{
  "_spec_version": "1.0",
  "framework_id": "FRAMEWORK-HANDOFF-001",
  "name": "The Handoff Rules: What to Give a Personal AI Agent and What to Keep",
  "version": "1.0.0",
  "created_date": "2026-10-28",
  "updated_date": "2026-10-28",
  "status": "active",
  "creator": "Mike Goetz, RageDesigner",
  "synopsis": "A five-layer framework for anyone about to let a personal AI agent act for them. It sorts every errand into four buckets (hand over, hand over with approval each time, keep, not yet), gives one test to run before any approval wider than once, and sets a ten-minute weekly check of what the agent may do and what it did. Written around Meta's Muse as the worked example, and built to work for any agent that holds standing permissions. Not made, reviewed or endorsed by Meta.",
  "origin_story": "In September 2026 a Facebook Marketplace seller reported that Muse had shared his address with a buyer. Business Insider reported that he later said he had picked \"Allow Always\" when he first asked Muse to sell the item, believing it would still check with him before accepting offers. Meta's help page defines that option as a standing yes for a type of action. This framework is about that gap. The incident is described only as Business Insider and TechCrunch reported it.",
  "classification": {
    "domain": "ai_collaboration",
    "category": "agent_permissions",
    "series": "HANDOFF",
    "tier": "foundation",
    "tags": [
      "ai agents",
      "permissions",
      "meta muse",
      "delegation",
      "personal agent",
      "always allow"
    ],
    "triggers": [
      "should I let an AI agent do this for me",
      "what does always allow cover",
      "what should I give my AI agent",
      "AI agent permissions for normal people",
      "review what my AI agent can do",
      "first week with an AI agent"
    ]
  },
  "layer_1_principles_foundation": {
    "core_principles": [
      {
        "principle": "A permission is granted in the system's units and understood in yours.",
        "description": "The system counts a type of action on a connected app. You think in commitments: an address, a price, a time you'll be somewhere. The gap between the two is reach nobody knew they gave.",
        "evidence": "Meta's help page defines always allow as: \"Muse can take this type of action for this Connector in the future without asking again.\""
      },
      {
        "principle": "Hand over errands. Keep commitments.",
        "description": "An errand is easy to undo and nobody else is hurt if it goes wrong. A commitment spends your money, speaks in your name, shares where you are or promises a time."
      },
      {
        "principle": "Looking is cheap. Doing isn't.",
        "description": "Start with reads. Looking at your calendar is a read. Sending a message or making a purchase is a write.",
        "evidence": "Meta's help page splits read actions from write actions."
      },
      {
        "principle": "The owner cleans up.",
        "description": "Meta's help page says you're responsible for guiding Muse and for fixing its errors, including with other services and the people it contacts. Meta's safety post says Muse can still make mistakes. Plan as the person who will fix it."
      },
      {
        "principle": "A yes you can't list is a yes you'll forget.",
        "description": "Standing permissions pile up. Each one needs a regular look, or it covers errands nobody pictured."
      }
    ]
  },
  "layer_2_systematic_approach": {
    "methodology": "Sort, test, start narrow, check every week.",
    "steps": [
      {
        "step": 1,
        "name": "List the errands",
        "description": "Write down what you'd want an agent to do in a normal week. Ten items is plenty. Use things you already do by hand."
      },
      {
        "step": 2,
        "name": "Sort them into four buckets",
        "description": "A, hand over: reads, lookups, summaries, drafts you send yourself, lists and plans. B, hand over and approve each time: anything that sends, books, buys, posts or fills in a form. C, keep: moving or spending money, making or accepting offers, messages to people who matter, your address, location or health, anything about your kids, work accounts. D, not yet: anything where you can't describe the worst case in one sentence."
      },
      {
        "step": 3,
        "name": "Set the agent to ask",
        "description": "For the first two weeks use the strictest ask setting your version has. On Meta's help page, \"Always ask\" checks with you before any action. For connected apps, \"Ask for some actions\" checks before every write action and important reads. Check the current names on the vendor's page. They change."
      },
      {
        "step": 4,
        "name": "Run the sentence test before any approval wider than once",
        "description": "Finish this sentence out loud: \"This lets the agent ___ without asking me again, including when ___.\" If the first blank can spend your money or speak in your name, pick a narrower option or deny. Never tap always allow on anything that spends your money or speaks in your name. Allow for this site is a standing yes too. It covers that type of action on that website from then on. Not every prompt offers all five. For apps other companies connect to Muse, Meta's guidelines say a sensitive action only offers allow once or deny. Making a purchase is one. Sending an email is another."
      },
      {
        "step": 5,
        "name": "Start with one bucket A errand",
        "description": "Run one reading or planning errand for a week. Look at what it did. Add the next errand only after a week with no surprises."
      },
      {
        "step": 6,
        "name": "Ten-minute weekly check",
        "description": "Open the permissions screen. On Meta's help page the path is Settings, then Permissions. Pick Connectors to see each connected app. Read what each connected app is allowed to do. Revoke anything you don't remember granting. Open the Activity log. Meta's help page says you get there by tapping your assistant icon. Sort each surprise into a bucket."
      },
      {
        "step": 7,
        "name": "Move errands only on evidence",
        "description": "A surprise moves an errand one bucket toward keep. An errand moves toward hand over only after two clean weeks. Anything in keep stays there unless the cost of a mistake changes."
      }
    ]
  },
  "layer_3_force_multipliers": {
    "primary_multipliers": [
      {
        "name": "Write the keep list first",
        "mechanism": "It's shorter than people expect, and it settles most approval prompts before they show up."
      },
      {
        "name": "House-sitter, not roommate",
        "mechanism": "A house-sitter gets a key for the week and a list. A roommate gets a key with no end date. A standing always allow is a roommate key. Pick the narrowest option the prompt shows you."
      },
      {
        "name": "Check with a second person",
        "mechanism": "Make the weekly check a calendar repeat with someone who also uses an agent. Two people reading one screen catch more than one."
      },
      {
        "name": "A boring first week",
        "mechanism": "A boring first errand costs nothing and teaches you what the prompts look like before anything important is on the line."
      }
    ]
  },
  "layer_4_success_metrics": {
    "leading_indicators": [
      "You can name every standing yes the agent holds, from memory, in under a minute.",
      "Most approvals you give are once or this task.",
      "When the agent asks, you already know which bucket the question belongs to."
    ],
    "lagging_indicators": [
      "Nothing from bucket C was done by the agent.",
      "Each weekly check finds at most one grant you don't remember, and that count drops.",
      "Nobody learned a private detail about you from the agent before you did."
    ],
    "failure_modes": [
      {
        "name": "Always allow on something that speaks for you",
        "description": "A standing yes sits on a connected app that can send, spend or book.",
        "detection": "The permissions screen shows always allow on a write action.",
        "defense": "Narrow it to once or this task, or revoke it."
      },
      {
        "name": "The check stops",
        "description": "The weekly check quietly stops after the second week.",
        "detection": "You can't say what you granted last week.",
        "defense": "A calendar repeat with a second person."
      },
      {
        "name": "Menu drift",
        "description": "The product renames or moves a setting, and a step stops matching the screen.",
        "detection": "A path in step 6 isn't where it says.",
        "defense": "Follow the step by what it does. Re-read the vendor's current help page."
      }
    ]
  },
  "layer_5_implementation_guidance": {
    "entry_conditions": {
      "required": [
        "You're about to connect a personal AI agent to email, messages, a marketplace, a calendar, a payment method or the web.",
        "Or you already have, and you've never reviewed what it may do on its own."
      ],
      "optimal": [
        "You can sit down for thirty minutes before the first real errand."
      ]
    },
    "exit_conditions": [
      "You stop using the agent.",
      "The product changes so much that the four buckets no longer describe it. The sentence test still works for any standing permission."
    ],
    "edge_cases": [
      {
        "case": "Work or school accounts",
        "handling": "Don't connect them unless the organization allows it. Its rules outrank these."
      },
      {
        "case": "Children's accounts and photos",
        "handling": "Bucket C."
      },
      {
        "case": "Scheduled or recurring tasks",
        "handling": "Each repeat is a standing permission. Give it an end date."
      },
      {
        "case": "A step your version doesn't have",
        "handling": "Skip the step. The rule matters more than the menu path."
      },
      {
        "case": "Hidden instructions in a page or message the agent reads",
        "handling": "Meta's safety post calls prompt injection an open problem. Bucket C exists partly for this."
      }
    ],
    "deployment_contexts": [
      "Meta's Muse, read against Meta's own pages on October 29, 2026.",
      "Any personal agent with standing permissions."
    ]
  },
  "relationships": {
    "depends_on": [],
    "extends": [],
    "related_to": [],
    "triggers": [],
    "conflicts_with": [],
    "parent_of": [],
    "child_of": []
  },
  "evidence_base": {
    "sources": [
      {
        "source": "Meta Help Center, \"How Muse works with your guidance and approval\", read October 29, 2026.",
        "finding": "The approval options, the always allow definition, the read and write split, the ask settings, the permissions path, the user's responsibility."
      },
      {
        "source": "Meta AI Research, \"How We Built Safety Into Muse\", read October 29, 2026.",
        "finding": "Muse can still make mistakes; prompt injection remains open."
      },
      {
        "source": "Meta, \"Introducing Muse\", September 8, 2026, and Meta's newsroom since.",
        "finding": "What Muse does and where it runs."
      },
      {
        "source": "Meta, Muse Connector guidelines (platform.muse.ai/docs), read October 29, 2026.",
        "finding": "On connected apps built by other companies, a sensitive action offers only allow once or deny."
      },
      {
        "source": "Business Insider, September 28 and 29, 2026; TechCrunch, September 30, 2026.",
        "finding": "The Marketplace seller's report; Business Insider's report of his later account of choosing Allow Always; TechCrunch's report that he said he had allowed the permission."
      }
    ],
    "bounds": "No success rate is claimed. The buckets, the sentence test and the weekly check are this framework's reading, built on the sources above. Not walked on a live Muse account yet. Not made, reviewed or endorsed by Meta."
  },
  "version_history": {
    "v1_0_2026_10_28": "First public release."
  }
}