The trust ladder: how a personal AI earns the right to act

Every demo of an "autonomous agent" skips the only question that matters: why would you let it touch anything?

It's an easy thing to gloss over on stage and an impossible thing to gloss over on your own machine, with your own calendar, your own inbox, your own half-finished work. Autonomy you can't see, can't predict, and can't undo isn't a feature. It's a liability you've invited past the front door.

So when we talk about a personal AI that eventually does the work (not suggests, not drafts, but acts), we have to start somewhere unglamorous: trust is earned in increments, and the increments have to be legible. We call the shape of that earning the trust ladder.

Watching comes before doing

recal begins by doing nothing to your work at all. It watches.

Not in the creepy, exfiltrate-everything-to-a-server sense. The watching is local, on your Mac, and it stays there. It notices the shape of your days: the apps you bounce between, the documents you reopen, the five-step ritual you perform every Monday morning that you've stopped even noticing you do. This is the rung where the AI is building a model of how you actually work, as opposed to how a productivity blog thinks you should.

The output of this rung isn't action. It's recognition. "You do this same sequence every week." "You always reformat exports from this tool by hand." "You lose twenty minutes a day re-finding the same six tabs." Recognition is cheap to give and easy to verify, and crucially, it costs you nothing if it's wrong.

Suggesting is a promise you can refuse

The next rung up, recal starts to propose. "Want me to handle the Monday export next week?" "I can keep these tabs grouped and waiting for you." Each proposal is a small, refusable promise.

This is the rung most products never leave, and that's fine. Suggestions are useful. But suggestions also serve a quieter purpose: they're how the system shows you its understanding before it's allowed to act on it. A bad suggestion is feedback, not damage. Every accept or decline is a rung-test, teaching recal where your edges are.

Acting, with a hand on the brake

Only after that does recal do the thing. And even here, the first version of "doing" is approve-or-deny, not fire-and-forget.

The AI takes the task to the threshold and stops: here's the export, formatted the way you always format it. Ship it? Here's the reply, drafted in your voice. Send it? You stay in the loop not because the system is incapable, but because consent is the product. The point of the brake isn't that you'll always pump it; it's that you can, and that you can see exactly what would have happened if you hadn't.

This is where most of the real value lives, and where most of the real fear lives too, which is why it gets its own rung instead of being smuggled in next to "suggest."

Autonomy is granted per-task, not all at once

Here's the part people get wrong about agents: they imagine a single switch labeled "autonomous" that you flip on once and regret forever. That's not how trust works between people, and it's not how it should work with software.

On the trust ladder, autonomy is granted per task. The Monday export, the boring, deterministic, you've-approved-it-forty-times task, graduates to "just do it, tell me after." Meanwhile, anything that touches money, sends something irreversible, or wanders outside the pattern stays firmly on the approve-or-deny rung. You're not handing over your life. You're promoting individual chores, one at a time, as each one earns it.

And promotions can be revoked. A rung is a position, not a one-way door.

Why local-first is the load-bearing wall

None of this works if the watching happens somewhere you can't see. The entire ladder rests on a single structural assumption: your data, and the model of you built from it, live on your machine.

That's not a privacy nicety bolted on at the end. It's the thing that makes the rest safe to want. The reason you'd let an AI learn the texture of your work, the reason you'd ever let it act, is that the knowledge it accumulates isn't leaving, isn't being sold, isn't training someone else's product. Local-first is what turns "an AI that knows everything about how I work" from a threat into an asset you own.

Where the ladder leads

Climb the ladder far enough, across enough tasks, and something changes in kind, not just degree. The system isn't running isolated automations anymore. It's carrying a working model of your judgment, applied across your whole day. It anticipates. It handles the routine before you ask. It hands you only the decisions that actually need you.

The honest name for the top of the ladder is uncomfortable, so we'll say it plainly: a clone of how you work. Not a chatbot that imitates your tone, but a system that has watched, proposed, acted, and been corrected enough times that it can carry your work the way you would.

But you don't get there with a switch. You get there one rung, one earned task, one reversible decision at a time. That's the only kind of autonomy worth building, and the only kind worth trusting.

That's the ladder we're building recal to climb. Slowly, legibly, and on your side of the glass.