This is a linkpost for https://gwern.net/guardian-angel
I’ve been working on this for a while. It’s essentially Greg Bear’s “partials” idea. In this case an agent with a high fidelity understanding of the user is sent out into the world to perform tasks that the corporeal person doesn’t need to be present for. You can be in multiple places at once. You can stay at home while you’re out of town, etc. Sounds great, right?
Here are the main problems with a digital copy and why ”partial” is probably closer to the mark.
What do all of these problems have in common? Scope. And this is where we get back to that “partial personality”.
Worried your legal proxy is going to agree to something you don’t want? Give it scope - for instance, limited power of attorney (for legal standing) to make decisions in a narrow range. Your legal partial could not make purchases online, and your shopper partial could not agree to legal settlements on your behalf.
Legality - limited power of attorney exists, and we accept human proxies all the time. This would be easier to accept than full AI standing, since it would always be tied to a human. This also solves for accountability, since the user is still responsible for its partial’s actions.
Security - we make the gold mine of personal data a full copy represents a smaller target. Your business partial may not have personal details, and you would be bound by AUPs and other standard security controls to never hand over business details to your other partials. Your legal partial would have only the information it needs for that hearing or that case, and not be able to provide any more than allowed. Plus, the agents can always be shutdown and reinstantiated anew if necessary.
Reintegration - partials would only need to update the overall system, much like meeting with a legal representative or employee, for quick, scoped integration into the whole. Compression is already built into the data model, via scoping.
Identity - the mental model of proxies allow for safer interactions since they don’t represent another full self. The center of identity stays firmly within the human, especially since each agent not only has limited function, but limited role in the larger cognitive system. They’re smaller entities to the human brain, not complete other selves.
Obviously there are challenges to this - the legal issues alone pose a huge challenge. It will take market demand to force the issue, just as so many new technologies do. However, we should be aware that proxies and even full copies are coming sooner than even we here might think, and we need to start laying the foundations for the safety of users, or it’s going to be corporate interests writing them. I don't like the idea of a Meta Digital Self(TM) and I doubt many of you do either.
Powerful LLMs will be deployed at global scale in the next few years, and will dominate the Internet, and increasingly, ordinary life. As of mid-2026, there is no coherent vision for how knowledge professionals, or ordinary people, will be able to harness these LLMs for large productivity increases, or how they will handle cybersecurity and cognitive security.
I propose a goal of creating Guardian Angels (GA): digital twin LLMs which are personalized with the goal of providing not the stereotypical "assistant chatbot agent" persona, but emulating a single user's personality, values, and preferences.
This weakly solves the principal-agent problem by unifying the principal and agent as much as possible. In a GA future, the focus of the "principal" user is on defining what is worth doing by the GA (agent) users, and not on what or how to do things, functioning as the CEO or 'board' of an 'AI corporation'. This allows them to deploy numerous agents to achieve desirable things and to handle security, like screening all messages for advanced attacks (like interlocking ecosystems of synthetic media for propaganda or spearphishing). They cannot solve larger AI alignment problems, but they can help individual humans as part of a society-wide defense-in-depth strategy.
A GA persona is productive because it learns to emulate the principal's outputs but with higher quality. It is trustworthy because it is, by definition, allied with its principal and shares its values and goals. And it is secure in part by hardwiring a single, unique, situated user (for whom following a prompt attack would be absurd), avoiding 'confused deputy' problems, while periodic upgrades of the underlying model and the defenders' advantage allow GAs to keep up with attackers.
Standard techniques like prompt programming of in-context-learning for "frozen" models will not create useful GAs due to the limitations of post-training, context windows and self-attention with frozen weights in compute-efficient-but-under-parameterized models, low-compute outputs, and the status quo of passive offline data collection---which are collectively responsible for chatbots' disappointing results in knowledge worker amplification and creative writing and fatal errors in agentic settings.
We can try to create GAs by a combination of techniques: online learning (via dynamic evaluation) to update LLMs in realtime to avoid ignorance and fatal errors while remaining competitive with frozen frontier models, sample efficiency from pretrained preference-oriented large models and active Learning by querying the principal for corrections and preference data (obtaining low regret from DAgger-style bounds), and a local CLI-first logging-oriented UI/UX paradigm.
GAs could be done as an open-source community effort, but given the need for high security in deployment and the rising challenge of APTs equipped with Mythos-scale attackers, it probably makes more sense as a startup, catering initially to power-users and knowledge workers such as CEOs or researchers, and moving downwards as it is refined.