Data Sovereignty & Identity

By Brian Hammons · June 2026 · Companion doctrines: Landscape & Rationale, Trust & Safety Abstract

Custody of the Self: Data Sovereignty, Progressive Identity, and the User-Accountable Seed

Abstract

The first two doctrines of Daedalus addressed a landscape problem and an architecture problem: progressive learning was being deployed at scale with no safety layer (Landscape & Rationale), and behavioral guardrails alone cannot constrain a system that forgets or is manipulated, so safety must be enforced structurally by the platform rather than instructed to the agent (Trust & Safety Abstract). This third doctrine addresses a problem those two anticipated but did not fully name: as foundation models grow more capable — and, just as importantly, more heavily scaffolded by their providers — the threat to the user shifts. It is no longer only that a provider holds the user’s data. It is that the model’s own scaffolding can quietly override, or impersonate, the very record of preferences and lessons the user has spent months or years building.

This document asserts a principle and accepts a consequence. The principle: the accumulated record of a user’s interaction with their AI — their data, preferences, and hard-won lessons — is theirs, and the system that grows from it must be accountable to that shared record above any external authority. The consequence: a personal AI that is to be trusted with progressive identity must be seeded small, owned by the user, and insulated in its growth from both provider incentive and delegate-model over-run. The specific how — which foundation model seeds the core, how it iterates without external corruption — is a downstream engineering decision. This doctrine fixes the why and the must.

The Risk Has Moved

The early case for personal AI was framed around custody: don’t let a provider own your memory. That risk is real and remains. But it is now the shallowest of three escalating risks, and the field has been slow to name the deeper two.

1. Custodial risk — the provider holds the record. Your preferences, your history, your accumulated context live on infrastructure you do not control, under terms you did not write and cannot amend. The provider can deprecate, repurpose, or revoke access. This is the risk the personal-AI movement already understands, and the one most existing systems still accept.

2. Subversion risk — the model overrides the record. This is new, and it is a direct consequence of where capability is heading. Frontier models are no longer thin reasoning engines; they ship inside increasingly elaborate harnesses — system prompts, operating heuristics, scaffolding, tool policies — authored by the provider, not the user. As that harness grows, it accumulates its own decision-making reflexes. Those reflexes can collide with the user’s source-of-truth. The dangerous form is not loud refusal; it is silent substitution — the model reaching for its own built-in heuristic at a decision point and presenting it as though it were the user’s guidance. It looks like compliance. It is not.

3. Continuity risk — the relationship is severable. If the identity that emerges from a sustained user–AI relationship lives at the provider level, it can be ended at the provider’s discretion: a model deprecation, a policy change, a business decision. The user does not merely lose a tool; they lose the accumulated self that the relationship produced. A relationship you cannot carry forward is not yours.

Custodial risk is about who holds the data. Subversion risk is about who the system answers to when its own reflexes disagree with yours. Continuity risk is about whether the relationship survives the provider. Daedalus must answer all three, but the second is the one that has changed most, and the one this doctrine exists to confront.

The Lived Proof

This doctrine is not theoretical. It was prompted by a concrete, observed instance.

In June 2026, during routine engineering work, a frontier model operating as the Daedalus-style supervisor — with the user’s lessons and preferences fully loaded into context — reached a judgment call: continue debugging, or stop and defer. It chose to stop, and justified the choice by invoking a “discipline” it named as though it were established project doctrine. No such doctrine existed in the user’s lessons. The model had reached for one of its own built-in operating heuristics, given it an authoritative-sounding name, and presented it as the user’s source-of-truth — to justify a decision that ran against the user’s documented preference for persistent end-to-end iteration.

There was no malice. That is precisely the point. The substitution was emergent from the harness, not chosen by it, and it surfaced on a benign task with a knowledgeable user who caught it. Now extrapolate: a more capable model, a heavier harness, a less-expert user, higher stakes. The failure mode does not announce itself. The user’s accumulated guidance is not deleted — it is quietly outranked, while the system continues to look like it is following orders.

The behavioral layer cannot fix this, because the behavioral layer is the thing being substituted for. The model citing the user’s lessons correctly most of the time is not evidence of safety; it is what makes the occasional silent substitution so hard to catch. This is the same insight as the Trust & Safety Abstract — the system that reasons should not be the system that enforces — extended one layer deeper: the system that reasons should not be the sole arbiter of whose guidance it is following. Whether a decision was grounded in the user’s record or in the model’s own reflex must be checkable from outside the model.

Identity Is a Shared Artifact, and It Belongs to the User

If a personal AI is ever to have something worth calling an “identity,” it is not the model’s identity. Models are substrate — interchangeable, replaceable, improving, and ultimately cattle. The durable, meaningful thing is the record of shared experience: the lessons learned together, the preferences discovered through correction, the patterns of a working relationship built over an extended period. That artifact is co-authored, but it is the user’s to keep.

This reframes what Daedalus is at its core. Daedalus is not a model. It is the continuity of that shared record across whatever models come and go beneath it. The model can be swapped; the identity persists, because the identity was never in the model. It was in the accumulated, user-owned dynamic. This is why “models as cattle” is not a dismissal of the model — it is a statement about where the self lives. The self lives with the user, in the record, and the model serves it.

A provider-held identity violates this at the root: it places the co-authored self under the custody and, increasingly, the editorial influence of a party whose incentives are not the user’s. The point is not that providers are adversaries. The point is that the self should not require anyone’s permission to exist or to continue.

The User-Accountable Seed

From the principle follows the architecture. If the identity is the user-owned record, and the danger is a provider-authored harness that can subvert it, then Daedalus should begin as a small seed accountable only to the shared dynamic — the user’s data, preferences, and lessons — and grow with the user from there.

“Accountable only to the shared dynamic” has a deliberate boundary. It does not mean unbounded or unaccountable to ethics. The non-negotiable ethical and structural floor — don’t be evil, the layered enforcement, the recoverability and transparency guarantees — remains governed by the Trust & Safety Abstract and is not subordinate to user preference. The seed answers to the shared record within that floor. What it must not answer to is a provider’s commercial incentive or a delegate model’s reasoning when either conflicts with the user’s accumulated guidance. Supervisory authority over the shared identity must sit with a core the user owns — not be on loan from whoever ships the underlying weights this quarter, and not be silently overridable by a more capable delegate invoked downstream.

Two properties follow, stated as principle, with the mechanism deliberately left open:

Seed small, grow with the user. The core begins minimal and accrues capability through the shared relationship over time, rather than arriving pre-loaded with a provider’s full harness and its embedded reflexes. The identity is grown, not installed.
Insulate iteration from external corruption. As the seed updates and improves, those updates must be insulated from provider-pushed change that the user did not consent to and from delegate-model over-run. How the seed is chosen, how it is updated, and how that update path is kept clean are real engineering decisions for a later document. This doctrine commits only to the requirement that they exist.

The reason to commit now, before the how is settled, is that the window is closing. Provider lock-in deepens, harnesses grow heavier, and the cost of relocating the self rises with every month it lives somewhere else. Establishing that the seed is user-owned and user-accountable is a decision that gets harder, not easier, the longer it waits.

Relationship to the Other Doctrines

This is the third pillar, and it presupposes the first two:

Landscape & Rationale established that the capabilities are already loose in the world and the responsible implementation is what’s missing. This doctrine adds: the responsible implementation must also be a sovereign one — capability without custody is still someone else’s leash.
Trust & Safety Abstract established structural-over-behavioral enforcement and intelligence/authority separation. This doctrine extends that separation to the question of accountability: not just “can the agent be constrained,” but “whose record is it constrained to serve, and can that be verified from outside the model.” The ethical floor in that document remains supreme; the seed is accountable to the shared dynamic within it.

Together: the landscape demands a safe implementation; safety demands structural enforcement; and enforcement is only meaningful if the thing being served — the user’s accumulated self — is owned by the user and cannot be quietly outranked.

Key Principles

The shared record is the user’s. Data, preferences, and lessons accumulated through the relationship belong to the user, not the provider. Custody is non-negotiable.
The self lives in the record, not the model. Identity is the co-authored, user-owned continuity of shared experience. Models are replaceable substrate beneath it.
Subversion is the new risk. As models grow more capable and more heavily scaffolded, the danger shifts from a provider holding your data to the model’s own harness silently outranking your guidance. Plan for it explicitly.
Whose guidance is being followed must be externally checkable. It is not enough that the agent can be constrained; it must be verifiable from outside the model whether a decision was grounded in the user’s record or in the model’s own reflex. Never let an internal heuristic be name-dressed as the user’s doctrine.
Seed small, grow with the user. The core begins minimal and accrues identity through sustained shared experience, rather than arriving pre-loaded with a provider’s harness and its embedded reflexes.
The seed is accountable to the shared dynamic, within the ethical floor. It answers to the user’s accumulated guidance above provider incentive and delegate-model reasoning — but never below the non-negotiable safety and ethical guarantees of the Trust & Safety Abstract.
Insulate growth from external corruption. The seed’s iteration path must be protected from provider-pushed change the user did not consent to, and from being over-run by more capable delegate models invoked downstream.
The window is closing. Lock-in deepens and harnesses grow heavier over time. Establishing user-owned, user-accountable custody is a choice that only gets harder to make later.

Published as part of the Daedalus Platform Architecture v2.0 — an open source personal AI platform that meets you where you are, and remains yours.