This essay is the argument for a structural separation. A follow up gives a rule which produces the separation – Custody and Agency: The Rule. A third piece defines the terms of the rule – Custody and Agency: The Terms.
People will not host their digital lives on local devices. Most companies will not host their business on local infrastructure. Mail, files, photos, money, identity, transactions, the record of who said what to whom – all of it lives with a handful of companies, and it will keep living there.
So the question is not where your digital engagements are held and protected. It is what the holder and protector is allowed to do.
Now, with AI, the answer is: anything. The company that stores your documents also sells you the AI agent that reads them, rewrites them, sends them, deletes them, and acts in your name across the rest of the Internet. Custody and agency live under one corporate entity, one login, one set of business incentives.
That is a problem. Custody of a person's digital life and the operation of AI agents over it should be separate businesses under separate ownership. Not separate product lines. Separate companies.
Separation
Custody is the deterministic layer: storage, compute-as-a-service, identity, and the traditional software that does the same thing every time. Its promise is simple – the thing is still there tomorrow, unchanged, retrievable, computable, predictable. This includes the entire pre-AI cloud: mail clients, doc editors, spreadsheets, CRM, chat, calendar, payment apps, rules and scripts that run on a schedule, etc. All of it is deterministic – or was probabilistic in narrow, bounded ways long before what we now mean by AI – and all of it stays on the custody side. The software people already use doesn't move. What moves are the non-deterministic new actors that now show up alongside it.
Agency is the non-deterministic change layer: AI models and the agents built on them, which act on your behalf and may act differently each time. Their promise is useful change, not reliability.
The boundary between the two layers is not about the use (or not) of machine learning. Spam filters, ranking, autocomplete have been probabilistic for two decades and belong inside custody. The line is at action (change). AI that only reads may reside inside custody; AI that mutates data, sends, pays, signs, or reaches outside has to cross a well-maintained boundary under explicit terms and clear tracing of identities, incentives, and liabilities.
The FCC spent twenty years litigating where exactly the line runs between "basic" and "enhanced" services – between carrying a signal unchanged, and doing something to it along the way. That line became the Internet's baseline: the phone network had to carry everyone's data on equal terms, and everything we call the Internet – providers, websites, services – was built on top as "enhanced" services, no permission needed. Those twenty years of litigation were an investment. The Internet is our return.
Why structure, not rules
Ok, why not just functional separation: keep the conglomerates, but mandate open interfaces, interoperability, non-discrimination. It has been tried on both sides of the Atlantic – the Microsoft consent decree in 2001, the Digital Markets Act, the remedies in the Google search case – and it tends to underperform for a structural reason rather than a lack of will. The firm being regulated controls the interface it is required to open. It knows what the interface can do; the regulator learns only what the firm discloses or a rival can prove. Every rule describes the market as it was when the rule was written, and the firm is the one deciding what the market becomes. Enforcement arrives late, case by case, against a target that has already moved.
There is an older way to say this. Inside one firm, the interface between custody and agent is governed by internal organization, which management can override whenever it is convenient. Across a firm boundary, the same interface is governed by prices and contracts – visible, contestable, enforced by counterparties rather than by a regulator chasing disclosures. Functional separation tries to make an internal interface behave like a market one. Structural separation makes it a market one. And with AI, cross-firm interfacing is getting buildable and cheap.
Rules require perpetual attention from an enforcer. Ownership structure does not. A custody company that owns no agent has no reason to favor one. A custody company that owns the leading agent has every reason, and will find ways the rule didn't anticipate.
This was Glass–Steagall's logic in 1933: not that bankers were bad, but that a firm holding deposits and a firm taking risks with them should not be the same firm, because no rule could control the conflicting incentives. Whether Glass–Steagall's repeal caused 2008 is disputed; the structural insight is not.
The precedent that applies
The closer precedent is not banking. It is the FCC's Computer Inquiries, 1966 to 1986, which separated the carriage of signals from computation on top of them and imposed structural separation on AT&T. Basic service had to be offered to everyone on equal terms; enhanced services had to be a separate business. The commercial Internet grew in the gap that decision opened. The separation was written for the telephone network, before anyone was thinking of it as data infrastructure; but because AT&T had to carry any service on equal terms and could not run one inside the carrier, the same wires became a neutral substrate that anyone with a modem and a server could build on – dial-up providers, then the web – without asking the network's owner for permission or competing against it.
Deterministic custody is the new carriage. Agents are the new enhanced services. The architecture is the same, and so is the regulatory move proposed here.
The market already built models
This would not be a foreign structure imposed on the industry. The industry has already produced two models.
The integrated model: Google with Gemini inside Workspace and Search, Apple with Apple Intelligence inside iCloud. One company, one stack under rules changeable by the company. Apple's implementation is already close to a separation of agent from custody – but still subject to potentially changeable internal company rules.
Then, the participant model: Microsoft and OpenAI; Amazon and Google with Anthropic. Minority stakes, separate entities, separate brands.
Where the participant model is already in place, the ask is small: take the structure you already have and remove what makes it captive. No round-trip financing. No compute exclusivity. No governance seats. Stakes capped and passive.
Where integration is the model, the ask is larger. For Google, that means a seam Alphabet already half-draws: Cloud and Workspace are reported as a separate segment from Search, YouTube, and advertising. What would have to move across is the consumer custody that Alphabet books alongside Search – Gmail, Drive, Photos, the user accounts. It is a breakup, and a real one, but along a line the company has already started drawing for its enterprise customers.
Google is the case to watch, and not because of Search. Search (with Gemini as option) is an agent that works over the open web – data no one holds in custody for you – and the new structure does not touch it. What the structure touches is everything Google holds on your behalf: mail, files, photos, the account, the software tools, the cloud. For a Google agent (Gemini) to operate on those, it must cross the boundary like any other external AI agent. How that reshapes Google's business is a question too large for this essay and one Google has likely been thinking about longer than its critics have; a company that has watched AI change how people query the world is not waiting for regulators to tell it that the ad model will have to change shape around it. Google's answer will reveal whether structural separation would be an imposition or where the industry is already going.
Then Meta – the limit case. Meta's AI ambition is precisely the fusion the structure forbids: models grounded in the live interaction flows of billions of people. The capability would be almost surreal – a model continuously fed by the world's conversations is the closest thing to a real-time model of society anyone could build. But conversations are not just data about the world; they are where the world's sense-making happens. An agent layer fused with custody of that flow does not merely observe it – it speaks inside it, everywhere, at once, steered by one company's incentives. Then prediction – fused with presence – stops being prediction: a system that reads where the world's conversations are heading, and can speak inside all of them at once, does not forecast the future of culture – it manufactures it.
No prior concentration of power has had that shape. The proposed structure's answer is not that the capability must not exist. It is that it must not be one company's organ. It should be subject to the best framework humanity has produced so far – regulated markets. Under separation, Meta's custody side becomes the most valuable context provider on earth, selling privacy-preserving grounding access across the boundary – including to its own former AI lab on the same terms as everyone else.
The separation affects the agent side too
This is not only an argument against hyperscalers. AI agent vendors have started holding custody: memory, uploaded files, project context, the accumulated record of what you've told the agent. That is a digital life under the control of a non-deterministic actor, which is the exact configuration the structure aims to prohibit.
Under separation, context lives on the custody side. Agents visit it and work on it under clear mutually-agreed upon limitations and liabilities.
This is buildable
The objection that you cannot compute over data you don't hold has been answered in practice. Privacy-preserving machine learning – the line of work Andrew Trask and OpenMined call structured transparency – sends the computation to the data and returns only the result. The data doesn't move. The boundary allowing reads is already engineered.
The boundary allowing acting (changes) is older: capability-based security. The idea is that being logged in should not mean being allowed to do everything. Instead, each permission is a separate key – this agent may send this mail, and nothing else – handed over at the boundary, recorded there, and taken back when the job is done. An agent holds only the keys it was given. This has been understood in computer science for forty years.
There is a cost. Keeping data and the agent that works on it in different companies means extra steps, extra milliseconds, extra engineering. This objection was raised against every previous separation – the phone network, banking – and each time the answer was the same: the industry agreed on standard ways to connect, and the cost shrank until no one remembered it.
Shareholders come out ahead
The strong form of separation sounds like expropriation. History says otherwise.
Standard Oil's shareholders were richer after 1911 than before. The Baby Bells outperformed the market after 1984. Breakups have been enrichment events for shareholders: each business, valued on its own, turned out to be worth more than its implied value as part of the conglomerate.
And the custody business is not the dull utility it sounds like. In an economy where models commoditize, the durable asset is data that agents can compute over but never take – the one moat that survives, as Andrew Trask puts it, if you can market it without sharing copies (via privacy-preserving ML). Enabling this capability for their customers would be the "enhanced" layer of the custody company's business. Separation hands it to them outright.
Who charges whom follows the old basic/enhanced line. Holding, retrieval, and the boundary itself are the mandated layer, open to every agent on equal terms. Access to what is held is on terms set by the party it is held for – consent for most people, a real market for organizations whose data is the rare asset. And the services that make that market work – matching, metering, attestation, computation without copies – are the custodian's enhanced business, priced as it likes.
The hyperscalers already know this. The participant model exists because they want the upside of agent-layer growth without the regulatory exposure of owning it. Separation says: keep the upside, lose the control. No sacrifice is asked of shareholders. It is a good trade.
What it does for safety
With separation, three things become possible that are not possible inside a single company. Every agent action on what is held in custody crosses a logged interface, so there is an audit point that the agent vendor does not control. Agent failure cannot propagate into custody without crossing that interface; the agent's actions become visible and capability-limited. And liability splits into a deterministic category insurers already know how to price and a probabilistic one they will learn to, instead of a blend no one can.
The safety field is itself moving this way – from alignment as a property of a model to alignment as a property of the systems and institutions a model operates in… Séb Krier's "Of Swarms and Sand Gods" is the clearest statement. The structure proposed here is that move carried one layer further: to the layer where institutions are owned. A boundary built by the company that profits from the agent can be quietly relaxed by that company. A boundary owned by someone else cannot.
This is environment-architecture safety. It partitions risk by layer, as proposed here at the scale of the whole economy, in one structural move: a failure in the agent layer stays in the agent layer. It makes that layer safe to lose control of without major consequences for the data held on the custody layer infrastructure.
The politics
Separated custody becomes a utility, with the obligations utilities carry: interconnection, non-discrimination, probably oversight of terms. That is what custody of a person's digital life or a company's business should be.
There is a choice here that large concentrations of power have faced before: manage it down on your own terms, through structures that keep the shareholders whole, or wait for the terms to be set by people who will not be consulting the shareholders. Think Roosevelt and Glass–Steagall. Structural separation has never happened in advance of the failure that made it obviously necessary in retrospect. Not many reasons to hope for a different scenario this time. But then – all the reasons to have the structure in place to contain the potential failure.
I spent two decades building the custody/agency architectures this essay is about: interaction at Akamai's edge, a distributed-identity platform (Keeam, 2012) built on the premise that a person's identity and contexts should be held separately from the services that act on them.
The legal and economic arguments were drafted with Claude (Anthropic), which is itself an agent-layer product and would be bound by the separation proposed here. Yes, Anthropic might be a beneficiary of the proposed separation – but that's how our system works – sides with interests having conversations and making trades.
---------
Co-written with Claude (Anthropic).