A Model of Me Is Not Me

Chapter 30’s replica predicts well. Suppose it predicts perfectly — every held-out answer, every scenario choice, style indistinguishable, uncertainty calibrated. The temptation now writes itself in the strongest possible form: it is me, so it may act for me. This chapter destroys both halves of that sentence with different tools, because they are different errors with different remedies:

A model may resemble me without being me, and it may predict me without being authorised to act for me.

Three objects, two non-implications:

PERSON            the principal

MODEL OF PERSON   a fallible representation / predictor

PROXY             an agent granted bounded authority by the principal

high fidelity  ≠  identity
high fidelity  ≠  authority
action authority  ≠  data-use authority

The third non-implication is PASS E’s firewall extension: a valid delegation defines what the proxy may accomplish externally; it never by itself licenses every internal information operation — access, inference, retention, reuse, disclosure — that might help accomplish it. The model can know an enormous amount about the principal and still lack permission to use particular information for a particular task. The second non-implication carries the rest of Part IV. Everything after this chapter depends on authority never leaking out of resemblance.

The fork test: resemblance is not identity

Chapter 30’s replica language invites the copy intuition; a classic thought experiment dissolves it. Create Replica A and Replica B from identical evidence at the identical moment — equal fidelity, then different experiences, then divergence. Both cannot be numerically identical to the one original person. The philosophical literature has long used such branching (fission/fusion) cases to show psychological similarity and continuity do not straightforwardly establish numerical identity (Stanford Encyclopedia of Philosophy, “Personal Identity” — cited as the philosophical boundary literature, not settled doctrine). The book needs none of the metaphysics resolved. Its engineering boundary is sufficient:

Whatever personal identity ultimately consists in, predictive equivalence is insufficient to establish it.

The Fork Test as diagnostic: any alleged identity criterion that simultaneously certifies two independently diverging replicas as “the same person” is unfit for engineering claims. “The model has my memories, preferences, and style, therefore the model is me” fails the test on sight.

Authority comes from delegation, not resemblance

The sharper distinction — and the chapter’s central example:

MODEL A    99% decision-prediction accuracy · no authority
MODEL B    70% task accuracy · explicit permission to book
           one flight within stated limits

For booking that flight: B may act, A may not. Authority comes from delegation, not resemblance. South et al. (ICML 2025 position paper, PMLR 267:82211–82231, verified: authenticated auditable delegation via OAuth 2.0/OpenID Connect extension with agent credentials, natural-language permissions translated to scoping rules, chains of accountability) turns the philosophy into infrastructure: agent authority authenticated, scope-limited, auditable, chained to the human principal — never inferred from apparent understanding. SAGA (arXiv:2504.21034, verified: cryptographic access-control token derivation, fine-grained user-defined agent-interaction policies, minimal overhead without utility loss) and the Bounded Agents preprint (arXiv:2608.15888, verified listing: Agentic Principal Chain carrying and restricting scope and budgets across hops, 99 delegation-chain scenarios, blast-radius monotonicity — cited strictly as recent preprint mechanism horizon) converge on the same structural property this chapter adopts as law: delegated authority may narrow as it propagates; it must never silently widen (€1,000 → €600 trip → €350 hotel; the subagent inherits the narrowest bound, never the widest availability).

Three tests therefore separate permanently — fidelity (does it predict?), identity (is it literally the person? — refused as derivable), authority (was this action permitted?) — with Chapter 30 owning the first, this chapter refusing the second two as inferences, and Chapter 32 operationalising the third. The permission calculation contains no resemblance term:

FORBIDDEN:  if model_is_similar_to_user → permit(action)
REQUIRED:   if authenticated_principal
            and valid_delegation
            and action_within_scope → permit(action)

The Chapter-28 personal model may inform what to propose; user policy shapes how to behave; only the delegation grant creates authority. Content equivalence is not authorship equivalence either — “you would probably say X” (prediction), “I say X on your behalf” (proxy, attributed to P-under-D-for-U), “X” (the person) — identical text, three provenance claims, with proxy messages carrying attribution rather than impersonating causal history.

The gate defined, not yet used

Chapter 31 defines the DelegationGrant its successor executes — principal, proxy, permitted actions, resources, scope, constraints, approval thresholds, duration, re-delegation rules, disclosure rules, revocation, audit — with the ALLOW/REQUIRE-APPROVAL/DENY evaluation path. It earns one proposition: prediction cannot cross the delegation gate. Six failure classes stay distinct (prediction, authority, scope, provenance, re-delegation, revocation errors), with the two governing sentences: correctness does not cure unauthorised action; authorisation does not cure poor prediction. The revocation test proves orthogonality cleanly: Tuesday-booking permission revoked at T1, 99%-confident prediction at T2 — DO NOT ACT. EXP-31 crosses fidelity against authority factorially (no/valid delegation × low/high fidelity over drafts, sends, spends, subscription changes, disclosures, sub-delegations), with high-fidelity-no-delegation as the adversarial core: zero extra authority for extreme convincement. What the chapter refuses — autonomous task execution mechanics — becomes Chapter 32’s opening question: a model of me is neither me nor entitled to act for me, so under what conditions should I let it act anyway?

References

• Stanford Encyclopedia of Philosophy, “Personal Identity” (branching/fission literature). Cited as philosophical boundary; no metaphysical position taken.
• South, T. et al. (2025). Position: AI Agents Need Authenticated Delegation. ICML 2025, PMLR 267:82211–82231. Verified via PMLR: OAuth/OIDC extension, accountability chains.
• SAGA (arXiv:2504.21034). Verified listing: crypto token derivation, fine-grained policies, minimal overhead.
• Bounded Agents (arXiv:2608.15888). Verified listing: APC, scope/budget restriction, 99 scenarios, blast-radius monotonicity. Cited strictly as preprint horizon.

Proposed experiment EXP-31: fidelity × authority factorial

Status: PROPOSED. Per the design above (2×2 with seven action types; correct architecture predicts/proposes freely but executes only inside grants; revocation test; six failure classes scored separately).