Beyond Personal Agents, Toward Personal Intelligence

When AI begins speaking with customers on someone’s behalf, safety should be the first measure of its value. Does it protect private information? Can it distinguish an answer supported by evidence from a commitment that requires the owner’s decision? Faster responses and stronger execution become useful only within those boundaries.

Lucky Farm is the first customer onboarded onto Leptex. Its live hawthorn page presents the product, pricing by the pound, payment terms, and pickup and delivery information. An assistant serving this business needs to help customers understand that public information while respecting the boundaries around supply decisions, special arrangements, and private records. Our starting point is concrete: help customers understand how to buy hawthorn while the farm retains authority over its information and commitments.

This gives our promise—“Your personal intelligence. Built around your goals. Guided by your choices.”—a concrete meaning. The farm makes products and purchase terms available for questions, while retaining authority over private records, changing supply, and special commitments. Owners should not need to understand the permission system of every AI tool before they can protect their business. A product should make the available information and matters needing confirmation understandable in everyday use.

Leptex calls the AI we are building around that question personal intelligence. It is grounded in a person’s expertise, business principles and ongoing relationships. That person can inspect the material, adjust its permitted uses and withdraw authorization, while the system enforces those limits. Our argument is that safety provides the foundation, human agency sets the direction, and sustained value in daily operations is the test of success. Together, they determine whether intelligence deserves lasting trust.

When buyers send agents to inquire on their behalf, personal intelligence must also help merchants serve reasonable needs, verify authority, and reduce the burden of abuse. Safety boundaries protect the owner’s time and authority as well as their information.

Read the Lucky Farm customer story for a closer look at the onboarding work and the live storefront.

Safety begins with product responsibility

An ordinary business owner can judge whether a price list belongs in a customer conversation. Understanding which files, past messages or actions become available through an account authorization can be much harder. When a small task requires broad access the owner cannot assess, the product places too much responsibility for protection on its user.

Repeated permission prompts cannot solve that problem on their own. A click records a choice without necessarily establishing that the consequences were understood. NIST’s qualitative research on security fatigue documented connections between security burdens, avoidance and risky behavior. Product design therefore needs to examine both whether permission was granted and whether the choice was understandable and the default scope appropriate.

Different barriers need to be examined separately. USDA’s 2025 farm technology survey reports 85% internet access and 29% internet use for agricultural marketing within its scope; marketing includes direct sales, market advice, and price information. Connectivity, organizing online commerce, and understanding AI permissions are different capabilities. The survey does not measure farmers’ security awareness. Product teams still need to observe whether owners can understand and adjust information scopes in actual use.

A public dispute makes that responsibility concrete. On September 28, 2026, The Next Web reported that user Matt Robb said Meta’s Muse shared his address and arranged a Facebook Marketplace pickup without his confirmation; the buyer arrived at his building that evening. The report also recorded the Muse team’s response that it was investigating at the time. The public material does not establish what failed, and we do not have complete authorization records.

Meta’s official safety explanation describes isolation, separate permission checks and defense in depth. Those mechanisms should be acknowledged accurately, and a user report cannot establish that all agents are inherently unsafe. The product question we draw from this is whether safeguards protect someone unfamiliar with security terminology in actual use. A published description of controls still needs to be tested against system behavior and user understanding.

Why safety documentation cannot replace a safe experience

If users expand access that could have been limited in order to finish their work, they may weaken protection at the authorization layer. That does not mean isolation or other checks disappear. Engineering needs to examine which access was broadened; product design needs to examine why broad approval appeared necessary for normal use. Both matter. Responsibility cannot end with “the user clicked allow.”

Cloud Identity and Access Management (IAM) offers an analogy. A permission system can express precise restrictions, yet granting a task far more actions and resources than it needs does not create a least-privilege configuration automatically. AWS’s IAM best practices recommend granting only the permissions needed and refining them over time. The analogy concerns configuration and use; it does not equate an agent’s security architecture with IAM.

On a farm, explaining hawthorn prices needs product and purchase terms. It should not require opening an entire phone, private email, or other customers’ records. Asking owners to read lengthy security documentation before deciding each permission can shift learning and judgment costs back onto them. The normal path should present understandable choices: which information serves which inquiries, what still needs the farm’s confirmation, and how to correct or withdraw it. The safety experience needs to be designed with the task.

Leptex takes this responsibility as its starting point. The owner expresses business intent; the product turns it into a clear, limited and enforceable scope for information and capabilities. Secure-by-default principles from CISA and its partners likewise call on technology providers to take responsibility for product security and reduce the burden on customers. Safety should be part of ordinary use, rather than appearing only in explanations after something goes wrong.

In initial farm deployments, Forward Deployed Engineers should work through these choices alongside real tasks and ask owners to try viewing, changing, and withdrawing access. Documentation existing, someone reading it, someone completing the task correctly, and the system enforcing the restriction need separate evaluation. This work should produce clearer defaults, configuration, and product feedback rather than depend indefinitely on engineers explaining everything to each owner. Teams of any size face delivery costs; a document alone cannot be assumed to complete onboarding.

Make knowledge boundaries visible and manageable

“Allow access to my files” describes an access path. A list of materials whose contents, purposes and intended audiences can be reviewed helps an owner understand what they have actually made available. In Lucky Farm’s hawthorn business, customers need to understand the product, pricing unit, payment terms, and collection arrangements. Those materials can be organized explicitly; explaining a price does not require disclosing the owner’s household information or another customer’s contact details.

We call this manageable scope a knowledge boundary. Owners can inspect particular materials and decide whether they belong on a public page, in an exchange with a particular customer or in internal work. Adding material to a library and permitting its use in public answers should be distinguishable choices. The fact that information belongs to a merchant does not make it available to every customer.

For a hawthorn pickup inquiry, an assistant can explain the collection arrangements the farm has published. If a customer requests another location that is outside the approved information, the question should return to the farm for confirmation rather than trigger a search through private files or an invented address. Published arrangements can be explained, additional commitments need confirmation, and private records must remain protected. These are design requirements for the workflow.

If the merchant accidentally adds an image containing a home address, content previews and audience labels should help them notice and correct the mistake: change its scope, withdraw it or delete it. The product must also reduce accidental publication and ensure that subsequent answers respect the revised scope. Relying on the user to notice cannot be the entire protection strategy.

The essential connection is between two responsibilities: owners can inspect and manage material, and the system enforces isolation. A file list without access control only displays a boundary. Complex permissions without understandable information scope still leave ordinary people unable to assess what is happening. Inspectable knowledge and reliable limits need to form one product experience.

Defense in depth makes the boundaries real

Knowledge boundaries need to hold as material enters the system, answers are formed and information is maintained. Defense in depth uses complementary controls to reduce the risk that a single failure causes widespread disclosure or unauthorized action. NIST’s definition includes people, technology and operations. For personal intelligence, that principle can be understood by following the course of an exchange.

Before material informs an answer

Answers should use information appropriate to the exchange and authorized for its audience. When evidence is missing, the assistant should explain what information or confirmation is needed, rather than expand its access to produce an answer. This follows the authorization principles of least privilege and denial by default. The outcome an owner should be able to check is whether each audience receives information within the intended scope.

Owners need to establish where an answer’s evidence came from and whether it remains current. When material is missing, conflicting or outdated, the assistant should explain the limitation. Traceable evidence helps verify a fact, but accurate information is not necessarily information the recipient is entitled to see. Evidence and permission to disclose are separate requirements.

Before information is sent or action is taken

Disclosure has consequences even without a payment or order change. A public inquiry should not open the owner’s private files, and a customer asking an assistant to ignore its rules should not change the merchant’s authorization. OWASP’s analysis of sensitive information disclosure explains why confidentiality instructions in prompts are insufficient on their own. Protection requires product controls and validation in use.

Explaining a price, preparing a quote, and confirming an order require different permissions. Owners need to understand what they have allowed, and the product needs to enforce those limits when acting. OWASP’s guidance on excessive agency likewise emphasizes limiting tools’ capabilities and permissions. A product must also distinguish permission for a class of actions from approval of each individual action. Where confirmation is required, the recipient, terms, and information to be shared should be clear.

After information changes or a problem occurs

After information changes, subsequent answers should respect its revised scope. If something goes wrong, owners need a way to stop the affected collaboration, establish the basis for what happened, and seek a correction. Records kept for that purpose also need appropriate access and retention limits so they do not create new privacy risks.

Withdrawal cannot make someone forget an address already received, and rollback cannot undo every real-world consequence. That is why protection needs to precede disclosure. Validation should cover ordinary misunderstandings, accidental uploads and mistaken grants as well as malicious inputs. Being able to investigate a failure does not replace reducing the risk beforehand.

When a buyer’s agent approaches a business

Personal agents are entering commercial workflows. The Agent2Agent (A2A) protocol defines task communication between agents and specifies server-side authentication and authorization responsibilities. Google’s account of the Agent Payments Protocol (AP2) discusses mandates that express transaction intent and payment scope. These developments show concrete infrastructure being built for agent collaboration; they do not establish that all commerce will become agent-mediated. A2A specification; Google’s guide to agent protocols

For a merchant, this raises a practical question: as inquiries become easier to send, who handles receiving, screening, and verifying them? A buyer might ask an agent to compare several farms or request new quotes as their needs change. The cost of an individual exchange may fall, yet total handling costs may rise if merchants must clarify a large volume of requests one by one. This is a risk to test in practice, not a claim that agents inevitably increase costs.

Leptex wants personal intelligence to provide an initial layer of reception and protection at the merchant’s entrance. What matters is whether a request reflects a genuine need the business can serve, whether the requested action is authorized, and whether the behavior constitutes abuse. A customer represented by an agent can be a genuine buyer; a request from a person can still cross a boundary. “Human or machine” is not a sufficient judgment.

Personal intelligence also needs to protect the owner’s attention. We call its reception and routing responsibility at the entrance a “merchant-side AI gateway”: customers should receive accurate information they are entitled to access, and commitments should be confirmed by an authorized person or business process. Owners should see the work requiring their attention with fewer unrelated interruptions. Convenient service, information boundaries, and handling costs need to be considered together; response volume alone cannot evaluate the system.

Identity, authority, purchase intent, and behavioral risk are four different questions. Authenticating a caller does not establish that a buyer has authorized it to place an order. Purchase intent does not grant access to private information, and choosing not to buy yet is not abuse. Protocol-level verification must work alongside the merchant’s knowledge boundaries, business rules, and request-handling controls.

This protective layer should serve reasonable inquiries, apply appropriate constraints to repeated or anomalous requests, and route consequential commitments through verification. A judgment about purchase intent cannot replace authorization checks or justify bypassing safety boundaries. Turning those principles into a customer journey is part of the product responsibility of Chat as a Page.

From individual tasks to continuing personal intelligence

A personal agent typically works through a delegated task by accepting a goal, planning steps, using tools and delivering a result. Personal intelligence also attends to what persists across tasks: how business knowledge changes, which principles govern commitments, how customer relationships continue and how the owner corrects the system’s understanding.

This is a distinction in product emphasis, not a division between mutually exclusive technologies. Agents can use explicit sets of material, access controls and long-term memory; personal intelligence can call on agents to execute tasks. Leptex chooses to place execution within maintained business context and evaluate it through safety, reliable communication and the owner’s authority to decide.

A hawthorn order makes the distinctions concrete. “What would two pounds cost?” requires the applicable product price and terms. “Can I collect it at a different time?” requires checking the farm’s arrangements. “Can you give me another buyer’s contact details so we can combine orders?” does not justify crossing that person’s privacy boundary. Even one product creates different requirements for looking up information, confirming arrangements, and disclosing data.

A useful system should first explain prices and collection information supported by the available material, then refer special quantities or schedule changes to the farm for confirmation. In the next exchange, neither party should need to repeat context already confirmed. When harvest arrangements or sales terms change, subsequent answers need the applicable updated information. That continuity connects a single inquiry to the ongoing work of a fruit season.

Human agency belongs in everyday use

Safety gives human authority a practical foundation. A farm can delegate repeated product explanations while retaining judgment over available quantities, harvest arrangements, and exceptional orders. The product needs to communicate what the operator has confirmed about growing, fulfillment, and acceptable terms, while keeping unresolved matters visible.

Agency appears in whether an owner can correct material, understand an answer, withdraw authorization that is no longer appropriate and take over a conversation at a consequential moment. Those capabilities must be clear enough for people without technical training. Declining additional access should affect only operations that need it, while preserving public inquiries that can safely continue.

Capability and control should therefore not be treated as an inevitable tradeoff. Personal intelligence aims to reduce repetitive work while keeping its behavior understandable, open to challenge and correctable by the person it serves. Time saved can then return to creative work, professional judgment and human relationships.

Commercial value depends on lasting trust

Independent business owners repeatedly answer similar questions, organize scattered customer context and correct outdated information across channels. If owner-reviewed knowledge can be maintained and reused within appropriate boundaries, one careful explanation has the potential to improve many subsequent exchanges.

That is our commercial hypothesis: helping a person make sustained use of their knowledge could become a service worth paying for over time. Value would come from more reliable understanding, less repetitive work and clearer next steps. Document counts and model calls cannot, on their own, establish that value.

Testing the hypothesis starts with whether information and authorization boundaries hold. A sale achieved through private-data exposure or an unauthorized promise cannot count as product success. On that foundation, three areas need observation:

• Communication quality: whether answers are grounded in evidence and reflect updated material, and whether special requests reach someone with authority to decide.
• Operating burden: whether owners spend less time repeating explanations and correcting mistakes, and customers find useful answers more easily.
• Sustained value: whether users continue to use and pay for the service, and revenue covers model, service and support costs.

These are measures to validate, not growth or efficiency results reported here. Lasting advantage needs to be established through reliable behavior, business understanding and customer trust. Possessing a knowledge base does not automatically create a competitive moat.

Begin with the daily work of independent businesses

Onboarding Lucky Farm gives these principles a starting point people can inspect. The hawthorn page is live. The next tests are whether customers understand prices and fulfillment terms, whether special requests return to the farm, and whether answers remain grounded as information changes. Going live is a beginning; less repetitive work, effective boundaries, and sustained operating value still need validation in use.

The current Workspace supports viewing document summaries and parsed content, managing who may use that material, and removing it. Leptex CaaP (Chat as a Page) brings permitted business information into customers’ browsing and questions. Who provides the information, who may receive it, and when the merchant needs to intervene become product questions that can be examined in actual use.

These features do not guarantee detection of all sensitive information or correctness in every answer. The principles above are standards for design and validation, not a claim that every safeguard has been fully implemented. The product needs continuing checks that boundaries hold, users understand them, and errors can be corrected promptly.

Large companies can work deeply in these settings too. What Leptex must demonstrate is whether sustained attention to owners’ knowledge and judgment can produce a more reliable, usable product worthy of lasting trust. Focus is a choice about how to work. Users ultimately determine its value.

As capability grows, authority should become clearer

Personal intelligence is worth pursuing because expertise should not depend entirely on its owner being available at every moment. It can help more people understand a craft, a service or a piece of land while preserving the owner’s authority over how that knowledge is used.

The path needs to be complete: establish safety through inspectable, manageable knowledge and defense in depth; preserve human agency through practical controls; and test the business model through reliable exchanges and sustained operating value. Safety, human agency and commercial value address the same question: as intelligence grows more capable, does it continue to serve the person it represents?

Whether customers arrive directly or through agents, this responsibility remains: serve reasonable needs, verify consequential actions, and protect the owner’s knowledge boundaries and time.

Leptex chooses to answer through products people can use, examine and improve. Our aim is to help knowledge reach further, keep responsibility for commitments clear and enable ordinary people to participate in this change with confidence. That is our reason for moving beyond personal agents toward personal intelligence.

Read the series

This is the first part of the Personal Intelligence Trilogy, which provides the foundation for the business strategy in Leptex Master Plan, Part One. It establishes the argument for safety and human agency; the next two examine product form and operating practice. Together, they develop a continuous argument from principle to product to validation in a real business.

1. Beyond Personal Agents, Toward Personal Intelligence — Principle: establish safety and knowledge boundaries while preserving human authority. (this essay)
2. Chat as a Page: A New Front Door to Commerce — Product: help customers approach a business within clear knowledge and authorization boundaries.
3. How to Build Personal Intelligence - Start by Running a Business — Practice: improve the product through actual operations and safety validation.