network trust).

Quite a global combo of capabilities.

From the announcement:

• Skyfire’s KYA protocol issues signed JWTs with verified identity and payment claims for each agent

• Experian’s Human-to-Agent Binding enriches those claims against its consumer identity data and issues a real-time trust score

• Cloudflare validates the trust signals at the network edge, before requests reach the merchant’s origin

They are bang on-trend, of course.

Because every identity, wallet and trust company has now pivoted to being an agent-identity company, an agent-wallet company, and an agent-trust company.

Quite sensibly. ‘Skate to where the puck is going’ etc. And now the market is heating up, it’s going to be a real zoo of new customer capabilities.

Some things will fly, some will swim, and some will walk.

From on-device Personal AI and agent registries, to agentic identity wallets and identities for AI systems. From verifiable credentials for delegated authority and portable customer AI ‘memory,’ to digital wallets for AI authentication and ‘proof of human.’

From personal data binding for AI agents and new open protocols for digital trust (not just payments), to new ‘fiduciary AI’ commercial models and zero-knowledge AI auditing so we know what data has been shared by which AI agent, where, why and how.

Woof.

I’ve never been more excited about what’s about to emerge next.

It’s why it’s time for digital trust to be as hyped as AI itself.

TRUSTED AGENTS, EXPERIAN’S AGENT TRUST

Is BankID ready - or able - to adjust to what’s coming?

Apparently there were 1,054,521 bank account ‘switches’ in the UK during 2025. Someone moving their bank account to a new provider.

Hooray for customer empowerment! Hooray for an open market of providers that provide real customer choice!

But hold up.

Retail Banker International has done an analysis of those UK switching stats, and say that only around 2.5% of UK adults switch their primary account each year. You can put the Pom Poms down.

Because it means that 97.5% of people didn’t switch. And more interestingly, means that consumers only switch their bank account every 20+ years.

Let’s take a different view: It means that the banks should know you pretty deeply as a customer.

20 years is a TON of data about your life. Where you live. How much you earn. And in today’s world of digital money, how often you pay for things, where you shop and who you send money to and how often.

It’s why for the longest time, banks have assumed that they should be the logical source of truth for customer identity. ‘Heir apparent’ to the next wave of digital identity.

Two of their better arguments are that banks are regulated, in ways that many of the other identity providers in the market are not, and that consumers mostly trust bank brands over other businesses.

CRIF says that in Europe, 62% of consumers trust their financial services providers. In the US it’s 72%. So, FS providers argue, our banks should become a universal identity provider, right?

Maybe.

Yes, while most people ‘trust’ their bank, the stats for ‘looking after our personal data’ is less good (that’s one for a whole other post). But more importantly, each bank can only reach some parts of the market.

Meaning that each country would need to 1) standardise what ‘Bank ID’ means, 2) build out a banking network where we can rely on any bank’s data to prove who we are.

Which is exactly what’s happened in a range of countries, where BankID is a huge part of the identity market.

But why has it taken off in some places, but not others? It’s because two things must be true.

First, a small number of banks need to cover most of the market. It’s why we see thriving BankID networks in Sweden, Norway, Canada and Belgium. But not in the US or Brazil.

But the second thing that needs to be true, is that those banks need to get on with each other. Which is why it’s taken much longer to agree what BankID looks like in the UK, Germany and Australia.

In each of those counties, a handful of banks enjoy huge market share. But they’ve just not been able to collaborate enough to get something off the ground, even though there have been many, many attempts over the years.

Which brings us to today, and the UK. Where it now looks like the banks have finally got there on BankID, after many years of false starts.

Barclays UK, HSBC, Lloyds Banking Group, Nationwide Building Society, NatWest Group and Santander UK are getting together to develop a financial services-led ‘digital verification service.’

But what interests me most is the timing.

It’s arriving right when digital wallets and portable digital ID are becoming a thing. And from multiple different angles.

At one end of the market, the UK Government is launching digital ID in a ‘GOV.UK Wallet’. At the other, you can see a path for Apple and Google to arrive with a verified ID in their respective wallets. (Yes, they’ll also need to be certified like the rest of the market, just like in the EU, but they are already on the march, and have already activated wallet-based ID in a number of major countries and US states).

It’s about when wallets arrive, not if.

And in the middle of course, there’s everyone else. The UK apparently now has over 200 identity and trust providers, of which only 50 of are certified against the government’s own Trust Framework. That’s one certified provider for every 1M UK adults.

Side question: what’s the collective noun for a group of identity providers… a proof?

So will the UK banks be successful this time? Potentially.

They have the reach, they have the brand awareness, and so-called ‘trust’. But critically, they also have a consumer who’s already comfortable using open banking.

Today, if you need to verify a payment while using a shopping app, you can just jump out of the merchant app experience, approve in your bank app, and bounce back. It’s become a UX familiar pattern.

And that matters A LOT when you are getting customers to change their behaviour.

So I can see UK BankID having some success.

The question is if the ‘bounce out of this app and approve’ flow will become more dominant than an ‘embedded identity’ flow, where the digital ID wallet players can make identity part of the merchant’s own check out.

Like with Apple and Google, and soon the other digital ID wallet players that can embed digital ID within an app.

It’s why I believe ‘Embedded Identity’ will become a whole thing itself, just as ‘embedded finance’ has become. And I wouldn’t bet against the BigTech players if they can get certified in the UK.

Plus, if the UK Government can get its act together on the rollout and comms of the UK digital identity wallet, it would become the highest assurance digital ID in a portable wallet out there, rolled out in parallel to the EU Digital ID Wallet.

So it’s all to play for with the Banks. And for BankID in the UK.

Pay with your bank. Log in with your bank. Now verify yourself with your bank.

Yes, the UK banks involved with BankID already cover most of the UK market. That’s step one done. And they’ve now shown that they can finally get on with each other to make it happen. Step two.

But wait…

What about all the heat and light coming from the AI providers? We are going to need ever-more proof that our AI agents are connected, verified and authorised by a real human.

Most of whom will be verified bank customers.

So can we add BankID to AI flows? Will AI agents be able to connect back to a BankID app to approve Agentic Commerce? Step up to an authentication for a live selfie using my mobile bank app?

And beyond payments, could BankID become a ‘control panel’ for handling AI Agent approvals more generally? Lots to chew on.

It all begs an important new question: is BankID is ready - or indeed able - to adjust to what’s coming?

READ

AI Agents are going to need their own identity and their own money

One of the reasons many people are mis-reading what’s going on with AI agents is that we’re not using the right tools yet.

Today, we’re retrofitting AI agents with yesterday’s infrastructure. For payments, we’re giving agents virtual cards. For identity, we’re connecting them to existing platform accounts. Yes, that gets us part of the way there. But it also creates clumsy experiences, brittle permissions, and a thousand new opportunities for fraud.

So you need to be paying attention to the x402 protocol.

It was baked into the original design of the web, and allows for web-native payments. But it was never activated.

Now HTTP 402 can let services request payment directly inside the web request flow. It’s being governed by the Linux Foundation, and is being backed by the big guns. Coinbase, Cloudflare, Stripe, Visa, Mastercard, American Express, Adyen, Fiserv, Circle, Amazon Web Services, Google, Microsoft, Shopify, Solana and Polygon Labs among many others.

But what about digital identity? It’s an old truth that ‘the internet was born without an identity layer’. It’s why we have such a Frankenstein’s monster of a digital economy today.

Half-living digital identity documents that have been scanned and then tampered with. Uncanny deepfake video streams that pass KYC checks. Creepy sounding voice clones that are like us but not like us.

And why we’re still sending pictures of our identity documents over email.

But now Daniel Buchner and the team at Proof have introduced x401. A path toward web-native identity. Like x402, but where a digital service can ask for a verifiable proof before allowing access.

Not another login button, not another identity workaround, but a native trust layer for the agentic web.

“Today, the mechanisms for presenting identity credentials all assume a person is actively using the UI of a web page or app that requests a credential. AI agents have blown this assumption away.

“Enter x401, a machine-friendly protocol that leverages existing technologies (OIDC4VP, W3C Digital Credentials, and W3C Credential Management) to enable AI agents to detect requests for any form of digital credential (Verifiable Credentials, Passkeys, etc.) and utilize them within the agentic experiences users are relying on more and more every day.

“The internet got its payment layer with x402, but it came thirty years after it was first envisioned.

“Let’s not make the internet wait that long for the HTTP-native identity mechanism it needs in this age of AI.”

Daniel has deep roots in the identity and wallet world. And you should be following this development. Not least because it’s with input from some heavyweights across the AI, wallet and credentials industry, including MATTR, Okta, Circle, Lightspark and OpenAI.

Exciting times.

AI Agents are going to need their own identity and their own money.

Are you ready?

READ

A longer list of things to track…

There are SO many interesting and important Customer Futures things happening at the moment. Here are just a few from my open tabs:

• Opinion: The “Transatlantic Data Protection Framework”, covering EU data transfers to the US - is dead READ

• News: The UK will now allow digital age checks for alcohol purchases READ

• Article: Who Does The Agent Work For READ

• Post: You are statistically more likely to survive a plane crash or get into Harvard than to intentionally click on a traditional banner ad READ

• Post: The payments industry solved transaction trust years ago… AI is forcing us to solve identity trust next READ

• Article: Coinbase is going all-in on the Agentic Economy READ

• Opinion: The First Source of Personal Intent READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Hi folks,

Gam Dias’ recent piece for the Trusted Agents newsletter was about goats.

Why?

Because he wanted to make a point about customer loyalty.

The goat in the picture above doesn’t stay because it loves you. It stays because you tied it to the post.

“You have a CRM and you call it a relationship. A points scheme you call loyalty. Retargeting you call a bond. But none of it was loyalty. It was just a rope. You see, comparison took effort, switching was a hassle, and your customer could not be bothered.

“You read all that friction as devotion.”

Bang on, as ever.

But there is something else afoot.

I bet you didn’t notice something pretty important last week. We crossed an important milestone for the digital economy.

According to the Cloudflare CEO Matthew Prince, automated traffic now accounts for about 57% of HTTP requests. While human-generated traffic has fallen to 43%.

This is the first time machine traffic has consistently exceeded human traffic on the web.

Most of it was bog standard AI crawlers of course, not an explosive wave of AI agents shopping on behalf of people.

But.

You need to think carefully about what it points at.

Because the day your customer hands the comparing task, the switching task, to an agent, the rope is cut.

A Personal Agent will check every price, every review, every return policy, and it does not care that someone has banked with you for eleven years.

Nor will the AI watch the superbowl ad, or be nudged into an emotional purchase by the picture of grandpa or the kids.

As Gam reminds us, loyalty is not a thing you store any more.

It’s a new digital vote that’s cast by a very patient piece of software, making better decisions than the customer can, 24/7, faster, with more data, and sweeping across most of your competitors before your marketing team gets out of bed.

Goats eh?

One to think about as you design your latest digital transformation to ‘own the customer’.

It’s never been more important to understand the future of the digital customer.

So welcome back to the Customer Futures newsletter.

In this week’s edition:

• Getting your (ID) message right is WAY more important than your (ID) tech

• What if an organisation holds too much trust?

• Your biggest AI challenge isn’t the model - it’s getting personal data into it

• … and much more

Let’s Go.

Getting your (ID) message right is WAY more important than your (ID) tech

If you want a textbook example of how NOT to explain and promote digital ID, look no further than the UK government.

Which is ironic, because only six months ago, it was on the path to launching a digital identity wallet that can hold a range of useful citizen credentials. And was framed about digital growth, citizen empowerment and data portability.

And yet.

Only months later, it was an omni-shambles of a comms screw up.

So bad, that a government body had to look into what went wrong, and what to do about it.

Ladies and gentlemen of they jury, I give you: the UK Government Home Affairs Committee’s latest report into the recently announced launch of digital ID...

“The government’s early attempts to set out its plans for digital ID were nothing short of a fiasco. To the public this announcement came out of the blue and made little sense.

“It raised fears of government over-reach into people’s lives and was so poorly thought out that they had few answers to ease these concerns.

“It is worth bearing in mind that this was a policy direction that was generally well received by the public before they were spooked by the government’s poorly thought out and badly explained plans.

“Ministers have rightly gone back to the drawing board and begun the difficult task of rebuilding trust in what has the potential to be a valuable tool for government.

“Alongside potential benefits remains the potential for significant changes in the way people access services or interact with the state. That is why government must include voices from across society in deciding the direction of digital ID.

“Each element of its future digital ID strategy must have clearly defined aims, a comprehensive plan for delivery and strong safeguards. Any future mistakes might prove fatal for public confidence.”

The fact that the UK Government’s plans include digital wallets, verifiable credentials and an open standards-based portable digital identity is lost in the noise.

I first pitched the UK government about this approach six years ago.

They’ve finally got the tech approach right. Maybe in another six years they will have worked out how to communicate it.

Bonus read: the excellent Richard Pope’s view on why they got it wrong, and the 7 messages that would have worked.

UK GOV COMMITTEE REPORT, RICHARD’S PROPOSAL

What if an organisation holds too much trust?

Great question this week from Sarah Gold. Recommended reading on ‘Just Enough Trust.’

“Organisations generally want to gain people’s trust, and maximise this to the greatest extent possible, but what we’ve found during our decade working on this issue is that this is the wrong goal.

“A system people trust completely and without question is as dangerous as one they don’t trust at all.”

READ

Your biggest AI challenge isn’t the model - it’s getting personal data into it it

Much of the emerging Empowerment Tech stack requires the movement - the transfer - of personal data.

Because

• Personal AI needs personal context

• Digital wallets need credentials

• Personal data stores need data sources and imports

• Agentic commerce needs permissioned access to user data

It’s becoming obvious that the biggest barrier to the AI economy won’t be the AI itself.

Because there are now plenty of good-enough (by which I mean mind-blowingly clever) AI models, many of which are open source, low cost, and even on-device.

No, the challenge will be getting the data into them in the first place.

So if you’re not already following the work of the Data Transfer Initiative (DTI), you should be.

Did you know that over 70 jurisdictions now give individuals a legal right to data portability? And over 140 have data protection laws covering it?

Personal Data Portability is becoming a global expectation, not just a European exception.

The DTI is a world-leading organisation with experts on all things data portability, not only shaping and helping deliver the regulations that mandate customer data transfers, but building the critical frameworks and infrastructure to make it possible.

Inevitable, even.

And the DTI has become increasingly vocal about AI because personal data portability is likely to become one of the most important pieces in the AI economy.

The very definition of Portable Customer Context that AI needs to thrive.

You can already feel it coming.

Your AI digital assistant gets super-powered when you can:

• Move your Gmail history into a portable customer memory layer for applications and services to access, not just Google

• Move your purchase history from Amazon into another marketplace service

• Move your travel data into a trusted journey management and expenses app

• Move your ‘social graph’ (i.e. who you know, how often you communicate and all that metadata about your social life) into a new, less spammy private network

Without data portability, the incumbents - meaning the BigTech players, the data brokers and all those data intermediaries - keep their data moats, their data advantage.

But with new, real-time and meaningful data portability - much of which is now mandated in law around the world - new entrants can compete. And exciting new digital services can emerge.

It’s why the DTI’s work to coordinate and ship open-source infrastructure for data portability is so important.

Powering the likes of Google’s Data Portability API, Facebook’s Transfer your Information, and Apple’s Data and Privacy page.

Yet while most people see the DTI as a data portability initiative, I think they’re building something much bigger. Because they are starting to solve a governance problem that the agentic AI world doesn’t yet realise it has.

Right now, agents are sprouting like weeds. And every week there’s a new model, a new framework, a new startup, a new gateway, and a new agent marketplace. And naturally, much of the conversation has focused on identity. How does an agent identify itself? Who is it acting for? How do I know it’s really my agent?

Yes, these are important questions. But hidden underneath every identity question is really a trust question.

Because an agent can identify itself perfectly and still be dangerous. An agent can authenticate flawlessly and still misuse data. An agent can prove who it is while remaining entirely untrustworthy.

As the number of agents explodes, trust will become even more important than identity. Trust is what allows data and AI ecosystems to scale.

In today’s era of rapid tech shifts, organisations will naturally rise and fall. Models will come and go. Standards will evolve. And startups will appear overnight and disappear just as quickly.

But what becomes most valuable are the stable principles of trust that will soon sit over and above any specific company, model or platform.

Which is precisely where DTI becomes interesting.

The new ‘DTI Registry’ is designed to vet services and organisations that want access to personal data. It acts as an independent governance layer between users, data holders and data recipients.

Today, that means data portability. Tomorrow it could mean something much broader. When the same question will be asked everywhere:

“Can this organisation be trusted with my data?”

Or increasingly:

“Can this agent be trusted to act on my behalf?”

The AI industry is currently discovering identity. Soon it will rediscover trust. And trust is much harder.

We’ve already seen how casually people hand over permissions to AI tools they’ve downloaded from the internet. Email access. Calendars. Documents. Financial information. Personal files.

Of course, convenience is winning. Plus ça change. But governance is still struggling to keep up.

So the question isn’t whether agents will gain access to our data. They will. Rather, the question is what trust infrastructure sits underneath them when they do.

This week, the DTI just hit another milestone. A new trust mark.

Agnostic of a provider’s business model, available globally, and where every badge holder has been verified against the DTI trust framework.

It’s why organisations like the DTI matter. Because they’re quietly building a new layer of trust that the agent economy is going to need.

And fast.

Remember, the biggest AI challenge won’t be the model - it’s getting your personal data into it.

Bonus read: the DTI’s CEO, Chris Riley, posted this last week about the mission: “Building Trust Infrastructure for Agentic AI”

DTI TRUST MARK, CHRIS’S POST

A longer list of things to track…

There are SO many interesting and important Customer Futures things happening at the moment. Here are just a few from my open tabs:

• Announcement: Model Context Protocol now has enterprise-managed authentication (‘Zero Touch Auth’) READ

• Post: Your AI agent has an identity… that doesn’t mean it has permission READ

• Announcement: Google Wallet ID passes are coming to Europe READ

• Opinion: Your next customer is a machine READ

• News: Singapore releases a 53 page guide to Agentic AI Governance READ

• Article: (The World Bank) Digital Wallets: A New Paradigm - Convergence of User-Centric Digital Identity, Data Sharing and Payments READ

• Post: Signal’s Meredith Whittaker says AI chatbots ‘are not your friends’ and calls Copilot agents a backdoor READ

• Announcement: Advancing trusted calls with Open Verifiable Calling at Microsoft READ

• Article: How GenAI agents threaten retail banks’ customer relationships READ

• Opinion: Governments across Europe still think they’re just shipping a digital wallet by the end of 2026… but they aren’t READ

• Opinion: Did OpenAI Just Kill Its Ads Business? READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Customer Futures London Meetup: 22 June

Are you curious about Personal Agents, digital ID and digital wallets? Are you already working on Empowerment Tech?

Join us on Monday 22nd of June for our next Customer Futures Meetup, and a catch-up about all things Empowerment Tech.

Excitingly, we’ll be joined by the team from JLINC, a breakthrough data portability protocol, who are sponsoring the event.

We’ll be diving into all things authentic data + AI agents + verifiable credentials.

When: 6-8pm, Monday 22nd June

Where: Bar Area, The Hoxton, 199-206 High Holborn, London WC1V 7BD

Who: Regular readers of Customer Futures, friends and colleagues... anyone interested in the future of being a digital customer

Hi folks,

Last year, I wrote two posts in a series about Data Portability. It’s time for an update.

Because the UK’s ‘Smart Data’ initiatives are picking up speed, and you should be paying attention.

In the first Data Portability post, we looked at how the GDPR introduced data portability as a formal right. We saw how the EU’s Digital Markets Act (the DMA) transformed that right into something technical - and enforceable.

And how the Big Tech “gatekeepers” - META, Booking.com, Microsoft, Bytedance, Apple and others - have responded. Reluctantly, cautiously and minimally.

In the second post, we looked beyond data rights and infrastructure, and started thinking about participation and agency.

I introduced the idea that customer data doesn’t just need to move between large enterprises, but can instead flow to the customer themselves. Into data stores and vaults, into digital identity wallets, and into personal agents that can now act on your behalf.

All good stuff.

But today, I want to go further. Because we need to follow the money.

Data portability began as a story about compliance and competition (that was part 1). Then it became a story about agency and empowerment (part 2). But it’s now becoming something far more fundamental.

It’s a story about a new economy, and the empowered customer.

About who gets paid. About who captures value. And about what happens when individuals hold their own data, can prove things about themselves instantly, and have software acting on their behalf.

This is where we’re going in Part 3.

Because when that happens, and the customer becomes an active participant, not just a ‘data subject’, data portability stops being a regulatory discussion.

It becomes an economic one.

Today we walk through:

• The uncomfortable truth: your data already has a price

• Data Portability 1.0 was about movement… Data Portability 2.0 is about value

• Today’s economic model: brands pay to stalk, not to serve

• Three new money flows when the customer becomes the API

• Smart Data is really about Smart Customers

• The Great Customer Reset: when the money starts flowing back

It’s never been more important to understand the future of the digital customer.

So welcome back to the Customer Futures newsletter.

Let’s Go.

The uncomfortable truth: your data already has a price

Let’s start with something we all intuitively know, but rarely say out loud.

Your data already has a price.

Every scroll, every pause, every tap, every purchase and every moment of hesitation contributes to a vast digital pricing engine. One that determines which brands get to place what, in front of whom, when, where, and at what cost.

Want to know what’s being captured right now? Check out this page.

You see, platforms don’t need your explicit permission to value your data.

They can model it. They can infer it. They can auction it. Have you looked closely at the global Real Time Bidding (RTB) machine for digital ads? It’ll make you shudder. (Johnny Ryan calls RTB ‘the biggest data breach in history.’)

Entire markets now revolve around answering a single question.“How much is it worth to reach this person right now?”

This is the world we already live in. Where brands pay platforms for access, platforms monetise the resulting consumer attention, and individuals receive very little direct economic value in return.

Ok, we get some convenience, and some recommendations. Sometimes loyalty points. But honestly, it’s mostly noise in our day.

Not real value for the customer.

But once individuals can hold their own data, combine it with other verified sources, and allow Personal AI to curate and use that data on their behalf, the game changes.

Why?

Today’s question is “What can we infer about this customer?”.

But tomorrow’s question becomes “What high quality data can we request from the customer?

And:

“What does a fair value exchange look like when the customer is in control?”

It fast becomes a very different conversation - and a very different commercial model.

It’s where data portability gets interesting.

Data Portability 1.0 was about movement… Data Portability 2.0 is about value

So far, most discussions about data portability have focused on movement.

• Can customers access their data?

• Can they move it to another provider?

• Can they switch services more easily?

• Can they receive continuous and real-time access?

Important questions, yes. Necessary questions even.

But they all assume that the main purpose of data portability is to make switching easier. To unlock market competition. To allow customers to move from Brand A to Brand B with less friction.

Switching is useful and important. But it’s an incomplete view of data portability.

The better framing:

“What becomes possible once customers can get a copy of their own accounts and records?”

We now get to ask:

• What new services become viable?

• What new types of customer participation become possible?

• What new business models can be unlocked?

This is where data portability stops being a compliance obligation… and starts becoming an economic shift.

Today’s economic model: brands pay to stalk, not to serve

Let’s be honest. Today’s digital economy is mostly organised around brands spending enormous amounts of money trying to guess what customers want.

The entire machine is optimised around:

• Capturing attention

• Behavioural prediction

• Probabilistic targeting

• …and increasingly desperate attempts to interrupt our social feeds, our inboxes and our chats

From the customer’s perspective, it shows up as an endless stream of irrelevant emails, poorly timed notifications, retargeting ads and generic recommendations.

From the business perspective, it is simply called digital marketing.

But here’s where I’m going. Empowerment Tech offers a different way of thinking.

Instead of brands paying to interrupt, they can pay to respond. Instead of inferring intent, they can receive intent. Instead of guessing context, they can work with context that has been intentionally provided.

And that is where we can start to follow the money.

Three new money flows when the customer becomes the API

When data portability combines with digital wallets, portable customer memory, data stores and Personal AI, three entirely new economic flows begin to emerge.

1. Trusted Data becomes a service

Today, businesses spend extraordinary amounts of money - literally billions of dollars - verifying, cleaning, reconciling and checking customer data.

Not because they enjoy doing so. But because they don’t trust the data they have.

Yet imagine a world where a digital wallet can instantly prove a customer’s:

• Identity

• Age

• Address

• Professional status

• Student status

• Entitlements

• Memberships

All without exposing unnecessary personal information. Where every one of those proofs creates value. Every one reduces risk. Every one reduces cost.

Businesses can start paying for ‘trusted, high assurance data’ rather than repeatedly building expensive verification processes themselves.

A bank may pay for a verified proof of income. A lender may pay for a verified proof of employment. A travel company may pay for a verified loyalty credential.

And not because they want to ‘own’ the underlying data. But so that they can trust what they are seeing.

That is the first new money flow.

Businesses paying for trusted data and assurance, rather than collecting and storing (and cleaning and insuring) raw customer data that was wrong in the first place.

2. Brands subscribe to customer demand

The second flow is even more disruptive. We are already pumping lots of personal data into our favourite chatbots.

Right now, the AI Majors are getting all that vast customer data. Getting to know you better that you know yourself.

Pulling out rich insights about your situations, problems, challenges, questions and queries.

It’s going to become breathtakingly intimate with you - and not just about facts and figures, but about how you think, how you feel and your broader life context.

It’s not long before your Personal AI has a pretty comprehensive picture of:

• Your preferences

• Your budgets

• Your goals

• Your constraints

• Your memberships

• Your upcoming plans

Now imagine that your Personal Agent can communicate those needs to the market. Not your identity. Not your browsing history.

Your intent.

• “I’m planning a family holiday.”

• “I’m considering switching energy provider.”

• “I need car insurance in the next thirty days.”

• “I need a new laptop.”

Instead of brands paying to interrupt millions of people hoping a few might be interested, brands pay to respond to qualified, permissioned demand.

It is the difference between shouting into a crowded room vs. responding to someone who has already raised their hand.

Remember, online click through rates are typically sub 1-2%. And of those clicks (supposedly ‘qualified leads’), maybe 1% end up buying something.

Here’s the fascinating thing. In the new intent-driven world, branded messages that respond to customer intent won’t be ’ads’ anymore.

They will be more like hyper-personal offers, where businesses pay for qualified demand, likely as a subscription.

But all this only becomes possible when data portability gives customers control of their data.

3. Digital transformation on the customer side - new efficiencies, lower costs and and automation

The third flow emerges when Personal AI starts acting. Not recommending, but doing.

When my Personal Agent can

• Switch providers

• Cancel subscriptions

• Negotiate better deals

• Optimise tariffs

• Manage renewals

• Find savings

Right now customers can’t see all those opportunities. Because it takes time, effort, patience, and vast data sets across your life.

Precisely all the things AI - and specifically AI Agents - will be excellent at.

As customers start to save time, businesses reduce support costs, and processes become more efficient, we’re about to see a new wave of digital transformation arrive.

But this time it’s on the side of the customer.

Data portability won’t just unleash new competition. It unlocks a much larger automation economy altogether.

Will the UK get there first?

One of the mistakes people make when discussing data portability is assuming that this is primarily a European story.

But some of the most interesting developments are happening in the UK. Because for a few years now, the UK has been pursuing something called ‘Smart Data’.

The idea is quite simple.

Allow individuals to access and share their own data with trusted third parties in ways that increase competition, innovation and consumer benefit.

We’ve already seen it play out through Open Banking. What began as a regulatory intervention to increase competition in retail banking, has become one of the world’s most successful data portability ecosystems.

Millions of people now use Open Banking-powered services without even realising it. But look at it another way. Open Banking was never the destination. It was the prototype.

Today, a number of UK’ Smart Data programmes are exploring how similar approaches can be applied across other sectors including energy, telecoms, pensions and beyond.

They estimate that Smart Data can unlock nearly $100bn of new value in the UK alone.

It’s all pointing in the right direction, especially if we can see data portability through this new lens: of smart data, rather than just business-to-business data transfers.

The UK data portability agenda is on the move. And the Smart Data movement is worth paying attention to.

Smart Data is really about Smart Customers

Yet the mistake is to look at Smart Data through the old ‘data portability’ lens. About APIs, standards and regulation.

Those things matter, but remember, they are just plumbing.

The real story is what happens once customers are put back in the centre of their digital lives, powered by their personal data.

Yes, data portability provides the mechanism. Digital wallets can provide trust, and Personal AI can enable the intelligence.

But Smart Data provides the fuel.

Put those pieces together and the result is WAY more valuable than switching between providers. It’s the emergence of a new economic actor.

The Empowered Customer.

A customer who can betterunderstand their own data and situation. A customer who can prove things about themselves. A customer who can express intent.

And increasingly, a customer who can deploy software to act on their behalf.

The Great Customer Reset: when the money starts flowing back

Put all of this together and you begin to see the Great Customer Reset.

Today:

• Data flows from individuals to organisations

• Money flows from organisations to platforms

• Individuals receive very little direct economic benefit

Soon:

• Data still flows, but now under the customer’s control, and via their own personal software

• Businesses pay for trusted access

• Businesses pay to respond to verified intent

• Automation creates new value that can be shared in real time, via the customer themselves

Look, this isn’t some fantasy world where everyone gets paid for their browsing history. It’s much deeper, more nuanced and much more significant than that.

A world where individuals become active participants in the value chain.

Not the product, not the target, but participants.

If you’re building products, designing digital strategy, or thinking about customer engagement, you need to ask a difficult question:

Are you still viewing data portability as a compliance cost? Or are you starting to see it as the foundation of a new economic model?

One built around:

• Agent-ready APIs

• Portable customer profiles

• Verifiable credentials

• Customer-controlled context

• Intent-driven engagement

• And entirely new revenue streams and customer value

Those who continue to see data portability as an overhead, a regulatory requirement, will keep spending money trying to guess what customers want.

But those who understand where this is heading will start building for a world where customers can simply tell them.

The DMA. eIDAS2. Open Banking. Smart Data. Digital wallets. Personal AI.

They might look like separate initiatives, but they’re not. They’re all pushing towards the same destination.

The Empowered Customer.

A world where customer data no longer sits trapped inside company databases, but flows under the control of the individual. And where the biggest opportunity won’t be moving data. It will be creating entirely new value around the people who control it.

That’s us, by the way.

The customers, the users, the consumers, the citizens, the patients, the athletes, the fans, the volunteers, and all the rest of us.

So I’ll say it again.

While data portability began as a story about compliance and competition (part 1 in this series), and became a story about agency and empowerment (part 2), it’s now becoming something far more fundamental: a story about economic flows.

That’s the real point here.

That data portability really needs to be about Smart Data. And that, my friends, means Smart Customers… and a completely new economy.

Data portability is just the first step.

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Customer Futures London Meetup: 22 June

Are you curious about Personal Agents, digital ID and digital wallets? Are you already working on Empowerment Tech?

Join us on Monday 22nd of June for our next Customer Futures Meetup, and a catch-up about all things ET.

Excitingly, we’ll be joined by the team from JLINC, a breakthrough data portability protocol, who are sponsoring the event.

We’ll be diving into all things authentic data + AI agents + verifiable credentials.

When: 6-8pm, Monday 22nd June

Where: Bar Area, The Hoxton, 199-206 High Holborn, London WC1V 7BD

Who: Regular readers of Customer Futures, friends and colleagues... anyone interested in the future of being a digital customer

Hi folks,

It feels odd to say it, but I’m feeling pretty numb right now with today’s endless stream of company updates, reels, newsletters and videos.

A few years ago, even when most of the content was either mediocre or outrageous, it still felt human. Real. Digestible even.

But now it feels like a tsunami of clickbait, hot takes, snippets, shorts and podcasts that all say the same stuff. Or that are designed to shock and divide us. All to be consumed while you wait for the kettle to boil, sit on a train, or ride an exercise bike.

And since Covid, it’s only got worse.

Three-hour must-listen podcasts. Long reads about the future. Endless announcements about pilots, protocols and partnerships.

So over the last few weeks, I’ve taken a step back. Pen and paper. A blank page. Making sense of things for myself.

Away from the infinite scroll. Away from the conference-floor noise. Away from the exhaustion of the “thrilled to announce” posts.

There are some seriously important things happening at the moment. Around digital wallets, verifiable credentials and AI agents. And I’m excited about what’s coming.

But so much gets lots in the tornado of trying to keep up.

So this week, we’re back with a few simple things you might have missed but should be paying attention to. And why they matter.

Because it’s never been more important to understand the future of the digital customer.

So welcome back to the Customer Futures newsletter.

In this week’s edition:

• Anthropic’s ‘Zero Trust’ paper points directly to OBO

• Giving AI Agents access to Instagram, but forgetting to check their ID

• Google Wallet just got an upgrade - and it’s a huge opportunity for business

• Beyond The Prompt: Is your AI talking behind your back?

• … and much more

Grab a cappuccino, a quiet spot in the cafe, and Let’s Go.

Anthropic’s ‘Zero Trust’ paper points directly to OBO

Anthropic’s latest paper on “Zero Trust for AI Agents” is an important read if you care about the future of the digital customer.

I especially love the AI Major’s idea of “least agency”.

Folks in the identity world will be familiar with the term “least privilege”, which is about managing what an identity (a person, device, or system) can access.

But the idea of “least agency” asks what an agent can do, under what conditions, with which tools, and with what level of oversight.

Autonomous AI agents are more than just about ‘access’. We also need to be careful about action too. How they behave, not just where they go.

So the rules around who-can-do-what must now be designed - and enforced. Not just managed at the level of ‘here’s your access badge or token’.

This particular table in Anthropic’s paper stuck out for a few reasons. It’s their view of what we need to ensure we can trust AI agents inside the enterprise:

Specifically, they recommend:

• Persistent agent IDs

• Backed by cryptographic material

• Certificate presentation for all service connections

• Remote attestation to verify agent integrity before granting access

• Confidential computing enclaves

Yes, it’s somewhat technical. But for those who’ve been following Customer Futures for a while, you’ll see that most of those recommendations can be delivered with verifiable credentials, and likely a digital wallet for every AI agent.

Why am I banging that drum again?

Because AI agents are naturally decentralised things.

We wont - and can’t - have one huge central platform that hosts and manages all the AI agents everewhere. And certainly not when those AI agents act outside the company’s firewall. When the AI needs to move between and across different companies.

And of course, when the AI agent is operated on the side of the customer themselves.

Once again, we’re bringing old mental models - of centralisation and industrialisation, of data lakes and CDPs, of enterprise systems and controlled access - to the new world of AI agents.

Once again, we’re applying old logic, old assumptions to the new tech.

Instead, we need to give AI agents their own identities. Their own digital credentials and proofs. Their own portable trust. So that anyone, anywhere can instanly verify who they are, what they are allowed to do, and on whose authority.

It’s why I keep coming back to the ideas of ‘OBO’. A framework for ‘on behalf of’.

Giving each AI agent its own persistent identifier, together with run-time control with permissions, access and actions.

In case you missed it in recent posts, here are the eight things that I believe a framework around ‘Agent OBO’ can describe:

1. The identifier of the ‘principal’ (the person, org or machine) doing the delegating

2. The identifier of the AI agent

3. Proof of the ‘binding’ between the principal and the AI agent (the relationship)

4. The scope of the delegation (what, where, when, who)

5. The intent of the delegated task (why)

6. The operator of the agent (e.g. SaaS provider vs. device owner)

7. The reputation of the agent

8. The terms on which data will be shared about the principal (a pointer to a machine-readable governance framework, and covering compliance with any particular regulations)

Importantly, these ‘OBO 8’ can be wrapped up into a single digital object that can be asked for, inspected and verified instantly. It will be machine-readable, and suitable for high-frequency, real-time transactions, with auditability baked in.

Which is why Anthropic’s ‘Zero Trust’ paper matters, when it’s describing OBO in great detail.

Of course, you can alternatively just feed the whole thing into Claude and get a 10 point summary so you can sound smart in your next meeting.

Isn’t that what everyone does now?

READ

Giving AI Agents access to Instagram, but forgetting to check their ID

Another predictable face palm from META, who has been using AI for ID checks when a user needs to carry out a password reset.

But whoops - bad actors can also use AI to fake the selfie, needed as part of the reset.

AI tricking AI. Who knew!

Apparent last week some bad actors used AI to fake-reset a bunch of high profile Instagram accounts. And it worked.

From Marijn Markus:

“An attacker would start the “Forgot Password” process, claim the account had been compromised, and use a VPN matching the target’s location. Instagram’s AI support flow would then request selfie verification.

“The attacker would take photos from the target’s public profile, generate an AI video showing the face moving, and submit it as proof.

“If accepted, the attacker could change the account email address, receive password reset links, and take control of the account.”

It feels like a simple thing to miss.

That loophole has apparently been fixed, but wow, you’d think META, of all folks, would have more solid ID verification checks in place…

Right? RIGHT?

READ

Google Wallet just got an upgrade - and it’s a huge opportunity for business

This is a big deal, if you follow the breadcrumbs.

Lucyna Janas, Head of Google Wallet Partnerships, has announced that privately-issued credentials, for example from banks and private companies, are coming to Google Wallet.

As Nick Lambert puts it:

“This is a defining moment for verifiable credentials and reusable digital identity.

“The Google Wallet solves the distribution problem of how a company gets verified ID credentials into their users’ hands. Hundreds of millions of devices run Android.”

Nick points out that for banks and businesses, it’s potentially a huge opportunity. If a company has already verified someone, and carried out digital identity checks, then they can issue that data into Google wallet too.

And the customer can then reuse that data elsewhere, with trust.

Things like KYC and ID verification checks - currently a business overhead - can become portable and useful. Perhaps even a new revenue stream for the business, if designed correctly with privacy (for example ensuring that there is no “phone home” moments where the bank can see where the data has been used).

This is all possible with the available technology today.

BUT.

Look further, and this move by Mastercard may be less about digital ID, and more about data portability full stop.

On the 16th June in London at the Ctrl-Shift Smart Data Forum, Google will be demonstrating their latest Data Portability API. Now required by regulation as part of the EU’s Digital Markets Act (DMA) and the UK’s Data (Use and Access) Act (DUAA).

But what if that data sharing wasn’t direct via API between Google and another business, but instead using a verifiable credential… and issued straight to the user’s wallet, as Google Wallet has announced?

And what if that data format was based on open standards, so that the personal data could be issued into any certified wallet, including Apple’s? Perhaps even the EU Digital ID wallet?

Well, customers just got empowered in a new way. To receive copies of their own account records from banks and other company sources. And to be able to share their personal data with others, transparently, auditably, and under their control.

Think customer account records. Think proof of spend. Think enrolments and entitlements. And yes, digital identity. And that’s all before we get to customer status and loyalty information.

If this plays out as I suspect, it’s another brick in the wall(et) for Empowerment Tech.

I’ll share as we find out more about Google Wallet’s plans.

One to watch.

READ

Beyond The Prompt: Is your AI talking behind your back?

I had a real reality check with AI yesterday.

I was asking ChatGPT about how to handle some team travel logistics, and it suggested I get an earlier train given my current location.

Yet I hadn’t given it information about where I was, nor remember doing so.

Hmmm.

I asked it why it knew my location, and it apologised. It then confessed it had pulled my computer’s IP address and area code.

Now, this is pretty standard for digital services, and we should be used to this as part of the usual data scrape. But it shocked me when it casually dropped in my current location to the chat, and suggested new travel plans.

My point here isn’t about some unusual data collection. By now, we should know that if it can be collected, it will be collected.

No, this is actually about transparency and context. Because it would’ve been trivial to get the ChatGPT response to say:

“From your IP address, it looks like you are currently in XYZ, and I assume you want to take the train. So I suggest you head to ABC to get ahead of possible delays.”

It won’t be the first or last time this kind of thing happens. But it raises a bigger question about what personal data our prompts are using.

And critically, what happens to our data Beyond The Prompt.

Helpfully, there’s just been an excellent analysis of exactly that, and researchers have some pretty alarming results.

Sekoul Krastev shared some of the highlights:

“It turns out your favorite chatbot is maybe forwarding your conversation content to third parties. In some cases, the literal plaintext of what you typed and what the model said back.

“17 of 20 chatbots shared data with at least one third party during a single session. Advertising services appeared on 12 of 20. SeaArt alone contacted 13 distinct advertisers in one session, including Facebook, Google, TikTok, and Amazon.

“Claude and Mistral’s support widgets transmitted user name, email, account ID, and user hash on page load... before anyone even typed anything.”

Woof.

If you thought data leakage from browsers, cookies, real-time bidding and adtech was bad, just wait till you take a look at how AI is handling (and storing) your data.

And that’s before we give lots of our personal data - including intent prompts, locations, preferences and identity information - to AI agents. All in the name of ‘getting something done.’

Yes, this is a governance problem, a data protection problem, and an incentives problem. But more importantly, this is a transparency and UX problem.

Big Tech companies will always collect more data than they need, more than they should, and disclose less than they must.

Making it clear what data is being used to produce an AI chat result - and what happens with your data afterwards - must become table stakes.

Whether it’s recommending a product, an employee hire, or a financial transaction.

Or even if you are just getting a train.

READ

OTHER THINGS

There are far too many interesting and important Customer Futures things to include this week.

So here are some more links to chew on:

• Announcement: DIF sets a precedent: AI Agents are banned READ

• News: OpenAI and Plaid are bringing personal finance management directly into ChatGPT READ

• Opinion: Your Chatbot Has a Long Memory. That Isn’t Always a Good Thing READ

• Article: When AI buys on your behalf: understanding the stack and the risks READ

• Post: The future of identity is headless and AI-first READ

• Opinion: We Must Be Honest About AI’s Dishonesty READ

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Watch: Modernising government services… with digital ID and verifiable credentials

I’m hosting a new series of digital ID webinars with iDen2 and Carahsoft, starting with a look at digital ID in government.

We’ll be talking about digital wallets and verifiable credentials as a fresh, practical way to improve citizen trust, lower fraud, reduce inefficiencies and enable secure, reusable digital ID across government programmes.

We’re live on Wednesday May 27 at 1pm Eastern Time.

You can register for the online event here.

Hi folks,

I’ve been chewing on this one for some time.

There’s a saying that every business does one of two things. You are either bundling, or you are unbundling.

The great AI shift is about to do something fascinating with both. But unless you stand back, you can’t see it. So today I want to show you what’s coming with digital identity, and why.

We walk through

• The great smartphone convergence

• Why it’s about to happen again

• An old truth about convergence

• Different businesses are starting from different places

• The Great Convergence (modern edition)

• What this means

It’s never been more important to understand the future of the digital customer. Welcome back to the Customer Futures newsletter.

Grab a fresh peppermint tea, a comfy seat, and Let’s Go.

The great smartphone convergence

Before the iPhone was launched in 2007, we used to have to carry around a bunch of different things. A radio, a camera, a torch, a calculator, a phone, an MP3 player, and much more.

Each tool did one job. And each lived in its own world. Then hardware and software caught up, and bundling them made them portable, together.

Remember, the iPhone didn’t replace the fancy big DSLR cameras with professional lenses. It just gave us a good enough camera we could carry everywhere.

Likewise, the radio wasn’t replaced. But it made listening anywhere possible, with a neat new touch interface. And the mobile didn’t replace the torch. It just made light available when and where you needed it.

A hundred different tools melted into one interface.

A inevitable convergence.

It’s about to happen again

This time, it’s not hardware features collapsing into a phone. Rather, it’s about four digital capabilities that have developed independently over two decades.

And are now being pulled together:

• Identity to prove who you are

• Wallets & credentials to carry entitlements

• Context & profiles to understand your needs and history

• AI agents to act on your behalf

Each has evolved independently. And each has become important in its own right.

But they no longer work on their own. Unlike the iPhone, this convergence isn’t about convenience. It’s about interdependence:

• Identity without context is blind

• Context without identity is untrusted

• Agents without either can’t act (or at least are clumsy)

• Wallets without agents or context don’t do anything useful

These capabilities need each other.

Which is why they’re being pulled together into a single customer-side layer. A new operating system for the individual.

And it’s happening everywhere you look.

Which brings us to an old truth about convergence

Jamie Zawinski once said:

“Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.”

It’s so obvious once you see it. The idea that all features expand until they integrate with email.

But Zawinski wasn’t really talking about email. He was pointing at a kind of gravitational pull, something every product drifts towards eventually because it solves a universal need.

In Web1, that gravity was contacts. Please tell us who you know. In Web2, it was communication. You knew a platform had matured when it touched email.

Here’s my bet: In the agentic era, the gravitational centre is identity.

And so here’s a new Jamie’s Law:

“All technology platforms eventually expand until they require identity - digital reputation, authority, and verifiable context.”

This is the new convergence.

The same way every device became a phone, every modern platform is becoming an identity system. And as soon as a product tries to automate, personalise, or act on your behalf, it hits the same unavoidable questions:

• Who is this for?

• Can the action be trusted?

• What does the user intend?

• What are they allowed to do?

• What is the right behaviour in their context?

You can’t answer these questions with more and more interfaces. Nor can you with more and more APIs. Or more and more LLMs.

Only identity, context and proof of authority (i.e. delegation) can.

Identity becomes the final - converging - dependency.

Different businesses are starting from different places

Once you see identity, context and delegation as the new centre of gravity, you see the competitive landscape in a completely new way. And the latest company moves and developments snap into focus.

Why?

Because every major player begins from one of three starting points, and each starting point shows you what they’re missing.

Different strengths. Different blind spots. Yet the same trajectory towards the three pillars. The winners will be those who assemble the full stack fastest:

Context + Identity + Agents (Delegation)

It’s how we frame all our work at Trusted Agents.

Here’s how I see the race lining up:

1. The AI-First Players

OpenAI, Perplexity, Anthropic and so on.

They began with breakthrough models. They have the most capable agents, able to reason, plan and act. But they’re missing the two prerequisites for trusted action:

• Identity: who the agent is acting for

• Context: what the user knows, prefers, intends or allows

Which is why you can see them urgently adding:

• Memory

• Personal clouds and data stores

• User permissions

• Account-level authority

• Policy and safety frameworks

You see, LLMs need identity and context to become fully agentic. Yes, they have capability. But they don’t have the core foundations for digital trust.

2. The Wallet & Identity Players

Apple Wallet, Google Wallet, eIDAS2 wallets, identity providers etc.

They all began with the strongest core features:

• Verified identity

• Credentials and proofs

• Entitlements

They already have tools to know who you are, and can then prove what you’re allowed to do. But they don’t yet have deep personal context or AI agents that act on your behalf.

So they’re adding:

• On-device intelligence

• Personal agents

• Richer data stores

• AI plugins to access other data ecosystems and services

The wallets give them trust. Agents give them behaviour. And context makes the whole system usable.

3. The Context & Relationship Players

Banks, retailers, insurers, telcos, marketplaces and so on

They began with the richest customer relationships - and critically, customer understanding:

• Spend

• History

• Behaviour

• Needs

• Preferences

• Life context

So they’re now adding:

• AI copilots

• Customer service agents

• Automated decisioning

• Personalisation engines

But remember, they’re still missing:

• Identity infrastructure that carries authority beyond their walls

• Wallets and proofs to let their agents act in other systems

Yes, their AI can advise. But it struggles to act elsewhere without portable identity and verifiable authority. They have context… but no portability.

The three primitives everyone needs

Regardless of where they start, every company ends up needing the same three foundational components.

It’s what I’ve been talking about as the pillars of Empowerment Tech.

1. Data Store (context)

Memory, preferences, behaviour, intent, history and all sorts of other customer context that is useful in a transaction.

2. Digital Wallet (identity and proofs)

Who you are, what you can prove, what authority you carry.

3. AI Agent (delegation)

Acts on your behalf, uses your context, follows your intent, and can be bound to a natural person.

Every platform starts with one of these. But every platform eventually needs all three.

The Great Convergence (modern edition)

So here’s what we are seeing:

• AI players adding identity + context

• Wallet/ID players adding agents + context

• Data and context (the ‘customer relationship’) players adding agents + identity infrastructure

And so everyone is moving toward the same architecture: Context + Identity + Agents

Not because of convenience, but because each capability relies on the others. This new convergence is driven by necessity.

What this means

I believe three related shifts will define the next decade:

1. Identity becomes infrastructure
Everything that acts on your behalf requires verifiable authority. Identity and trust stop being products and features to bolt on, and become woven into every touch point, every transaction, and every customer moment.

2. Wallets become the new data layer
They carry reputation, entitlements, proofs, state and get bound to real people and organisations so we can prove who belongs to what.

3. Agents become the new users
Software that interacts with other software on our behalf (OBO).

Now, zoom out and you’ll actually see that the starting point doesn’t matter. Because the direction of travel - towards Empowerment Tech - is already set.

The last era converged on communication, but this next one converges on identity.

And the new Jamie’s Law:

All technology platforms eventually expand until they require identity - digital reputation, authority, and verifiable context.

And once again, many different tools will melt into one interface. One customer interaction.

It’s the next inevitable convergence, but this time organised around digital identity and trust.

So are you ready?

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now

Each week I unpack the disruptive shifts around Empowerment Tech. AI Agents, digital wallets, Personal AI in and the future of the digital customer relationship.

If you haven’t yet signed up, why not subscribe:

Subscribe now

Watch: Modernising government services… with digital ID and verifiable credentials

I’m going to be hosting a new series of digital ID webinars with iDen2 and Carahsoft, starting with a look at digital ID in government.

Because many government agencies are now under triple pressure: to reduce fraud, to improve digital service delivery, and to modernise legacy ID systems.

At the same time, today’s approaches like manual ID verification, repeated identity checks and siloed data systems are struggling to scale.

So we’ll be talking about digital wallets and verifiable credentials as a fresh, practical way to improve citizen trust, lower fraud, reduce inefficiencies and enable secure, reusable digital ID across government programmes.

We’ll be live on Wednesday May 27 at 1pm Eastern Time.

You can register for the online event here.

Hi folks,

This week, I’m sharing an important post by my co-founder Gam Dias.

It’s about why we decided to set up Trusted Agents. About our predictions for AI Agents. And why your business is not ready. Not really.

Gam talks through:

• Why both sides of AI matter

• Our AI agents predictions

• Where it will go wrong

• The three most important questions

• The stage before the investment

It’s never been more important to understand the future of the digital customer. Welcome back to the Customer Futures newsletter.

Grab a hot chocolate with extra marshmallows, a cosy corner, and Let’s Go.

The starting line

Jamie Smith and I founded Trusted Agents in January 2026. But the thinking behind it goes back much further than that.

We met online during the pandemic, at one of the MyData and Internet Identity Workshop conferences that brought together a particular kind of person.

People who believed, before it was fashionable to believe it, that individuals should have meaningful agency over their own data and the value it generates.

By rights we should have met years earlier. When we did eventually compare notes, we realised we had been building toward the same idea from completely different directions.

That convergence is what Trusted Agents is built on.

Jamie spent years working at the intersection of digital identity and human trust. At Evernym, and through his work with Ctrl-Shift, he was focused on a specific and underappreciated problem: how does a person prove something about themselves to a system — their identity, their permissions, their credentials — without surrendering control to that system?

That question sits at the foundation of everything agentic commerce requires.

When a customer’s agent acts on their behalf, the business on the other side needs to know: is this agent authorised? Is it acting for a real, verified person? Has the delegation been done correctly?

Jamie had been building the trust and identity layer that answers those questions long before most organisations knew they needed to ask them.

But I came at it from a different angle.

I co-founded First Retail, recognised by Gartner as a Cool Vendor for our work on semantic infrastructure — the layer that gives agents the context they need to act accurately on behalf of real people. Not just permission to act, but understanding. Knowing what a person prefers, what they value, what they have consented to share, and what that means in the context of a specific transaction.

If Jamie’s work answers the question of whether an agent can be trusted, my work addresses what that agent actually needs to know to be useful.

Why both sides of AI matter

This is the argument at the centre of Trusted Agents, and it is worth being precise about it.

For agentic commerce to work, for a customer’s agent to discover, compare, negotiate, and transact on their behalf in a way that any serious B2C organisation would accept, three things need to be true simultaneously.

First, the agent needs a trusted identity: verifiable proof that it is acting for a real, authorised person, that the delegation has been made correctly, and that the permissions are current and specific.

Second, the agent needs personal context: a portable, accurate understanding of the person’s needs, preferences, and history that travels with the agent rather than being locked inside any single organisation’s systems.

And third, the organisation the agent is dealing with needs clean, machine-readable data: accurate product information, pricing, availability, and policy that an agent can interpret and act on without human intervention.

Without all three, the transaction either fails or produces outcomes that nobody intended.

And most organisations are currently missing at least two of them.

That is a readiness problem, not a tech thing. And readiness is what Trusted Agents is built to address.

Our AI agents predictions

When Jamie and I started mapping this out properly, we tracked the protocols and standards being developed to support agent-to-agent interaction. We studied the governance requirements. We looked at what machine-readable data actually needs to look like for an agent to use it reliably. We watched the identity infrastructure develop.

And we made a specific prediction: once that infrastructure layer was strong enough to support a complete, trusted, end-to-end agentic transaction, agentic commerce would accelerate fast.

Not gradually, but fast.

Because the underlying consumer behaviour — delegating decisions, automating routine purchases, using AI to navigate complex choices — was already there. The infrastructure was the missing piece, not the demand.

That infrastructure is now going in.

Model Context Protocol [a standard that allows AI agents to connect to external systems and data sources in a structured, controlled way] is being adopted at speed.

Agent-to-agent coordination frameworks are moving from experimental to production. The European Digital Identity Wallet is expected to reach 300 to 400 million people. Bain is forecasting $300 to $500 billion in agentic commerce in the US alone by 2030.

It feels like our predictions are landing.

Where it will go wrong

The consistent mistake organisations make is not underestimating the technology. It is overestimating their own readiness to deploy it.

Boards get sold on quick financial gains. Management is pushed to find cost reductions before the business is structurally prepared. Agentic tools get stood up on top of bad data and business processes that were designed for human workflows — and then people act surprised when things go wrong.

Here is the harder truth: AI agents are not digital colleagues.

They do not exercise human judgment, human restraint, or human common sense. If your business process has a gap that a polite human would quietly work around, an agent will find that gap and push straight through it. If your pricing engine responds to signals that can be gamed, agents will game it. If your controls depend on human interpretation, you do not have controls. You have assumptions.

The organisations that will navigate this well are the ones that understand the shift structurally, not just technically, before they commit to pilots and platforms.

That is the conversation Jamie and I have been having with banks, travel companies, and retailers.

It is the conversation Trusted Agents exists to have.

The three most important questions

I want to be transparent about something, because I think the openness is useful.

When Jamie and I were planning Trusted Agents, we did not just ask ourselves who might want what we do. We used a framework from the book Levers by Ryan Tansom — specifically the W3 method — to pressure-test our assumptions.

The three questions are simple. Who do you believe your customer is, and what data do you have to prove it? What do they actually buy from you — not what you sell, but what they buy? And why do they buy it?

They sound obvious. They are not.

Most businesses answer them from instinct and stop there. The discipline is in checking the answers against evidence, and then being honest about what the evidence says.

Here is how we worked through them.

WHO

We kept returning to the same profile. Not the CTO. Not the CDO. Not the transformation programme lead who has already been given a budget and a mandate.

Rather, the person we consistently found ourselves most useful to was earlier than that — and more interesting.

It’s the innovator inside a medium to large B2C organisation who can see the shift coming, has been given or has taken on the responsibility for making sense of it, and is surrounded by people who are either dismissive or paralysed.

Personally ambitious. Intellectually ahead of the organisation. Carrying the weight of a technology shift that their peers have not yet fully registered.

In Geoffrey Moore’s terms — and this matters for how we think about timing — this person is an innovator operating inside an early or late majority organisation.

They are not a startup founder. They are not a frontier AI lab. They are someone trying to move a complex, regulated, human-filled organisation toward a structural shift that the organisation does not yet have the language to discuss.

WHAT

This one took us longer to answer honestly. We do not sell implementation. We do not sell model selection. We do not sell proof of concept factories.

What our clients actually buy — when we were rigorous about it — is clarity, orientation, and the confidence to move their organisation forward before the window closes.

They buy the thinking, the framing, and the shared language that allows them to have conversations internally that they could not have before. They buy the stage before the formal programme. They are buying the conditions that make everything else possible.

WHY

Because they need to become the internal leader who turns agentic AI confusion into credible next steps — without sounding like they are repeating vendor hype.

Because the personal stakes are real.

Because the technology shift is moving faster than any they have managed before. The organisations that get the framing right early will have a material advantage.

And because the leaders who create that clarity will be remembered for it. The ones who wait for consensus will be managing someone else’s roadmap.

The stage before the investment

But something has shifted in the last few months. The conversations we are having with banks, travel companies, and retailers have changed in character.

Six months ago, the questions were exploratory. What is this, where is it going, should we be paying attention?

Now the questions are operational:

• What does this mean for our customer relationships specifically?

• Where are our processes exposed?

• How do we brief our board without either overhyping or understating what is coming?

• How do we move hundreds of people from awareness to a shared point of view without creating chaos?

That shift in the quality of the question tells us the market has moved.

Leaders who were watching are now feeling the pressure to act, and they are looking for something that most of the market is not yet providing — not a vendor pitch, not a generic AI literacy programme, but a structured way to think clearly about what agentic commerce actually changes, and where to direct attention first.

That is the gap Jamie and I have been working in. And it’s getting busier.

Importantly, there is a particular moment that many of the leaders we work with describe in almost identical terms.

They can see the shift coming. They have enough context to know it is serious. But their organisation has not yet developed the shared understanding needed to act — no common language, no agreed point of view, no internal momentum.

They are not blocked by a failed pilot. They are earlier than that. They are trying to create the conditions that make good decisions possible, before anyone is ready to make them.

Before investment.

That is a specific and demanding place to be. It requires moving executives who are sceptical, peers who are distracted, and teams who are waiting for direction — all at the same time, without the authority that comes with a formal mandate or a signed-off budget.

It’s also exactly the stage we have built Trusted Agents for.

So I’ll say it again:

The consistent mistake organisations make is not underestimating the technology. It is overestimating their own readiness to deploy it.

It is such an exciting time. But one that demands careful attention.

We set up Trusted Agents for those who can see what’s coming, but their business can’t. And if they don’t get executives aligned quickly, and make the case now, they may get left behind.

So be honest with yourself - is your business ready for what’s coming?

And that’s a wrap. Stay tuned for more Customer Futures soon, both here and over at LinkedIn.

And if you’re not yet signed up, why not subscribe:

Subscribe now