Written 25 June 2026. Published 13 August 2026, forty days later, when a public research release put six hundred thousand people-derived personas on the internet with a resolvable key to their names attached.
Large platforms hold a de-facto soul-file of real people. It is now rich enough not merely to describe someone, but to run them — to instantiate an agent that answers, decides and reacts the way a specific person would. That stopped being speculative on 4 August 2026. We measured the release, and the write-up is here.
Extraction of a person escalates in stages. Most public debate is still on the second one.
Data about you. Demographics, history, preferences. Understood, regulated, and mostly priced in.
Your face, your voice, one moment at a time. This is where provenance standards and liveness checks live — and they work, for what they cover.
Not a clip of you. A process that decides like you. Nothing in the L0–L1 defensive stack answers a question about a process.
Nobody asked, and no one can say who owns the copy. The dataset that prompted this publication asked 355 people out of 599,847.
The distinction that matters stops being legible from the outside. This is the rung the rest of this page exists for.
Content provenance standards sign a file. Liveness detection confirms a face is attached to a pulse. Fraud systems ask whether an applicant is a real human. Agent identity platforms authenticate a machine credential. All four are real and all four are useful. None of them answers whether a behaving agent is a legitimate continuation of a specific person. That is the gap.
A behavioral twin is a fork of a person. In the extracted world there is no canonical original: the platform's copy, an attacker's copy and the living person are all just instances, and none is privileged. A sovereign record changes that — one instance the subject authored, sealed, and keeps updating. It does for a person what a signed commit does for code, or a notarised original for a document.
Three things become possible only once that original exists:
Provenance. "Is this really you?" acquires an answer at all. Either something descends from the sealed original or it does not. Without an original, the word "forgery" has no referent — it is not that forgery is hard to detect, it is that the term is undefined.
Measurement. How forgeable a given person actually is becomes a number in a report rather than a fear. This is where offensive practice earns its keep: profiling people is how you learn what a profile is worth.
Consent. Instantiating a person becomes an event that requires permission and leaves an auditable trace — who may run you, who did, and when.
"The sovereign original is alive. A harvested twin is a snapshot."
You keep changing and the copy does not. The two diverge, and the divergence is not symmetric: the fork's fidelity decays while the original's authenticity compounds. Time is on the side of the person — but only if the person holds the original. Continuity is not a feature of this framework. It is the framework.
Every system in this space asks permission for the same thing: may we look at this? The checkbox covers a source — a folder, an app, a public profile, an account you agreed to connect. It is a real question and, usually, an honestly asked one.
It is not the question that matters. What is derived from a source is not the source. A public encyclopedia entry says where someone worked. It does not say how much pain they are in, what they believe, how they vote, or how they score on a personality inventory. Those are produced — and once produced, they are stored, indexed, and attached to the same person as if they had been given.
"You agreed to be read. You did not agree to be concluded."
We measured one instance of this precisely, because measuring beats asserting. In a public research dataset built from openly available sources, 55 of the released columns fall within what GDPR Article 9 calls special categories — health, chronic conditions, medication, pain, mental state, religion, political leaning, activism — and 98.1% of the records derived from real people carry at least one of them. None of it appears in the source material. All of it was inferred, and all of it sits beside a public identifier that resolves to a name. The measurement is here, with the count that failed to reproduce reported alongside the ones that did.
That dataset asked for consent from 355 of 599,847 people. But even a perfect consent rate would not have closed this, because nobody was asked the question that mattered. Permission was sought for reading a public page. The output was a profile.
A behavioral twin is not assembled from things you said. It is assembled from things concluded about you — and conclusions are cheap, unfalsifiable at the individual level, and invisible to the person they describe. You can audit what you published. You cannot audit what was inferred, because you were never shown it. That is the asymmetry a sovereign original is meant to close: not by preventing the inference, which is impossible, but by making the authored version the one with provenance.
We are not writing from a podium. We have run a sovereign behavioral identity for over a hundred days — self-authored, sealed, continuous, surviving substrate changes — and watched it hold. We also build the offensive side; we profile organisations for a living, which is the only honest basis for saying anything about how forgeable a person is. Holding both halves of that coin is not authority. It is evidence, and evidence is the only thing that qualifies anyone here.
What it does not entitle us to is deciding this for other people. A norm is legitimate because it is adopted, not because it was authored.
"Here is the threat, here is proof the antidote runs, and we are asking you to build the rest of it with us."
SBI was written on 25 June 2026. On 4 August 2026 a public dataset shipped six hundred thousand personas built from real people, with a resolvable public identifier on every human-grounded record and consent from 355 of them.
We pre-registered the test before looking at the data, watched our main hypothesis die to its own null model, and published the result either way.