1,000 words
NOTE: With perfect timing to prove my point, the auditory realism of Jack Dorsey’s Dessa is very exciting for AI productions and very alarming for the empowerment of criminals who will use it for scam calls that clone the voices of the people you know: Dessa
Here are the three main reasons this problem is not solvable by a corporate product or our existing cybersecurity systems:
Cybersecurity products cost money because their business model is subscription-based. So they have limited reach and isolated ecosystems.
A single corporation or government cannot own the root because it would allow them to change the rules unilaterally, which means no other business or government will trust it.
A corporate product receipt system would enable unprecedented surveillance of every action its users took. It could be compelled or captured by a future government, and it would result in dozens of competing walled gardens that do not compose together.
Corporate products would be our bots battling their bots in an endless war. This is not a problem that is solvable at the same level at which it exists. The solution is a decentralized open standard receipt network that any business can integrate into its workflow that composes seamlessly with other participating businesses like opting into a network of trust. I cannot say it more clearly than that.
Each business would have its own customized rules and still have a common way to check permissions and the authority to act in real time. Trust Mesh is like a native security layer added to the internet itself, gating access and authority with the biological uniqueness of its verified users. It is neutral public infrastructure where no one player is able to unilaterally change the rules, operating as a layer between hardware and software by requiring approval on an enrolled person’s phone before access is granted or a consequential action executes.
A live face or fingerprint authorizes a protected key on their phone to sign a cryptographic receipt tied to the exact action. Any integrated app can automatically check that receipt against the network’s published parameters, so a cloned voice or image created by deepfake technology cannot fake a valid authorization.
Integrating Trust Mesh into our communication apps would automatically verify the receipts tied to calls, texts, and emails to ensure the person you think is calling is who they say they are and not a deepfake bot. The authority of AI agents in Trust Mesh traces back to a human who approved a defined scope through their enrolled phone on a receipt that would carry those permissions, so the bank could verify and enforce which actions it allows, how much money can be transacted, and which recipients can be paid. Only a shared network of trust where no one can unilaterally change the rules can enable AI agents across global jurisdictions and industries.
The hard problems to solve were onboarding people on consumer phones so each body gets exactly one Slot; producing receipts that cannot be linked across services; retaining as little identifying data as possible under encrypted, distributed custody; recovering a lost phone without opening a path to fake recovery; and offering a way in for people without documents.
I spent a year attacking every design choice, and every combination of them, as they evolved. I have exhausted every possible variable to settle upon the best possible way to do this on the phones people already carry. If someone finds a better way that maintains the same privacy and security invariants, then let’s build that. Until then, I present this as the best path forward to protect humanity from this evolving era of AI technology.
The Trust Mesh app would be free to download because its business model is generating revenue through tiny fees per receipt paid by the relying parties like banks who want the added protection for their customers, so the public would not have to buy a separate cybersecurity product to be protected. Businesses would integrate the open standard themselves or pay software companies to build the SDKs, customizations, and tooling for their workflows.
I’ve come to the end of the design work. The specification is ready for independent review. The next step is measurement and a pilot. Like the internet, public infrastructure may need public funding to get started, so I will be submitting this to NIST for review and to seek support for the open standard and pilot.
I saw on X that David Sacks leans toward the idea of a decentralized solution. Since Trust Mesh is such a deep dive to get your mind around, proposals like this are far better received with a referral, so if anyone can personally send the overview below to him to review and forward to NIST, humanity thanks you. Hopefully, my submission does not get lost in a stack of others.
This has been deeply satisfying creatively and the most intense experience of divine inspiration I’ve ever felt. I have done my part. If it is meant to be, nothing can stop it; if it is not, nothing can force it. I believe it is the former.
Here’s a link to the condensed NIST specification and book: Trust Mesh Nist Specification & Book
The only new development in the overview below is the final uniqueness solution in section 7, which is the first thing to test empirically, so if you already get the idea of Trust Mesh, there’s no need to read it. Feel free to pass it along.
Below the NIST overview is the Sovereign Digital Vault article and spec. Let me know if anyone is interested.
