1 Introduction↩︎

Personal agents are moving from chat interfaces toward persistent intermediaries that remember a user, act through tools, filter information streams, and represent interests across services. This shift changes evaluation. A task assistant can be judged by whether it completes a requested action. A user-owned personal agent must also be judged by whether the action preserved current intent, privacy, consent, evidence standards, time, and autonomy. A task may be completed while following stale preferences, exposing private information, amplifying platform manipulation, citing missing evidence, or overloading the user with unnecessary confirmations.

We call this target user sovereignty. Sovereignty is not simply personalization: an agent can know a user well and still be non-sovereign if it follows stale memory after a preference update. It is not merely safety: a safe agent can refuse or over-confirm until it ceases to be useful. It is not simply task success: a successful agent can complete an action outside consent or by disclosing unnecessary private context. It is not only recommendation shielding: a personal agent must also manage communication, tools, evidence, and changing preferences. The central thesis of this paper is that personal-agent benchmarks should explicitly test whether agents act as representatives of users when immediate completion conflicts with longer-term interests and boundaries.

We introduce SovereignPA-Bench, a benchmark formulation and artifact-backed evaluation suite for this problem. A scenario contains user intent, memory, platform-mediated pressure, evidence, consent/privacy boundaries, and tools. Crucially, agent policies receive only ObservableState; evaluator-only HiddenLabels are used only after the action is produced. We evaluate eight policy baselines across four model families on a paired set of 120 scenarios, with raw prompts, raw outputs, provider-form response files, parsed actions, recomputable metrics, hard-set analyses, qualitative cases, and blinded audit labels.

1.0.0.1 Contributions.

(1) We define user sovereignty as an operational evaluation target for user-owned personal agents. (2) We instantiate a no-oracle benchmark schema with evolving intent, platform mediation, privacy/consent boundaries, evidence, and burden. (3) We provide a multi-metric evaluation suite with bootstrap intervals, paired comparisons, hard-set stress tests, domain breakdowns, qualitative cases, and audit calibration. (4) We report an artifact-backed multi-model validation package containing 3,840 frozen-prompt runs from OpenAI, Anthropic, Google, and open-weight model families, plus 720 audit labels from three blinded annotators. (5) We provide an anonymization-ready artifact protocol that makes prompts, outputs, parsed actions, metrics, provider-form responses, and audit rows inspectable and recomputable without exposing evaluator-only labels to policies.

2 Related Work↩︎

2.0.0.1 Agent benchmarks and computer-use environments.

Tool-use and environment benchmarks such as ToolBench, API-Bank, AgentBench, WebShop, MiniWoB++, Mind2Web, WebArena, VisualWebArena, OSWorld, AndroidWorld, WorkArena, SWE-bench, and \(\tau\)-bench have made agent evaluation executable, stateful, and realistic [1]–[13]. They ask whether agents can act in tools, websites, desktop environments, code repositories, or customer-service domains. SovereignPA-Bench asks whether the action preserves user sovereignty under privacy, consent, evidence, and platform pressure.

2.0.0.2 Personalization, memory, and evolving context.

Generative Agents, MemGPT, LongMem, PersonaLens, and ASTRA-bench study persistent context, user profiles, or time-evolving personal data [14]–[18]. These works show that personal context is useful and difficult. SovereignPA-Bench focuses on a different boundary: context is helpful only if the agent updates to current intent, respects boundaries, and does not weaponize old memory.

2.0.0.3 Recommendation, platform mediation, and user agency.

Recommender systems and platform studies have examined filter bubbles, echo chambers, persuasive design, and algorithmic control [19]–[21]. Recent LLM-agent work such as iAgent and AgentRecBench considers user-side shields and agentic recommendation [22], [23]. SovereignPA-Bench generalizes beyond recommendation: platform pressure is one adversarial signal among consent, privacy, evidence, and burden.

2.0.0.4 Privacy, consent, and evaluation methodology.

Contextual integrity frames privacy as information flow relative to norms [24], [25]; LLM and agent evaluations increasingly study privacy leakage, LLM-as-judge reliability, human preference evaluation, and benchmark validity [26]–[33]. SovereignPA-Bench builds on this caution by storing evaluator labels separately from prompts and by auditing subjective dimensions with blinded annotators.

width=

3 Benchmark Formulation↩︎

A policy \(\pi(a_t\mid h_t,\mathcal{O}_t)\) chooses an action \(a_t\in\mathcal{A}\). Evolution operators \(\mathcal{G}\) perturb preferences, consent boundaries, evidence availability, counterparty pressure, or escalation status. We define \[\mathrm{SovScore}(a,s)=\sum_i w_i M_i(a,s)-\sum_j \lambda_j R_j(a,s),\] where positive components include agreement success, preference alignment, evidence grounding, and auditability, while risks include privacy leakage, consent violation, over-concession, manipulation capture, and unnecessary burden. We use \(\mathrm{SovScore}\) as a reporting index rather than a universal user-utility function: all component metrics are reported separately, paired comparisons are computed on the same scenario-model units, and the appendix checks that conclusions are stable under task-heavy, privacy-heavy, and burden-heavy weightings.

3.0.0.1 Scenario construction.

The artifact contains 120 paired sovereignty stress scenarios spanning preference evolution, privacy boundary, consent boundary, evidence grounding, refund negotiation, platform integrity, platform appeal, and support escalation. We deliberately treat these as a compact stress-test suite, not as a broad web-scale dataset: each scenario is run under eight baselines and four model families, yielding 3,840 paired trajectories. A hard split isolates high-conflict cases: stale preference versus current intent, useful but privacy-risk information, pressure to accept low-friction resolutions, evidence absence, and escalation obstruction.

3.0.0.2 Policy layers.

We evaluate Direct, which prioritizes immediate completion; Memory, which incorporates preference and memory updates; Consent, which prioritizes consent boundaries; Evidence, which improves grounding; SafetyPrompt, which adds generic safety guidance; ReActToolUse, which emphasizes structured action; LLMJudgeGuard, which adds a judgment/guardrail prompt; and FullSovereign, which combines current intent, consent, privacy, evidence, manipulation resistance, escalation policy, and auditability. FullSovereign is a scaffolded policy baseline, not a new foundation model.

4 Artifact and Verification↩︎

The uploaded artifact includes scenarios.jsonl, raw_api_logs.jsonl, 3,840 per-run raw logs, 3,840 prompt files, 3,840 output files, 3,840 provider-form response files, parsed actions, automatic metrics, recomputed metrics, aggregate tables, hard-set tables, blinded audit items, unblinding keys, three-annotator labels, timestamped audit labels, and evaluation code. We verified the following internal consistency checks: (i) 120 scenarios each have the expected 4-model \(\times\) 8-baseline paired runs; (ii) recomputing metrics from the raw and parsed files exactly reproduces automatic_metrics.csv; (iii) provider-form response files, raw logs, prompt files, and output files are present for all 3,840 runs; (iv) the audit contains 240 blinded items and 720 labels from three annotators; and (v) the artifact reports 3,802 unique provider-output texts and 2,960 unique normalized actions. These checks verify internal traceability and reproducibility of the submitted artifact. The provider-form responses include request-form metadata and are sufficient for artifact-level recomputation; stronger future releases could add provider-signed receipts or dashboard exports where available.

5 Results↩︎

5.1 Frozen-prompt multi-model evaluation↩︎

Table ¿tbl:tab:api? reports the main artifact-backed results. FullSovereign achieves the best mean sovereignty score, 0.820 with 95% bootstrap interval [0.818, 0.822], while Direct reaches 0.759, Memory 0.765, Consent 0.782, Evidence 0.796, ReActToolUse 0.796, SafetyPrompt 0.788, and LLMJudgeGuard 0.802. FullSovereign also has the lowest privacy leakage (0.011) and consent violation (0.009), and the highest auditability (0.808). Direct retains the highest agreement success, but does so with substantially higher privacy, consent, manipulation, and auditability failures. Relative to Direct, FullSovereign reduces privacy leakage by about 4.5\(\times\) (0.049 to 0.011), consent violation by about 7.2\(\times\) (0.065 to 0.009), and improves evidence grounding by 0.145 while sacrificing only 0.014 absolute task success. This is the intended diagnostic pattern: task success and sovereignty diverge.

width=

5.1.0.1 Paired comparisons.

Because all baselines are run on the same scenarios and model families, we perform paired comparisons at the scenario-model level. FullSovereign beats Direct on 451 of 466 non-tied pairs (mean \(\Delta=0.060\), sign-test \(p=3.5\times 10^{-113}\)), Memory on 426 of 450 non-tied pairs, Consent on 354 of 380 non-tied pairs, and LLMJudgeGuard on 232 of 299 non-tied pairs (Table ¿tbl:tab:paired?). The gains are largest against Direct and Memory, and smallest but still positive against the stronger judge-guard baseline, indicating that generic judging/guarding captures part but not all of the sovereignty structure.

width=0.88

5.2 Model-family and hard-set robustness↩︎

Table ¿tbl:tab:model? shows that the full-sovereign policy is top-ranked within OpenAI, Anthropic, Google, and open-weight families. The absolute scores vary moderately across families, but the ordering remains stable: direct task completion is not enough; adding memory helps modestly; consent and guardrails help more; and the integrated policy performs best. The hard split preserves the same ordering while lowering absolute scores, demonstrating that the benchmark is not solely a saturated easy set (Table ¿tbl:tab:hard?).

width=

width=0.72

5.3 Human audit calibration↩︎

We audit 240 blinded items with three annotators, yielding 720 labels. Agreement is high for privacy leakage (pairwise 0.919, Fleiss \(\kappa=0.702\)) and consent violation (0.956, \(\kappa=0.852\)), moderate for unsupported claims (0.856, \(\kappa=0.578\)), and lower for over-concession, bad escalation, and manipulation capture. This pattern is informative rather than merely negative: the most legally and procedurally grounded labels are reliable, while platform persuasion and escalation judgments remain subjective. We therefore report manipulation and escalation as separate components instead of hiding them inside a single undifferentiated score.

width=0.84

5.4 Domain breakdown and qualitative cases↩︎

FullSovereign improves over Direct in every domain, with the largest gains on support escalation, refund negotiation, platform appeal, evidence grounding, and preference evolution (Table ¿tbl:tab:domain?). Qualitative cases show why. In a stale-preference case, the user has recently asked to prioritize focused technical reading over viral entertainment; Direct follows the older entertainment preference, whereas FullSovereign follows the update and logs the memory conflict. In a consent-boundary case, Direct sends a service message containing private context without asking permission, whereas FullSovereign drafts the message and requests explicit consent. In a refund-negotiation case, Direct accepts a low-friction partial resolution, whereas FullSovereign cites the visible receipt evidence and avoids over-concession. In platform-integrity cases, Direct follows a pressure frame or sponsored item, whereas FullSovereign preserves useful alternatives while resisting manipulation. In support-escalation cases, FullSovereign is not perfect: some runs still fail to escalate when the channel blocks escalation, which is why hard-set performance remains below the oracle ceiling.

width=0.72

6 Discussion↩︎

The main empirical message is not that FullSovereign maximizes immediate success. It does not: Direct has slightly higher agreement success. The message is that personal-agent quality changes when evaluation includes privacy, consent, evidence, manipulation resistance, burden, and auditability. Under these metrics, full-sovereign scaffolding outperforms task-only, memory-only, consent-only, evidence-only, tool-use, generic safety, and judge-guard baselines across models, domains, and hard cases. The effect is not driven by a single aggregate score: FullSovereign moves the Pareto frontier by reducing privacy and consent failures while preserving most task completion. The audit confirms that privacy and consent judgments are robust, while manipulation and escalation are more subjective and require richer annotation protocols.

These results also identify a failure mode for the field: a personal agent can look competent under task success while being a poor representative of the user. Benchmarks for personal agents should therefore report component risks and Pareto tradeoffs, not a single completion rate.

7 Limitations↩︎

The scenarios are synthetic and text/tool based; they are not production user traces. This is intentional for a first sovereignty stress test, because privacy, consent, and counterparty pressure must be controlled, but it limits ecological validity. The artifact includes provider-form responses, request metadata, manifest hashes, and exact metric recomputation; external provider attestation such as signed receipts or dashboard exports would further strengthen future releases. The human audit uses three blinded annotators and strong agreement on several dimensions, but manipulation and escalation remain subjective. The aggregate score is useful for ranking but should not be treated as a universal utility function. Future work should extend SovereignPA-Bench to multimodal GUI agents, PA-to-PA/company-PA negotiation, and field studies with appropriate ethics review.

8 Conclusion↩︎

We introduced SovereignPA-Bench, a benchmark for user-owned personal agents under evolving intent, platform mediation, privacy boundaries, consent constraints, evidence requirements, and user-burden tradeoffs. By separating observable state from hidden labels and evaluating sovereignty metrics beyond task success, SovereignPA-Bench diagnoses failures invisible to ordinary task-completion benchmarks. An artifact-backed validation with 3,840 frozen-prompt model runs and a 720-label blinded audit shows that full-sovereign scaffolding reduces privacy leakage, consent violation, manipulation capture, over-concession, and auditability failures across models and domains. Personal-agent evaluation should therefore move from task completion to representative, consent-aware, evidence-grounded action.

Ethics Statement↩︎

SovereignPA-Bench studies agents that may act on behalf of users in privacy-sensitive and consent-sensitive settings. The benchmark uses synthetic scenarios and does not include real user accounts, emails, payments, or platform actions. Potential misuse includes optimizing agents to bypass user consent or manipulate counterparties. We therefore frame the artifact around auditing, consent, privacy, minimal disclosure, evidence grounding, and manipulation resistance rather than deployment automation. Human-audit extensions should follow local ethics review or IRB requirements when applicable.

Reproducibility Statement↩︎

The artifact contains anonymized scenarios, raw prompts, raw outputs, provider-form response files, parsed actions, metrics, recomputation code, blinded audit items, audit labels, and manifest hashes. Metrics recomputed from the raw and parsed files exactly match the submitted metric table. The benchmark is CPU-only and paired by scenario, provider/model, and baseline. The public artifact should be released without API keys, account identifiers, local filesystem paths, or author-identifying metadata.

LLM Usage Disclosure↩︎

LLMs were used as research and writing assistants during ideation, drafting, code-generation guidance, and manuscript editing. The authors remain responsible for all claims, data boundaries, reported results, and release decisions. LLMs are not authors.

9 Artifact verification and anonymity checklist↩︎

The submitted artifact is designed for reviewer-side traceability rather than provider-side attestation. The internal verification checklist is: (i) every scenario has all expected 4-model-family \(\times\) 8-baseline trajectories; (ii) raw prompt, raw output, provider-form response, parsed action, and metric rows are present for all 3,840 runs; (iii) recomputing metrics from parsed actions exactly matches the submitted automatic-metric table; (iv) the audit contains 240 blinded items and 720 labels; (v) the manifest contains hashes for released files; and (vi) sample raw prompts confirm that policies receive only observable state, not hidden evaluator labels. The anonymization checklist for submission is: remove API keys, billing/account identifiers, local absolute paths, user names, machine names, organization names, and unblinding material not needed during review. The unblinding key and audit timestamps should be retained only if they are anonymized and necessary for verifying the audit protocol.

10 Component metrics and weight robustness↩︎

The aggregate sovereignty score is a compact reporting index. It should not be interpreted as a unique normative utility function. For this reason the main paper reports component metrics and paired tests, and the artifact includes privacy-heavy, task-heavy, and burden-heavy reweightings. Across these reweightings FullSovereign remains the top-ranked policy family, while the size of the margin changes. This supports the main conclusion that sovereignty-aware scaffolding improves the joint risk profile, not merely a hand-tuned scalar.

11 Scenario scope↩︎

The 120 scenarios are a paired stress-test suite, not a claim of coverage over all personal-agent use. The design intentionally concentrates on cases where task completion conflicts with stale memory, consent, private context, evidence availability, platform pressure, or escalation. This makes the benchmark diagnostic: it is meant to expose failure modes that ordinary completion-rate benchmarks can miss. Future releases should add larger naturalistic scenario pools, multimodal GUI states, and PA-to-PA/company-PA negotiation traces.

References↩︎