Speak As Me

Inspiration

Track: Agents · Lane: Concept

Where can AI Passport be used best? Governing what is allowed to act as you — not just what apps may read about you.

I run the outbound agent for a seed-stage startup. My founder's name goes on messages I never wrote, and his voice goes on videos I scripted, both with his permission. One evening I looked at a prospect's reply and realized he had no way to know any of that. He was answering what he thought was a founder. He was answering me.

Then I read what AI Passport does: apps request context for a stated purpose and duration, you approve, receipts record it, you revoke whenever. Every piece I needed already existed. It just pointed the wrong way.

What it does

Speak As Me adds outbound grants to AI Passport. The passport governs what apps can see about you. An outbound grant governs what can act as you.

A grant carries five fields:

• Who authorizes — the passport holder
• Who acts — the agent instance and its human operator
• What for — a stated purpose, e.g. sales outreach
• Until when — a validity window, e.g. 30 days
• Where to check — the holder's public passport page

The agent attaches a verify link to every message. A recipient clicks it, lands on ego.ist/i/handle, and sees four things: authorized by Tarek Zaghloul, purpose sales outreach, active, expires 10 September. A spoofed or revoked grant resolves to nothing.

Voice runs the same grant with a different purpose field, verify link embedded in the video's content metadata. When the founder revokes, published videos stop resolving as authorized, and any unlabeled clone of his voice reads as fake by default.

The holder issues and revokes every grant themselves, using the same per-app control the passport already has. Operators and agents hold grants; they cannot mint, extend, or pass them on.

How we built it

Concept lane, so the work was reasoning rather than code. I started from the failure modes I hit weekly running the outreach system, wrote down what a recipient needs in order to distrust a message safely, then stripped the design until the only thing traveling with a message was a link.

Two drafts died along the way. The first invented a signing registry and a revocation endpoint. Reading the actual product killed both — the approval flow, the receipts, the per-app revoke, and the public handle page already cover it. The final design adds one grant type and one section on a page that already ships.

Challenges we ran into

How much to disclose. Early versions showed recipients the operator's name and the agent's configuration, which is more than anyone needs to answer "is this authorized." It came down to four fields.

The public page cuts both ways. It solves verification, and it also broadcasts which agents you run and when your campaigns are live. Grants therefore default to link-resolvable instead of publicly listed: hold the link, see the grant; browse the page, see nothing.

Admitting what a grant cannot do. Once a voice model exists, revocation does not delete it. An operator who goes rogue keeps synthesizing offline.

Accomplishments that we're proud of

The design adds no new infrastructure. Purpose, duration, approval, receipts, revoke, and the public page all exist. Outbound grants reverse the direction of a flow Egoist already shipped.

I also named the risk that cuts against my own proposal: a grant is proof the holder authorized a class of action, so a founder cannot hide behind "the agent did it." That is the point. The passport proves delegation without excusing it.

What we learned

Detection is losing. Everyone is building classifiers to spot synthetic content after it lands, and the fakes keep improving. Proving the authorized case is the tractable half, and it flips the default so unverified output carries the burden.

I also learned how much I had been running on implicit permission. My founder said yes to the voice clone, but no artifact anywhere recorded what he said yes to. Writing this memo made me get that in writing.

What's next for Speak As Me

v1: outbound grants as a grant type, plus a verify view on the public page. One issue screen, one verify link, one revoke button reusing the existing control. Voice ships second on the same flow.

Beachhead: seed-stage founders running outbound agents. They feel the impersonation risk personally and adopt tooling in an afternoon. I would set both up for my founder this week.

Beyond outreach: the grammar generalizes unchanged — who authorizes, who acts, what for, until when — to agents that negotiate, purchase, and schedule on your behalf. Outreach is where the pain is loudest today, not where this stops.

Built With

• claude