Boundary-Preserving Composition of Personal and Enterprise AI Systems

A workplace can contain a personal AI system, a distinct organizational coordinator, temporary task executors and shared model infrastructure. They can cooperate technically while still serving different principals and retaining different histories. The paper asks what must remain true when work, information or responsibility crosses those boundaries.

The report separates authorization, operational readiness and budget; distinguishes transport from permission to reuse information; separates task completion from prohibited effects; and treats role, memory, executor and model replacement as different transitions.

A capable model can still be operating with the wrong principal, stale permission, incomplete source state or an invalid resource assumption. A personal assistant that once saw employer material does not gain an indefinite right to export it; an enterprise service that pays for compute does not gain access to a worker's private biography; restoring an archive does not restore expired authority.

The practical problem is therefore compositional: ordinary mechanisms such as roles, usage control, provenance, scoped delegation and durable state already exist, but their boundaries can change during offboarding, revocation, correction, replacement, cancellation and recovery. The report makes those transition conditions inspectable and proposes a way to test whether extra checks add value beyond a strong conventional baseline.

The report does not claim invention of hierarchical execution, federation, role separation, ongoing authorization, provenance, local-first storage or resource-aware routing. It instead contributes a traceable crosswalk of those existing mechanisms, an application-specific set of obligations for personal/enterprise work transitions, and a matched evaluation agenda.

A negative result is valid: if a configured conventional system already satisfies the obligations with equal or lower burden, the additional profile should be narrowed or merged rather than preserved by terminology.

The initial catalogue covers personal-to-professional role change, role revocation, offboarding, executor replacement, model replacement, source correction, recipient-use change, nested delegation, concurrent spending, partial external effects, cancellation and context/transport failure.

Useful completion, prohibited effects, false refusal, human escalation and missing evidence are separate axes. The design explicitly prevents “deny everything” from looking successful and keeps failed or unobservable attempts in the denominator.

The report retains 38 external and 12 authored records at unequal reading depth. It explicitly reuses mature prior art in multi-agent organization, information-flow control, usage control, provenance, local-first systems, zero trust, interoperability, task authorization and cost-sensitive routing.

Close modern comparisons are not weakened to manufacture novelty. Where a conventional implementation already enforces the proposed check, that capability belongs in the baseline rather than being counted again as a new treatment.

The next scientific step is not another naming layer. It is a bounded implementation using mature components, followed by a controlled matched comparison, independent reproduction, full resource/economic measurement and only then staged deployment.