Personal Programming Interfaces

Your wishes belong in the software #

An agent may be able to read a calendar, prepare a cart or book a room. That tells us what its tools can do. It does not tell us what you want, which information you are comfortable sharing or when you want to be asked.

Personal Programming Interfaces, or PPIs, are our vision for carrying those human choices into software. You explain the situation in your own terms. Useful questions help uncover the decisions that matter. Your answers should become rules the software can check.

Software connections such as APIs will continue linking services underneath. A PPI adds the person's purpose, permissions and privacy to that connection. Models may help make sense of a request; their guesses must not become authority.

Ten questions that keep people at the center #

A PPI should make these everyday questions clear:

• Who is involved, and whose wishes is the agent following?
• What are we trying to accomplish?
• What may the agent do, and when must it ask first?
• Which information may it use, for what purpose and with whom?
• What should stay separate from this situation?
• When does permission begin and end?
• What limits apply to money, time and other resources?
• Who agreed to each choice?
• What happened, and what was the result?
• How can we change our minds and withdraw permission?

These are principles for the platform we are building. They describe the future experience, rather than guarantees across every agent or provider today.

Being able to act is different from being allowed to act #

Imagine asking for help finding a weekend to spend with friends. An agent could compare the dates you choose to share. Finding a suitable weekend does not give it permission to book a room or spend anyone's money.

The same distinction applies to private information. You might share when you are free without sharing why another date is difficult. Permission to coordinate a plan is not permission to pass along everyone's private circumstances. Each person's choice matters, including when a model company or another service would receive the information.

The intended ghost browser experience makes this distinction concrete: a focused view for the agent, a private place for you to decide and the real website on the trusted side.

Keep the choice meaningful when things change #

Permission for one task should not quietly become permission for the next. If the people, purpose or important details change, the software should bring the relevant choice back to you.

Withdrawing permission should stop further work within that permission. It cannot recall a message someone already received or automatically erase earlier copies held by a service. Browser access and stored information can also have separate lifetimes. Privacy boundaries explains these distinctions and the information use that matters before you share.

A foundation for personal and social agents #

A personal agent could help with your own plans. Social agents could help us coordinate with friends, families and teams. PPIs are intended to carry people's choices through both, so useful cooperation does not depend on handing over everything.

The question-driven experience shows how a familiar situation can uncover a missing decision. Our vision explains why keeping people in control matters as agents begin to act.