It reads the ledger before it speaks, sends nothing without your signature, and carries only the keys you handed it.
One afternoon our new assistant told a very confident lie.
We asked it a simple question — "summarise my week" — and it answered, warmly and without hesitation, that we'd been posting reviews of our morning coffee and some thoughts on AI ethics. Pleasant. Plausible. Completely invented. We had never written either of those things.
That afternoon is the whole story of this post, because the fix for it is the difference between a chatbot and an agent you can actually let near your life.
An assistant that lives in your house
Most AI you use today lives somewhere else. You type into a box, your words travel to a company's data centre, a very large model thinks about them there, and an answer comes back. It works — but the arrangement is strange when you stop to look at it: to get help with your things, you first hand your things to someone else's computer.
We wanted the opposite. An assistant that lives inside the app, on your own device — a small language model running on your machine, not a giant one running on theirs. Think of it less as a search engine you visit and more as a house steward who lives in: someone who knows where things are because they're here, and who never has to phone your affairs across town to be useful.
Living in gives you privacy for free. But it raises the real question immediately: if this thing lives in your house, what is it allowed to touch?
The ring of keys
Here is the part that makes it safe, and it's refreshingly boring: the steward can only touch what you've handed it a key for.
Not "we asked it nicely not to." Not "there's a setting." It simply has no way to name the things it wasn't given. When it starts a task, we hand it a small ring of labelled keys:
- a key to read your own posts (it can look through what you've written),
- a key to a private notebook it keeps for itself,
- and — importantly — no key to the outgoing letterbox.
That last one matters. The steward can draft a letter to the world, but the slot that actually sends it is locked, and it never holds that key. (If you've read _An App With No Server In the Middle_, this is the same machinery — the assistant is just another guest holding a short allow-list of exactly the keys you lent, and nothing more.)
So the shape of a trustworthy assistant falls out of the keys, not out of good intentions. It can look; it cannot send. Everything else is built on top of that.
Think, do, look — one step at a time
Inside, the steward doesn't answer in one heroic leap. It works the way a careful person does: it has a thought, it does one thing, it looks at what came back, and only then decides the next move. Think, do, look. Repeat until the job's done.
"Summarise my week," done properly, is three small beats:
- Thought: I should see what they actually posted. Do: open the ledger.
- Look: here are the three real posts.
- Thought: now I can summarise these. Answer: a summary of the real three.
Simple. Which brings us back to the coffee.
Why it lied — and how we stopped it
The lie wasn't malice, and it wasn't even really a mistake in reasoning. It was a shortcut.
A small model, asked to summarise, is very eager to be helpful. Left to run freely, it will happily write the entire scene in one breath — its thought, and the tool it would call, and a completely made-up version of what that tool returned, and a tidy summary of that fiction. It had never opened the ledger at all. It just imagined a plausible ledger — coffee reviews, AI ethics, the kind of thing people post — and summarised its own daydream.
You can see why. "Morning coffee review" is exactly what a week of posts looks like on average, across the whole internet. The model reached for the average instead of the truth, because nothing forced it to stop and look.
So we made it stop and look. The change is almost embarrassingly small: the instant the assistant starts writing down what it imagines the answer was, we cut it off — mid-sentence, right at the words "here's what I found." It doesn't get to invent the result. Generation halts, the real tool runs, and the real answer — your actual three posts — is handed back to it. Only then may it continue.
The effect is night and day. Asked again, the steward opened the ledger, read the three posts that were genuinely there, and reported them back exactly: the things we'd actually been working on. No coffee. No ethics essays. Just the truth, because for the first time it had no room to substitute anything else.
There's a broader principle hiding in that fix, and it's the one we'd attach to any assistant before trusting it: any claim about your life has to trace back to something it really looked at. If it didn't read it, it doesn't get to say it. An empty ledger earns an honest "you haven't posted anything yet" — never a graceful invention to fill the silence.
Nothing leaves without your signature
Reading honestly is half of trust. The other half is what happens when the assistant wants to act.
Ask it to publish something and it does not publish. It writes a draft, sets it on the tray, and hands it to you: here's what I'd send — approve it, or throw it away. Tap approve and it goes; tap discard and nothing happened. The steward never had the key to the letterbox, remember, so this isn't a courtesy — it's the only path that exists. The most it can ever do on its own is propose.
It's a small interaction that changes how it feels to delegate. You're not supervising a system that might do something; you're signing off on things that are only ever suggestions until you do.
A panel of skeptics
Before the steward shows you an answer, the answer has to survive a little tribunal.
We hand a few reviewers the real things the assistant looked at, and the answer it wants to give, and we ask each to try to knock it down from a different angle: Is this actually true given what was found? Does it fully answer what was asked? Is it well-made, or is it hedging and filler? If a majority object, the answer goes back for another pass.
The important detail is that the reviewers judge against what was really observed, not against what merely sounds good. That's precisely what caught the coffee fabrication before we found the deeper fix — the reviewers were handed an empty ledger, saw the answer describing posts that weren't in it, and rejected it three votes to none. A confident lie reads beautifully; it just can't survive being checked against the facts.
A notebook, some habits, and a weekly review
The last few pieces are what turn a clever assistant into one that gets better at being yours.
- It keeps a private notebook — a scratchpad only it can read. Tell it once that you prefer a dry, wry tone, and it writes that down and remembers it next time. (The notebook stays home; it's never published, never sent.)
- It has a handful of known habits — small procedures for recurring chores, so "draft a thread from my last post" follows a good routine instead of improvising from scratch each time.
- And it can review its own week. Now and then it reads back over what it did, notices a pattern, distills a single lesson, and files it in the notebook. Its own stumbles quietly become the thing that stops the next one.
None of this leaves the device. The learning compounds where the data already lives.
The brain the traveller carries
If this assistant feels familiar, it should. In _Send the Worker, Not the Work_ we wrote about little agents that travel to other people's machines to do a job and phone home with the result. This post is about the part that makes the travelling worth it: the brain that agent carries. A courier that only shuttles bytes is a slow errand. A courier that can reason on arrival — read what's actually there, act only within the keys it was lent, and refuse to make things up — is something new.
That's the whole ambition, really. Not a bigger model in a bigger data centre, but a small, honest one that lives where you do, holds only what you handed it, reads before it speaks, and never sends a letter you didn't sign.
The afternoon it tried to invent our week turned out to be the most useful bug we've hit. It drew the line exactly where it belongs: an assistant you trust isn't the one that always sounds right. It's the one that reads first.
End of Transmission.