Ask First

Creators didn't say yes to AI. There was never a way to be asked. Ask First lets them finally say "find me, but don't become me" — live, scoped and revocable, on the AI Passport.

Comment

Inspiration

Egoist Machines exists because of a creative-rights problem. Erin McGurk has said she conceived of AI Passport after growing alarm at how her own content was being used by AI. So I started by asking a narrow question: the Passport gives you control over what assistants know about you — why does that same control stop at the door of what you make?

Then I found the gap that made this worth a week. A YC profile of Egoist put it precisely: "Revocation is only meaningful if downstream systems honor it. A receipt proves that access occurred; it does not make the recipient forget."

That is the hard problem inside the whole passport thesis. A pass today controls the tap, not the water. Once an app has read a field, revoking the pass stops future reads — it does not un-know. I wanted to find the one place where that gap does the most damage, and creative work is that place, because the harm doesn't arrive when your work is read. It arrives years later, in a generated output, when someone's voice is wearing your face.

The framing I kept coming back to: creators are not losing this because they said yes. They are losing it because there was never a way to be asked.

What it does

Ask First adds a Creative Pass to the AI Passport: live, scoped, revocable consent for AI use of a creator's work, voice and likeness.

A creator's honest answer is not one bit. It is nine independent decisions — index, quote, retrieve, train, fine-tune, style-transfer, remix, voice-synth, likeness — and each one changes depending on who is asking. Most creators want to be findable, because that is distribution. Almost none want their voice cloned, because that is impersonation. There is currently no way to say find me, but do not become me.

Today the vocabulary is a single switch in a text file:

$$\text{expressible positions today} = 2^{1} = 2$$

A Creative Pass gives each of the nine use-types a mode (allow / ask / deny), four requester-class toggles, and commercial and attribution conditions:

$$\left(3 \cdot 2^{4} \cdot 2^{2}\right)^{9} = 192^{9} \approx 3.55 \times 10^{20}$$

The mechanism matters more than the count. Published work carries only a pointer to the creator's Passport — never the permission itself — and a registered requester must resolve that policy at the moment it wants to act, not at crawl time. An approval returns a short-lived lease rather than a licence: it expires on its own, is re-verified before each covered act, and can be killed mid-job. Because the requester never holds a copy of the answer, changing your mind changes the answer everywhere.

Out-of-policy requests escalate into the Passport Inbox as proposals, deduplicated so volume never reaches the human. Every outcome — including refusals — writes a content-free receipt. And every commercial refusal becomes a priced offer, which turns a dead end into the first structured demand signal a creator gets.

How I built it

Solo, in one file. index.html is a self-contained prototype — vanilla JS, no framework, no build step, no dependencies, no network calls, all state in memory. It deploys by dragging a folder onto Netlify and runs by double-clicking.

The build is a real policy engine, not a mockup. A normative decision order evaluates credential → policy mode → requester class → protected tier → escalation → commercial condition → grant, and everything downstream is derived from it: the live lease countdown, the receipt ledger, the demand inbox, and a comparison grid on the landing page that stays wired to the policy so editing a switch moves it.

Alongside it: SPEC.md, a protocol specification with wire formats, decision order, error semantics, threat model and rollout; and a two-page PDF built with ReportLab that maps the work against the three published judging criteria, so a judge triaging 100+ entries can score it without clicking anything.

I tested it with a headless-DOM harness rather than by clicking around — 31 assertions covering the decision matrix, the revocation flip, the enumeration defence and the full guided walkthrough. I also ran adversarial reviews of my own submission, in the voice of a hostile judge, deliberately instructed not to be encouraging. That found real problems (below). AI tooling was used throughout, which the organizers explicitly encourage.

Challenges I ran into

Revocation that was a promise, not a mechanism. The first design still handed the requester a permission object. A copy of a permission cannot be taken back. Switching to a lease — a bearer handle that expires by construction and is re-verified per use — was the change that made withdrawal structural rather than aspirational.

My headline feature didn't actually work. "Different for a research lab than for an ad agency" appeared three times in my copy, and the adversarial review found that requester_class was written into the response object and never read by any branch. Every requester got an identical decision. A judge changing the dropdown would have seen the demo not do the thing the pitch was about. Fixed and now covered by tests.

I was leaking the policy I claimed to protect. My deny response returned reason: "policy.style-transfer.commercial_ok = false" — the policy path and its value. Roughly eighteen calls reconstruct the whole policy. The fix was asymmetry: the requester gets an opaque code, the creator's receipt gets the detail.

Self-declared identity made the class dimension theatre. Requester class was being read from the request body, so an ad agency could simply write "research". It now comes from a registered credential, and unregistered callers are rejected at the transport layer with an empty body — not even a confirmation that the Passport exists.

Anti-fatigue was a word, not a mechanism. I claimed "only genuinely novel requests reach a human" with no novelty detection anywhere. Replaced with real duplicate collapse, keyed on requester, use-type and commercial posture.

A CSS grid blowout. My layout used 1fr for the middle column, which silently defaults to min-width: auto — so long JSON lines forced the grid wider than the viewport and pushed a whole panel off-screen. minmax(0, 1fr). Two hours to find, nine characters to fix.

Accomplishments that I'm proud of

The honesty is the differentiator. The submission states plainly that a lease does not stop someone who already scraped a public file, and that nothing here un-trains a model. Instead of hiding that, it names the distinction between custody-based enforcement (real, where the reference material was never public — voice models, likeness reference, unreleased stems) and declaration-based enforcement (which changes what a party can later claim). Judging criterion one is literally "names the main risks or misuse concerns", and I'd rather be the entry that concedes its boundary than the one that gets caught at it.

I refused to strawman the field. It is tempting to claim nobody has built this. IETF AI-preferences, RSL, C2PA data-mining assertions and Cloudflare pay-per-crawl are all real and all named in the submission with what each does and where it stops. The delta is defensible without exaggeration: they are anchored to content or origin and read once at fetch; this is anchored to a person and read at use.

It has a business, not just a privacy feature. "Why would a scraper voluntarily call your resolver?" It wouldn't — you convince the scraper's customer. Agencies demand indemnification, so a vendor who can produce receipts can sell and one who can't increasingly cannot. Which answers who pays: requesters, for consent provenance they can put in a contract. Creators pay nothing.

Everything claimed is demonstrated. Nine use-types, four requester classes, a protected tier above registration, expiring leases, content-free receipts and the demand inbox are all live and wired to each other. The walkthrough ends by revoking a permission and re-running a byte-identical request, which flips allow to deny with nothing recalled and nothing deleted.

What I learned

Consent is an infrastructure problem wearing an ethics costume. I expected to find bad actors. What I actually found is that a company that wants permission has no address to send the question to and no way to record the answer. When the scrupulous and the shameless behave identically, you're looking at a missing mechanism, not a missing moral.

Data minimisation has to be structural or it's decoration. "We don't store more than we need" is a promise. content_hash: null, holding pointers instead of a corpus, and returning opaque codes instead of policy paths are properties. The second kind survives contact with an adversary.

Every consent system dies of fatigue. Granularity and burden pull in opposite directions: nine dimensions is more expressive and more exhausting. Standing policy plus escalation plus duplicate collapse is the only way both survive.

Asking to be attacked is worth more than asking to be praised. The single highest-leverage thing I did was have my work reviewed by a deliberately hostile critic instructed not to soften findings. It found a dead code branch, a leaked policy path and a marquee feature that didn't function. None of those would have survived a real judge.

What's next for Ask First

Not a standards coalition, and not the frontier labs. Also not "the assistant checks before generating" — MCP tools are model-discretionary, the Passport connector is installed by the prompting user rather than the creator, and a mandatory pre-generation hook would need Anthropic, OpenAI and Google each to ship one. That's a coalition of the three hardest parties to convene, wearing a disguise.

Start where consent already blocks a sale. One voice or likeness platform. They integrate because their enterprise cycle demands consent provenance, not out of goodwill — and that is the custody-based half, where the lease genuinely gates the bits. Ship three use-types: voice-synth, likeness, style-transfer.

Then: creators onboard through the page they already have at ego.ist/i/you; publishing tools next, since the pointer is one header; assistants after that, framed honestly as advisory rather than enforcement.

Nearest technical work: cryptographically signed decisions so a lease is verifiable offline rather than only against Egoist, and a proper multi-rightsholder model — a master is typically co-owned with a label and split with a PRO, so permission should be unanimous-required while refusal stays unanimous-optional. That is the least developed part of the design and the first thing a music-industry reviewer would press on.

Ninety days: one voice platform resolving in production, a few thousand creators with non-default policy, and real priced offers sitting in demand inboxes. The offers are the proof the market exists.

Built With

Share this project:

Updates

Submission history