Personalization Can Mean Protection

Chapter 26’s friction lives in one interface at a time: tonight’s news boundary, this study session’s queue. But the reader’s boundaries are not per-service — “no infinite continuation during FOCUS” is true of video, podcast, news, and feed alike — while every service implements its own controls, defaults, and engagement objectives. Configuring each separately is unwinnable labour; worse, each service’s controls optimise that service’s goals. This chapter asks whether the user can carry boundaries across services without surrendering a behavioural profile to every service:

Can the user carry those boundaries and preferences across services without surrendering a giant behavioural profile to every service?

The policy travels. The history does not necessarily need to.

Portable policy, not portable profile

The object is a boundary policy with purpose, scope, and provenance — not a dossier:

PersonalBoundaryPolicy {
    rule · purpose · scope · allowed_contexts
    prohibited_uses · enforcement_strength
    exceptions · expiry · provenance
}

RULE  Do not auto-play additional media after my planned set.
APPLIES TO  video / podcast / short-form feeds
EXCEPT  explicitly opened queues
SCOPE  all connected media services
OVERRIDE  always available   SOURCE  user-authored

RULE  Do not use inferred engagement to increase
recommendation volume.
APPLIES TO  news / social / video
ALLOW  explicit + semantic subscriptions
SOURCE  user-authored

Three layers execute it: USER-OWNED POLICY (permit/prefer/forbid) → SERVICE ADAPTER (translate into the controls each service actually exposes) → ENFORCEMENT RECEIPT (applied, refused, unsupported, overridden). The receipt is load-bearing: “Video: autoplay disabled. News: finite digest enforced. Podcast: no compatible control — UNSUPPORTED.” The system must never simulate compliance — a protective policy is not protection until there is an enforcement point, and unsupported enforcement is reported, not hidden. Capability discovery precedes enforcement (SUPPORTED/PARTIAL/UNSUPPORTED/CONFLICT per rule per service), and extended precedence keeps engagement objectives permanently below explicit user policy: LEGAL/SAFETY > CURRENT OVERRIDE > PORTABLE BOUNDARY > SERVICE-SPECIFIC RULE > LEARNED POLICY > SERVICE DEFAULT, with service engagement never outranking the user. Two doctrines arrive with the cross-service scope. First, least privilege over the composed workflow: calendar plus email plus contacts plus browsing history jointly reveal more than any single permission suggests, so adapters reason about the combined data surface — and each adapter’s data access itself needs authority (what policy travels, what data is required, what stays local, what is inferred, what is retained), not just its enforcement mandate. Second, relational privacy: possession of a message, event, or contact record never makes everything inside it freely reusable — my account ≠ only my information — stated as fence, not treatise.

Wu et al. (CHI EA 2025, DOI 10.1145/3706599.3719900, verified: Wu/Liu/Wang/Yao, dual-control mechanism over data collection and tailored-content degree, 161-participant between-subject study) supplies the chapter’s central agency lesson with unusual sharpness: transparency alone proved insufficient for agency — worse than outcome display in perceived control — while combined transparency with actionable controls, particularly over recommendation outcomes, significantly improved it. The chapter’s formulation: “why this happened” is not enough if the user cannot change what happens next. Wozniak et al. (WWW Companion 2025, part-read, numbers held) supports authoring-over-exposure from the preference side: explicit controllable textual representations beating history-only ones.

Minimum disclosure, semantics without justification

Portability must not require centralised surveillance. The tempting architecture — collect everything everywhere into one decider — builds precisely the substrate protective policy should resist. Instead: minimum required policy, local scoped enforcement. A service told “do not autoplay after current item” does not need the rule’s rationale, the user’s cross-service history, or the full Personal AI policy. Policy semantics (required behaviour) travels; policy justification (why the person chose it — “reduce job-related anxiety after 21:00”) normally stays private. That is contextual integrity as implementation discipline, and Wang et al.’s Privacy in Action (Findings EMNLP 2025, pp. 17055–17074, verified via Anthology: PrivacyChecker, contextual-integrity-based mitigation, leakage 36.08%→7.30% DeepSeek-R1 and 33.06%→8.32% GPT-4o with helpfulness preserved; PrivacyLens-Live dynamic MCP/A2A environments showing higher practical risk) gives it empirical backbone at the agentic layer: enforcement at the information-flow point works, prompt-text policy alone leaks. Numbers cited as their benchmark’s, lesson imported as architecture.

Testing portability and leakage together

EXP-27 freezes one user-authored policy set across simulated news/video/social/research/shopping/inbox services: A independent defaults; B transparency only; C service-local controls; D manually translated portable policy; E portable policy with capability-aware adapters, minimum-disclosure enforcement, and receipts. Headline: how much declared policy was actually enforced, at what disclosure cost, with how many silent failures — compliance, conflicts, unsupported rules, corrections, cross-service consistency, information disclosed, unnecessary sharing, override success, false enforcement claims, task utility kept separate. Adversarial battery: missing capability (must declare, not simulate); excessive context demands (reject/minimise); global-vs-scoped conflicts (scoped explicit wins); expiring exceptions (no durable residue); post-API-change staleness (receipts fail loudly); over-broad propagation (spoiler-hiding must not become entertainment suppression — locality again). Failure criteria: E ties C (portability decorative); silent failures nonzero and unreported (theatre); disclosure exceeds minimum without utility gain (surveillance pricing); B ties E on perceived control (Wu contradicted — kept as live risk). Artifacts: policy packs, adapter matrices, receipts, disclosure ledgers, locality audits. What success would not justify: any claim about the system’s internal beliefs — portable authority is rules in motion, and the state it infers about the person remains unexamined. Rules now travel. But a second body of state — what the system has learned, inferred, and remembers — still shapes every encounter invisibly.

A policy this powerful cannot remain hidden; the person needs to inspect and negotiate the model.

References

• Wu, M. et al. (2025). Negotiating the Shared Agency between Humans & AI in the Recommender System. CHI EA 2025. DOI 10.1145/3706599.3719900. Verified: dual-control mechanism; n=161; transparency-alone insufficiency; outcome-control agency gains.
• Wang, S. et al. (2025). Privacy in Action. Findings EMNLP 2025, pp. 17055–17074. DOI 10.18653/v1/2025.findings-emnlp.925. Verified via Anthology. Used: enforcement-at-flow-point architecture; benchmark numbers cited as theirs.
• Wozniak et al. (2025). WWW Companion 2025. Part-read, numbers held. Used: authoring-over-exposure support.
• Ch 24–26 policy/precedence/friction machinery: extended across service boundaries, not rebuilt.

Proposed experiment EXP-27: portability with leakage accounting

Status: PROPOSED. Per the design above (A–E, six service types, enforcement-at-cost headline, six adversarial cases, utility kept separate).