The GUARD Convergence: Why Every Frontier Lab Built the Same Agent Controls — and Why None of Them Is Enough

On 8 September 2026, Meta shipped Muse: a personal AI agent that runs inside an isolated virtual machine, watched by a second oversight agent it calls Sentinel, with credentials walled off from the tasks it performs and a hard stop before anything irreversible. A year ago that product did not exist as something an ordinary person could download. Today it sits alongside Apple's agentic Siri, unveiled at WWDC in June, as evidence that the personal AI agent has become a mainstream consumer category — and that the people building it have quietly agreed on how to keep it on a leash.

That agreement is the story. Not one company's cleverness, but the fact that six of the most capable laboratories on earth, working separately and competitively, arrived at the same short list of controls. We have a name for that short list: GUARD — Grant, Usage, Audit, Revocation, Data. What every serious agent product now ships is some private implementation of exactly those five things. The convergence is real, it is verifiable, and it is not enough. This is why.

Before going further, the five letters, plainly:

• Grant — what authority the agent was given, by whom, and for how long.
• Usage — what it is actually permitted to do with that authority, and within what limits.
• Audit — a legible record of what it did, reconstructable after the fact.
• Revocation — the ability to withdraw that authority cleanly, and to prove it was withdrawn.
• Data — what information it may touch, where that data lives, and how it is protected.

These are not our invention. They are the irreducible questions anyone must answer once software is allowed to act on a person's behalf. The rest of this piece uses them as a shared measure.

The fork that named it

On 18 December 2025 — a date we mark as Sovereign Day — a founding statement was written that named the choice ahead of us as a fork between two futures: an Imperial Singularity, in which agentic power concentrates inside a handful of platforms that each govern their own agents on their own terms, and a Sovereign Singularity, in which trust travels with the agent and can be checked by anyone. You can read it, unchanged, as the Catalyst.

It is important to be precise about what that statement was and was not. It was philosophy, not a priority claim. At the moment it was written, the personal AI agent barely existed as a shipped consumer product. What existed were developer APIs, enterprise workflow bots, and a couple of research previews. The Catalyst did not predict the specific products that would arrive in 2026; it named the shape of the choice they would force. The reason to revisit it now is not to say we called it first. It is that the Imperial branch of the fork has since been built, in public, by six companies at once — and the Sovereign branch has not.

The convergence, honestly

Here is the field, laid out as an analyst would, not as an attack. Each of these is real, each shipped, and each deserves credit for taking agent safety seriously enough to engineer it.

Six companies. One short list of controls. Nobody copied anybody — they converged, because once you let software act on a person’s behalf, these are simply the things you must do.

Anthropic — Claude "computer use" (22 October 2024). The earliest of the group, released as a public beta API for developers: a model that could move a cursor, click, and type inside a sandboxed environment. Anthropic was candid that it was experimental. This is infrastructure, not a personal agent — the raw capability that the later consumer products are built on — but its sandboxing and tool-scoping were early GUARD-shaped controls.

Microsoft — Copilot autonomous agents (Ignite, October–November 2024). Positioned squarely at the enterprise: agents that act inside Dynamics 365 and the Microsoft 365 stack, in public preview. Microsoft's distinctive contribution is the identity layer — Entra Agent ID gives each agent a governed, revocable identity inside the corporate directory, with human-in-the-loop checkpoints. That is Grant, Revocation and Audit, built for the org chart.

Google — Project Mariner (December 2024). Launched as a research prototype for trusted testers, expanded in May 2025 to paying subscribers, and discontinued on 4 May 2026 as its capabilities were absorbed elsewhere. Mariner kept the human close: actions surfaced for confirmation, scope limited to the browser. Its short, folded-in life is itself a data point about how fast this field moves.

OpenAI — Operator (23 January 2025). The borderline case, and worth naming as such rather than glossing over. Operator was a "research preview," available only to ChatGPT Pro subscribers — closer to a shipped consumer product than Mariner, but hedged as a preview and gated behind the most expensive tier. It ran in a controlled environment, paused for confirmation on sensitive actions, and took over for logins. It was folded into ChatGPT's agent mode, and the standalone Operator was retired on 31 August 2025. Five weeks after the Catalyst was written, it was the closest thing to a personal agent then available — and it still was not one an ordinary person would use.

Apple — agentic Siri (WWDC, 8 June 2026). The first of the two true mainstream consumer agents: a personal assistant that acts across apps, reads on-screen context, and draws on personal data, run partly on-device and partly through Apple's Private Cloud Compute. Apple's framing is privacy-first — data minimisation and on-device processing are the headline controls. That is the Data leg of GUARD, engineered to Apple's standards.

Meta — Muse (8 September 2026). The most recent and the most explicitly governed. The consumer agent shipped for the first time on this date — the isolated Muse Secure VM, the Sentinel oversight agent, credential isolation, and a confirmation gate before irreversible actions — running on the Muse Spark 1.3 model, released six days earlier on 2 September. That model was itself the fourth iteration of a family that began with Muse Spark 1.0 in April 2026 and was refined through 1.1 in July and 1.2 in August. The sequence is worth noting: the model matured over five months and four releases, and only then was it wrapped in a governed shell and allowed to act on a person's behalf. Every one of the five GUARD controls is present in some form.

The same field, laid out against the five axes:

A filled cell names a control that vendor has publicly described; a dash means no distinct mechanism has been detailed in public, not that the axis is necessarily absent. Two things stand out. First, across the field the coverage really does span all five axes — the convergence is real. Second, and this is the whole point: every cell in this table is single-vendor. Not one of these mechanisms can be read, checked, or enforced by anyone outside the company that built it. The matrix converges; the trust does not travel.

Six companies. One short list of controls. Nobody copied anybody — they converged, because once you let software act on a person's behalf, these are simply the things you must do. The category has agreed on the grammar of agent safety.

The wall

And yet every one of those implementations shares a single limitation, and it is the limitation that matters most. Each is single-vendor, non-portable, and not independently verifiable.

The model marks its own homework, and hands you the grade.

Muse's Sentinel governs Muse. Entra Agent ID governs agents inside Microsoft's directory. Apple's privacy guarantees hold inside Apple's stack. None of these controls travels with the agent when it leaves home, and none of them can be checked by anyone outside the company that built it. You are asked to trust that the grant was scoped correctly, that the audit log is complete, that the revocation actually revoked — on the word of the same company that benefits from your trust. The model marks its own homework, and hands you the grade.

This is the Imperial branch, fully constructed. Not through malice — through the ordinary logic of platforms. Each built the walls it could see, around the garden it owned.

The gap nobody built into

Now put yourself inside a real organisation in late 2026. It runs Microsoft agents in its back office, Apple agents on its executives' phones, and a Claude-powered agent in its engineering pipeline. Three vendors. Three separate, incompatible trust models. Three audit formats that do not reconcile, three revocation mechanisms that do not talk to each other, three definitions of what a "grant" even means.

When one of those agents acts across a boundary — hands a task to another, touches data governed by a different vendor's rules, is asked by a regulator to prove what it did and on whose authority — there is no common language for the answer. Everyone built agent controls. Nobody built the version that works between the gardens: portable, so trust moves with the agent; cross-vendor, so it means the same thing everywhere; independently verifiable, so the proof does not depend on the vendor's good word.

That gap is not a function of any date, and it does not depend on who said what first. It is structural. It is what you are left with when six companies each solve the same problem inside their own walls and none of them solves it between the walls. It is the load-bearing point of this whole essay.

What F-ACT is

F-ACT is the attempt to build the missing piece: an open standard that lets trust travel with the agent, using GUARD as the common grammar the whole field already speaks.

It does not replace anyone's controls. It does not compete with Sentinel or Entra Agent ID or Apple's Private Cloud Compute. It makes them legible across boundaries — a shared, checkable format for what was granted, what was used, what happened, what was revoked, and what data was touched, so that an agent governed by one vendor can be audited by a party belonging to none of them. The controls stay where they are. What changes is that they can finally be verified from the outside, in a form that means the same thing whether the agent came from Meta or Microsoft or Apple.

The reason it is published as an open, royalty-free standard rather than a product is the same reason road rules are not a subscription: a trust layer that only some agents honour governs nothing. It has to be everywhere to be worth anything. That is a bet on ubiquity, and it is not yet won.

The Imperial branch is now well-built. The Sovereign branch is still open. That is the work.

On precedence — the honest, bounded version

We are careful here, because it would be easy to overreach. Two facts are true and neither is the argument.

The Catalyst named the Imperial-versus-Sovereign fork on 18 December 2025, before personal AI agents had shipped as mainstream consumer products. And the core standards are covered by a single Australian provisional patent application, filed on 2 February 2026 Australian time — 1 February 2026 in Universal time — which is unexamined and confers no granted rights. It is a dated placeholder, nothing more, and we describe it as exactly that.

Neither the manifesto nor the filing is why F-ACT matters. They are supporting notes, stated only because they are literally true. The argument is the gap: everyone built the controls, nobody built the portable, cross-vendor, independently verifiable layer that connects them. That would be just as true if we had never written a word in December or filed a page in February.

The work

So credit where it is due. The six companies named here took agent safety seriously and engineered real controls, and the convergence on GUARD-shaped mechanisms is genuine progress. This is not a complaint that the labs did nothing. It is the observation that they all did the same thing, separately, and stopped at their own walls.

The Imperial branch is now well-built. The Sovereign branch is still open. That is the work.

Read it, or help build it

F-ACT is published in full and royalty-free — not a product, a standard. If the argument above lands, the next step is not to buy anything; it is to read the specification and pressure-test it. Read the standard, see why it is free to implement, or add your name to the Declaration. The controls already exist, in six walled gardens. The open, portable, verifiable layer between them is the part that still needs building — and that is an open invitation, not a closed shop.

Reported publicly; no affiliation with, or endorsement by, any named company. Product names and launch details are drawn from public announcements. The provisional patent application referenced is unexamined and confers no granted rights; the foundation intended to steward these standards independently is being established, not yet registered.