Hi everyone, thanks for coming back to Customer Futures. Each week I unpack the fundamental shifts around Personal Agents, digital customer relationships and Empowerment Tech.
If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.
To the regular subscribers, thank you.
(p.s. did your email cut this newsletter short? You can find the full post here)
Hi folks,
This week, I’m kicking off a new five-part mini series on something that’s going to be hugely significant for the future of Personal Agents.
Because I’ve been digging into an important new technical paper from Meta. Explaining how it’s building Muse, its new Personal AI Agent.
Why go into the detail?
Well, it’s a huge piece of research, and quite revealing. It goes way beyond the technology around Muse itself, and covers the identity, security, permissions, data and trust infrastructure all needed to make Personal AI Agents work in the real world.
But can they do it privately? Securely? With trust?
That’s why I’ve been getting under the hood. The how, not just the what.
And it’s a whole thing, if you care about this stuff. Which you really should do given what’s at stake.
So far, it’s clear that Meta is going much, much further than a smarter chatbot.
This is much closer to a full description of the digital infrastructure needed for an AI agent to operate as a digital representative of a person.
Read that again. The implications for businesses, customers, citizens and the wider digital economy are staggering.
I’m not saying Meta is right, or that they’ll succeed. But I’m pointing out that their approach looks pretty comprehensive, and we need to be paying attention to what’s coming. To the very future of the digital customer relationship.
So rather than try to squeeze everything into one newsletter, I’m going to unpack my analysis of Muse - and the implications - over five posts. Each looking at a different part of what’s going on.
Here’s what’s coming over the next few days:
Meta’s AI Agent ‘Muse’ is getting its own computer - and you need to be paying attention. What Meta has actually built, why the agent needs its own computer, and how this changes customer control - from apps to agents.
The agent isn’t in charge - and that’s the most important thing about Muse. How is Meta separating ‘intelligence’ from ‘authority’. And why permissions, credentials and trust will matter as much as the AI itself.
Delegation, not impersonation - why AI Agents are going to need their own IDs. Why acting as someone and acting on behalf of someone are two very different things. And what this means for agent identity and verifiable delegation.
When your customer sends an agent instead. What actually happens to websites, apps, customer journeys and commerce when businesses increasingly interact with a customer’s agent, rather than the customer themselves?
The ‘walled garden’ is now the agent itself. The extraordinary opportunity for customer empowerment, the risk of a new generation of platform lock-in, and why portability, interoperability and genuine customer control now matter more than ever.
These five pieces point towards one of the biggest shifts in personal computing since the smartphone. And perhaps something even bigger.
A fundamental change in who controls the digital customer relationship.
So let’s get into it. It’s a long one to kick off the series because there’s so much to unpack:
What is Zuckerberg’s new Personal Agent Muse?
Your agent gets its own computer: the brain, the computer and the connections
The agent isn’t actually in charge, and your agent doesn’t need your passwords
Your agent becomes a system of record
The customer now becomes the centre of the system
The next great customer shift is a complete reset
Let’s Go.
1. What is Zuckerberg’s new Personal Agent Muse?
On the face of it, Meta’s research paper How We Built Safety Into Muse is about security.
What happens when you give an AI agent access to someone’s email, calendar, files, browser and connected services. Then what happens when you allow it to operate without someone constantly supervising it.
Which, when you think about it, is quite a leap.
Because until recently, most of our interactions with AI have been asking questions, or generating content, or analysing some info. The AI produces an answer, and it’s up to us to decide what to do next.
But Muse now represents something different.
Meta describes an AI agent as something that knows its user, works in the background, coordinates other agents, develops its own tools and can even modify its own software.
That’s a remarkable - and hugely disruptive - collection of capabilities. And it’s worth thinking about what they mean when you put them together.
An agent that knows you is one thing. An agent that can act is another. But an agent that knows you, has access to your personal data, can coordinate software and continues working while you’re doing something else?
Well that’s the beginning of an entirely different relationship with technology.
With personal technology.
And the most interesting part isn’t the intelligence of the AI model. It’s everything Meta has built around it.
For an AI agent to operate on your behalf, it needs somewhere to work, data it can use, tools it can operate, connections to other services and rules that determine what it’s allowed to do.
I’ve long argued that Digital Public Infrastructure (DPI) will need a mirror set of capabilities on the side of the individual. And I think that’s what Zuck is building here.
In other words, we’re about to see a new wave of Digital Personal Infrastructure.
And Meta’s first major design decision is rather revealing.
2. Your agent gets its own computer
Meta research sets it out pretty clearly from the start:
“You and your Muse share your own dedicated computer in the cloud.”
‘Share’.
Isn’t that an interesting word? That the agent is something - someone - else, and separate from you and your stuff? More on that later.
This section in the research describes a dedicated ‘virtual machine’ (VM), with its own computing resources, storage, browser and ability to run software.
A virtual machine is basically a computer running inside another computer. You don’t need to buy it, maintain it or leave it switched on. It lives in a data centre, and you can access it remotely.
But unlike a conventional chatbot, which just responds to your questions, this gives Muse a complete computing environment in which it can actually work.
It can open a browser, use software, manage files, create tools and carry out activities that involve multiple steps. Meta also describes Muse’s support for ‘scheduled tasks’, which means the agent can perform work without waiting for you to open another conversation.
So now we’re 24/7.
Now, just hink about how different that is from the technology most of us use today.
If I want to organise a holiday, I open a browser, search for flights, compare hotels, check my calendar, look at car hire, find my loyalty numbers and work through a collection of websites and apps.
I become the integration point between all those different services. The airline has one system. The hotel has another. The car hire company has its own. And none of them really knows what I’m trying to achieve across the whole trip.
But with a personal agent, the idea is that the software can increasingly coordinate those activities for me.
And a dedicated computer is what gives it somewhere to do that work. Put another way, we’re moving from ‘AI as a conversation’ to ‘AI as a digital presence’.
Why?
Because a chatbot is somewhere you go to ask questions.
But a personal agent is something that can exist on your behalf, whether you’re talking to it or not. Some call it a Digital Twin. It has somewhere to live, information it can use, tools it can operate and connections to the services you rely on.
And increasingly, has the ability to act.
That’s a fundamentally different approach for the digital customer relationship.
3. The brain, the computer and the connections
I see Muse as three things working together.
First, there’s the brain.
Meta has developed a specific AI model that’s designed for ‘autonomous agents’, especially so they can use unfamiliar tools, follow instructions across long sequences of actions, and manage other ‘sub-agents’.
That last point is particularly important. Imagine asking your agent to organise a family holiday. One sub-agent could research flights, another could compare accommodation, while another checks existing bookings and travel preferences. Your main personal agent can then bring those results together, and help you make sense of all the pieces. Even book the holiday.
It’s a very different experience from asking a chatbot to recommend five hotels. This is now a system that can divide up work, use multiple tools and pull together the results.
Second, there’s the computer.
That’s the dedicated VM we’ve just discussed. Giving the agent a ‘persistent environment’ in which to operate. We’ll come back to that later, and look at how private it really is.
And third, there are the connections.
Meta explains that Muse can use ‘connectors’ to access external services. Things like email, social networks and other connected systems.
But there’s another important detail. The agent can also develop custom connectors for services that have suitable APIs.
Eh?
This part is a Big Deal.
An API is simply a way for software systems to communicate with each other. It’s how applications can exchange structured data, and can request actions without someone having to manually operate a website.
What’s interesting here is that Muse doesn’t necessarily need Meta to have built a dedicated integration for every service in advance. If another company or system has a suitable interface, the agent can potentially just create the connections it needs - on the fly.
That’s huge.
Because we’ve spent the last 15 years downloading apps to add new functions to our phones. We’re sick of hearing ‘there’s an app for that’. There are now literally millions of them in the app stores and hundreds on our phones.
Want to book a train? Download an app. Want to manage your finances? Download another. Want to track a parcel, organise a holiday, monitor your energy consumption or control your heating?
More apps. And every one comes with another interface, another account and another set of things to learn.
Personal agents will now change all that.
Instead of searching for a mobile app, installing it and working out how to use it, we will simply explain what we’re trying to achieve. The agent will work out the relevant services it needs, connect with the available tools, and even assemble new capabilities where they don’t already exist.
Of course, there will be limits. Businesses will still need to expose those ‘suitable APIs’, and the agent will still need permission to use them.
But I think this is a major moment for understanding how AI agents will get stuff done.
The next generation of personal computing will be less about downloading software and more about delegating outcomes.
Which has profound implications for the app economy.
We’ll come back to those in Part 4, when we look at what happens when businesses increasingly engage with customers’ agents rather than customers themselves.
4. The agent isn’t actually in charge
Now here’s where Meta’s paper becomes interesting.
Because giving an AI agent its own computer, access to your information and the ability to interact with other services creates some rather obvious problems.
What happens when it makes a mistake? Or misunderstands an instruction? Or encounters a bad actor on a website that tricks it into doing something you never intended?
Meta recognises that these are real risks. And its answer is to separate the intelligence of the agent from the authority to act.
How?
By building a separate security system called Sentinel.
Think of Sentinel as an independent gatekeeper. A security guard.
The AI agent Muse can work out what it wants to do, but it is the companion agent Sentinel that determines whether certain actions are actually allowed. Sentinel can approve a request, block it or ask the user for permission.
And crucially, Muse can’t simply override the decision.
Imagine asking your agent to organise a trip to New York. It might need to check your calendar, search for flights, compare prices and eventually make a booking. Those are very different activities, with very different consequences.
Reading your calendar is one thing. Changing an appointment is another. Spending £2,000 on flights is something else entirely.
Meta’s approach means that permissions can be much more specific. Potentially even applying to an individual action within an app, a particular task or a limited period of time.
Interestingly, Sentinel can also ask for your approval through a separate interface, rather than relying on a message inside the conversation with the AI.
Which is going to matter when it comes to the customer experience.
You can imagine that the main AI agent might be manipulated by something it reads, or simply misunderstand what you want. So Meta has designed a system that makes sure that the decision on what it’s allowed to do sits outside the agent itself.
The agent’s intelligence and its authority are two different things.
I think this is one of the most important architectural principles of the entire agent economy. We’ve spent decades building systems to authenticate people. Who are you? Can you prove it? Do you have the right credentials?
But in an agentic world, those questions are no longer enough. We also need to establish what an agent is allowed to do, on whose behalf, for what purpose, under which conditions and for how long.
That’s the beginning of a much bigger conversation about delegated authority, digital identity and trust.
We’ll unpack that properly in Part 2.
5. Your agent doesn’t need your passwords
Which takes us to annother important design in the research paper. Meta explains that Muse’s sensitive credentials are stored separately from the AI agent, using a mechanism called credential surrogation.
Yes we’re now getting a little technical. But it really matters.
Here’s what I understand that means.
Imagine Muse needs to access your email account.
The obvious approach would be to give the AI access to the ‘authentication token’ that allows it to connect to your email service. But that creates a significant security risk, because the AI might accidentally share that token with a bad actor, or be manipulated into revealing it.
Instead, Muse works with a substitute credential.
When an approved request is ready to be sent, for example to access your email, Meta’s security tools replace the substitute with the real credential.
In other words, the AI never needs to see the original credential. It’s a smart separation between the agent’s ability to do something, and its access to the credentials that make the action possible.
But look closely, and you’ll see a bigger story, and agentic design principle, here.
Your agent doesn’t need to control your identity credentials in order to act on your behalf. Which is a big deal for those of us working on agent delegation, digital ID and verifiable credentials.
It’s going to matter enormously as personal agents begin interacting with banks, retailers, airlines, governments and other organisations.
Because the agent isn’t the customer. It’s software acting for the customer. And those are not the same thing.
We’ll come back to that in Part 3, when we look at why agents need their own identities. And why the difference between ‘impersonation’ and ‘delegation’ is going to become such a significant issue.
But for now, the important thing to remember is that Meta is building these distinctions into the architecture itself.
Not simply relying on the AI model to behave.
6. Your agent becomes a system of record
Now here’s what I think might be one of the other most important things in the entire research paper.
Meta describes the dedicated VM as the ‘system of record’ for the data that users put into Muse. A system of record is a familiar concept in enterprise technology. It’s the authoritative place where important info is stored and maintained.
A bank has its account ledger, a company has its employee database, a retailer has its CRM system, and so on.
Now Meta is applying that idea to the individual.
It’s something I’ve been banging on about since 2012. The customer can become the source of truth. An active participant with fresh, verifiable data. Rather than a ‘passive data subject’ that gets shuffled around from system to system.
The idea that the only 360-degree view of the customer… is the customer themselves. And Meta’s approach and architecture for Muse seems to be pointing exactly that way.
The research paper says that files, ‘agent-generated information’ and customer memory are all stored within the user’s computing environment. Meanwhile credentials and other sensitive information are kept in separate protected areas.
So far, so sensible.
And in a shock empowerment move by Meta, users can now inspect, edit and download their files, including information Muse remembers about them.
And that’s all very important, because a personal agent becomes much more useful as it understands more about you. Your preferences, relationships, circumstances, previous decisions, commitments, goals and so on.
Imagine an agent that knows which airline you usually fly, what time your children finish school, which subscriptions you’re paying for, when your insurance renews and which businesses you regularly deal with.
Not because one company has assembled all that information in its own CRM system.
But because the information has been brought together in an environment organised around the individual.
Of course, that raises some enormous questions. The kind of Zuck-level, make-you-freak-out kind of questions. Who can access all my Personal Agent memories? What happens if I want to move it to another provider? Who controls it?
Yes, Meta says you can download it. But downloading memory isn’t necessarily the same as moving a functioning personal agent.
Which is why we’ll explore that very distinction in Part 5. It will fast become one of the most important ‘data portability’ questions of the next decade.
But let’s step back and look at the bigger opportunity.
A digital wallet or personal data store helps you organise information. Now a personal agent can use that information to get things done.
And that takes us to the customer relationship.
7. The customer now becomes the centre of the system
For decades, digital customer relationships have been organised around businesses.
Every bank has its own app. Every airline has its own website. Every retailer has its own account. Every service provider has its own version of who you are. And each business tries to build a slightly better picture of the customer from the tiny slivers of personal data it can see, hoping that the data is even correct.
We’ve spent billions on CRM systems, customer data platforms, personalisation engines and the elusive 360-degree customer view.
But it’s all a wild goose chase.
I’ll say it again: the only 360-degree view of the customer is the customer themselves.
No airline knows everything about my journey. No bank knows everything about my finances. No retailer understands everything about my preferences. And none of them sees the complete picture of what I’m trying to achieve.
But that’s the very point. A personal agent now potentially can.
Because it starts on my side of the relationship. It can bring together information from multiple organisations, understand the context across them, and coordinate activities that no individual business could manage on its own.
Think about a delayed flight. Today, an airline might know my flight is delayed. My hotel knows I have a reservation. The car hire company knows when I’m collecting a vehicle. My family knows when I’m supposed to arrive.
But none of these organisations necessarily knows what the others know.
A personal agent can now bring that information together, work out the consequences, identify alternatives and help resolve the problem. Not because one company has built the ultimate customer platform.
But because the customer finally has their own.
And THAT’S the real AI agent opportunity.
And it’s why I think Meta’s dedicated VM matters so much. It’s not only a clever way to run AI software, but it’s potentially the beginning of a personal computing environment that’s finally organised around the individual, rather than the businesses they deal with.
But let’s not get carried away here. Meta still operates the underlying infrastructure. It builds the model. It defines the software architecture and security rules.
A dedicated computing environment isn’t automatically an independently controlled computing environment. That distinction will become a huge deal later in this series.
Because you need to ask yourself this: Do you really want Meta running the operating system for your digital life?
The underlying architectural shift here is huge. Because we’re beginning to see some credible, scalable, dare I say ‘trusted’, infrastructure for a persistent digital representative that can operate across multiple business relationships.
And it’s about time.
Should Zuck own it? Of course not. But the shift is happening and you need to be paying attention.
8. The next great customer shift is a complete reset
This is all inevitable of course. Part of what I’ve been writing about all these years. About the coming Great Customer Reset.
When you zoom out, it’s perfectly obvious. Just look at the history of personal technology.
First came the personal computer. Computing moved out of dedicated and expensive buildings because it got small enough, cheap enough and safe enough to be used in our homes and workplaces.
Then came the mobile phone. And so computing became portable, connected and available almost everywhere.
Then came the app. We gained access to an extraordinary range of personal services, from banking and shopping to travel, entertainment and communication, all from a device in our pocket.
Now comes the personal agent. The next shift in the unit of personal control.
Instead of individuals having to navigate hundreds of applications and services themselves, we can begin delegating activities to intelligent software that operates on our behalf.
Put another way, the computer gave us access to computing power. The mobile gave us access to that power wherever we went. Then apps gave us access to digital services using that power.
Personal Agents will now give us the ability to organise and coordinate those services around our own goals.
And it’s going to fundamentally change the balance of power in the digital economy. The real opportunity is much more than automating existing customer journeys. It’s going to reorganise them around the person, their circumstances and what they’re actually trying to achieve.
Which is why Meta’s technical research matters so much. Not because Muse is the final answer (far from it), or because Meta will inevitably become the dominant provider of Personal AI (many of us hope not).
But because it shows us a credible architecture for something we’ve been talking about for years:
A personal digital representative with its own computing environment, its own tools, its own memory and the ability to operate across multiple digital relationships.
And perhaps most importantly, the infrastructure to make that agent safe enough to use.
Yet the biggest breakthrough won’t be the intelligence of the agent itself. It’s more likely to be everything that makes the intelligence trustworthy enough to act.
Next up: The agent is not in charge
There’s one rather obvious problem with all of this.
What happens when you give an AI agent access to your email, your calendar, your files, your browser and eventually your money? What stops it from making a mistake, or being tricked into doing something you never authorised?
Meta has spent an extraordinary amount of engineering effort trying to solve precisely that problem.
So in the next post, we’ll go deeper into Muse’s Sentinel feature.
Plus permissions, ‘protected credentials’ and how Meta has designed their smart personal agent to prevent it from acting beyond its authority.
Remember: the future of Personal AI won’t just depend on how intelligent these systems become. It will depend on how much authority we’re prepared to give them.
My brain hurts with how much is going on right now. But this shift might be the most important thing I’ve been tracking in 15 years.
See you in Part 2.
Thanks for reading this week’s newsletter.
If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe: