The Default Is the Protocol: Copilot, Office, and Who Gets to Mediate Intent

Hook — The Checkbox Nobody Voted On The toggle sits in the third tab of an enterprise administration console, rendered in the same grey as every other switch on the page. Allow assistant to access organizational content. Somewhere inside a procurement cycle that no end user will ever read, a decision is made on behalf of three hundred thousand people, and it takes roughly four seconds to apply. I have spent twenty-five years watching systems make decisions about people who never consented to them, and the lesson has never once changed: the architecture that matters most is rarely the one that gets announced. It is the one that becomes the default. Microsoft's latest Copilot release, which pushes the assistant deeper into Office and folds in a broader set of features, is being read by most of the technology press as a product update. Framed that way, it is unremarkable. Microsoft ships updates the way tides arrive — reliably, without ceremony, and without asking the shoreline. But read from where I sit, inside a bear market, inside an industry that spent a decade insisting the interface between a person and their own information should not be owned by anybody, the release is something considerably stranger. It is evidence that the competitive frontier has moved. Not from weaker models to stronger ones. From capability to distribution. From benchmark to default. When a protocol surrenders forty percent of its liquidity in seven days, nobody writes a press release. When a language model loses a benchmark by two points, everyone does. Truth is immutable, unlike the price action. That asymmetry says everything about what our attention has been calibrated to reward, and it is precisely backwards. Defaults are where durable power lives, and defaults are almost never debated. Context — What Actually Shipped, and What Did Not The update, as described, integrates Copilot more deeply into Office and adds further functionality to the assistant. That is the entire disclosure. There is no model version, no parameter count, no context window, no pricing change, no benchmark result, no availability date, and no list of which applications beyond the obvious ones are affected. What can be stated with reasonable confidence is architectural rather than numerical: this is an application-layer and workflow integration. Its value comes from placing a model at a high-frequency entry point and allowing it to call into documents, mail, calendars, chats, and structured enterprise data through a permission graph. That is orchestration, tenancy, latency, and cost-control work. It is not a new theory of intelligence. What is missing matters more than what is present. The technical questions that determine whether a system like this is trustworthy are mundane and unanswered: which model runs, whether routing sends simple tasks to small models and complex ones to large ones, what the hallucination rate looks like on contract review versus meeting summaries, whether enterprise content trains anything, where data resides, whether deletion propagates, and whether an administrator can produce an audit log that would survive a courtroom. Anyone claiming to know these answers is guessing, or repeating a vendor slide. My own grasp of the public record runs to the middle of 2024; anything after that requires the vendor's own disclosures and independent testing. I would rather publish an honest gap than a confident fiction. False precision is the most common form of intellectual dishonesty in this industry, and it is committed by people who should know better. Why does a piece about an office suite belong in a publication about decentralized systems? Because the question being quietly decided here — who mediates a person's intent when that person touches their own information — is the same question DeFi, self-custody, and verifiable computation have been asking for a decade. And crypto lost the consumer argument not because self-custody is wrong, but because the default was set somewhere else, by someone else, long before most users arrived. If the assistant layer becomes the default interface to work itself, that loss repeats at a scale we have not yet priced. In a bear market, the useful question is never which narrative wins. It is which operators still have runway. When an entire sector's tokens are priced on a story about agents and intelligence, the honest analysis is not whether the story is beautiful. It is whether removing the story leaves any usage behind. I have watched that test dismantle projects that raised nine figures from people who never ran it. It will dismantle more. Core — The Application Layer, Not a Miracle The hard part of enterprise AI was never intelligence. It is isolation. Tenant boundaries, permission inheritance, revocation, retention windows, jurisdictional data residency, and the question of what happens when a document is summarized for someone who lost access to it eleven minutes earlier. None of these are solved by a better transformer. They are solved by careful, unglamorous systems engineering, and they fail in ways that are procedural rather than spectacular. This is why the honest description of an enterprise assistant is not a brain. It is a permissions system with a language model attached, wearing a friendly face. There is a direct parallel in the plumbing beneath decentralized finance, and it is worth stating with technical specificity rather than tribal loyalty. A price oracle is a mediating layer between the world and a contract. Its structural properties — who signs the feed, how many independent parties can be compelled to cooperate, what the latency is between an event and its reflection on-chain — determine whether the protocols built on top are robust or merely lucky. A network that secures billions while its actual signing set resolves to a small number of identifiable, contractually reachable operators is a distribution decision wearing cryptographic clothing. That is not an accusation of bad faith. It is a description of topology, and topology is what survives subpoenas. Latency compounds the problem: the interval between the world changing and the feed acknowledging it is where liquidations are manufactured, and no amount of decentralization marketing shortens that interval by a single millisecond. Integrating a model into mail, documents, and meetings builds exactly the same class of system at a vastly larger scale. The assistant becomes a feed. The feed has latency, has a signing set, has a jurisdiction. Users will experience its behavior under stress, not its architecture in a diagram. Core — The Chokepoint Was Never the Model Open weights are one of the genuine achievements of the last several years, and they are not where power resides. History is blunt about this. The browser was not won by the fastest rendering engine. The mobile platform was not won by the best runtime. Search was not won by the best index. File formats were not won by the most elegant specification. Each of those contests was settled at the layer where habit, procurement, and default settings live. The distribution layer writes the terms, and everyone else negotiates within them. Crypto knows this better than it admits. Ethereum's durable advantage was never the EVM specification, which has been reimplemented many times. It is liquidity and developer habit — the default place a new team deploys because that is where everyone else already is. Bitcoin's advantage was never throughput. It is brand default, the fact that a stranger who has never read a whitepaper can name exactly one cryptocurrency. These are uncomfortable admissions for people who believe in technical meritocracy. They are also empirically obvious to anyone who has watched a technically superior fork spend three years fighting for relevance it never achieved. Truth is immutable, unlike the price action, and the market does not grade on architecture. The strategic consequence is unglamorous and enormous. If the entry point is the assistant, then whoever owns the entry point decides which tools get invoked, which data gets exposed, which agent receives delegated authority, and which settlement rail a transaction ultimately travels. A crypto-enabled agent living inside a closed workspace is a guest in someone else's jurisdiction, and guests do not set the rules of the house. When a company announces that it is integrating Office and more, the honest translation is not a feature list. It is a border. Core — Inference Costs Are the New Proving Costs Every seat that receives assistance is a seat that consumes compute. This is the detail that gets lost in the applause. A subscription software business achieves its margins precisely because the marginal cost of serving one more user approaches zero once the software exists. Attach a model to that business and you attach a marginal cost that scales with engagement. The more successfully the product is adopted, the more expensive it becomes to operate. Engagement and expense stop being opposing forces and become the same force. I have watched this exact pattern devour the economics of zero-knowledge rollups, and the resemblance is too precise to ignore. A proof system's mathematics can be elegant, verifiable, and formally beautiful, and none of that pays a hardware bill. What pays the bill is the amortized proving cost per transaction against the fee the transaction actually generates. Operators ran machines whose monthly cost exceeded what their chains collected, and the honest ones said so — several of them only after the treasury was half gone and the conversation could no longer be postponed. Anyone who has run infrastructure long enough to face that arithmetic learns a permanent lesson: cost structure is a thesis, not a footnote. A system that cannot describe its unit economics is not a protocol. It is a countdown. The same scrutiny belongs on inference. Model routing — sending trivial tasks to small models and reserving large ones for genuine reasoning — is not an optimization detail; it is the difference between a viable product and a subsidized demo. Local execution on device silicon is the same bet made in a different place. Batch processing instead of interactive responses is a cost decision disguised as a latency tradeoff. And a free tier is rarely generosity; it is either customer acquisition or data acquisition, and usually both. For anyone reading this with exposure to the AI-adjacent crypto complex, the bear-market question is not which token has the best narrative. It is three numbers, and they should be public somewhere: what does one verified action cost, what is the treasury runway at current burn, and what fraction of usage would survive the removal of a subsidy. I have never seen a project answer all three honestly and then fail. I have seen many refuse to answer and then fail. Core — Agents, Delegation, and the Reentrancy of This Cycle The moment an assistant stops drafting and starts acting — sending, scheduling, approving, transacting — the trust boundary becomes the entire attack surface. Prompt injection is the reentrancy bug of this cycle. It is not a flaw in the underlying primitive. It is an unvalidated input crossing a boundary that developers assumed was safe because it had always been safe in the lab. The mechanism differs from the classic smart contract exploit; the epistemological error is identical. In 2017, while the token boom made advisors wealthy for lending their names to things nobody had built, I declined that work and spent six months inside the Solidity and consensus implementation of a mainnet launch. I found fourteen critical vulnerabilities in the consensus implementation alone. The paper I published carried a title that I still consider less a summary than a warning: Code is Law, But Only If It Compiles. Based on my audit experience, the vulnerabilities that destroy systems are almost never in the cryptographic primitives. Block ciphers and hash functions do their jobs. Systems fail at the seams, where one component's assumption becomes another component's unexamined input. An agent that reads your mail and holds your keys is nothing but seam. Delegation without revocation is not delegation. It is transfer, dressed in the grammar of permission. The design requirements are not exotic, and they are almost never met: scoped authority rather than blanket access, time bounds that expire without human intervention, cryptographic receipts for every automated action, human-readable intent presented at the moment of authorization rather than in a terms-of-service document, and a mechanism to unwind what was done. The Decentralized Trust Protocol work I did with three ethicists attempted to encode precisely this — an agent may act, but it must be able to prove what it was authorized to do and nothing more. The hard part was never the proof construction. The hard part is that no vendor voluntarily hands over the receipt when the receipt is embarrassing. Core — Verification Without Exposure The genuinely interesting cryptographic contribution to this convergence is the ability to prove that a decision satisfied a stated policy without revealing the data the decision was made from. Zero-knowledge constructions make this possible in principle, and I have spent the better part of a year writing about the specific design: a proof that an automated action stayed inside defined bounds, verifiable by a third party, revealing nothing about the underlying correspondence, portfolio, or medical record. Two European regulatory bodies cited that series, which tells you something about how hungry supervisors are for a mechanism that lets them audit an outcome without reading everything. Honesty requires naming what remains unsolved. Proving that a process ran is not the same as proving which model ran it, at what version, with what prompt and what weights. Reproducibility across hardware is unsolved. Hardware attestation is a stopgap that relocates trust into a manufacturer rather than eliminating it. And the cost problem reappears in full force: generating proofs consumes compute and latency, which is the same budget line that already broke rollup economics at a fraction of this scale. A verification layer that costs more than the activity it verifies is not infrastructure. It is a monument. There is a second, subtler danger, and it is the one I keep returning to. In 2024, after the Bitcoin ETF approvals, I analyzed the custody structures of the five largest providers and found that roughly ninety-five percent of the arrangement depended on centralized third parties. Regulatory clarity arrived, and philosophical compromise arrived holding its hand. The same trade is now on offer for verifiable AI. Institutions will buy proofs — but they will buy them from audited firms, and the proofs will be standardized into a form that certifies compliance rather than distributes power. Verifiability becomes a checkbox. The checkbox lives in the third tab of an admin console. Truth is immutable, unlike the price action, and it is also, apparently, transferable to the highest bidder. Core — Sovereignty Is Not a Feature Toggle We should ask, plainly, how many people actually want sovereignty. In 2020 I founded a small nonprofit, personally mentored fifty developers from underrepresented backgrounds through their first token deployments, and wrote a governance guide that was downloaded fifteen thousand times. Then I burned out managing two hundred community members well enough to need three months completely offline to remember who I was. The lesson from that exhaustion was not that decentralization is a fantasy. It was that sovereignty is labor. It is a second job. People will accept a steward the moment the steward removes the labor. That is not a betrayal of the ethos. It is the design brief, and refusing to read it is why so much of this movement ships products that only convince the already converted. The Terra collapse, and the six weeks I spent afterward in a cabin in rural Virginia drafting a manuscript about dignity rather than efficiency, taught me something adjacent and harder: idealism that ignores cost does not survive contact with loss. Trust is not rebuilt by exhortation. It is rebuilt by defaults that protect people who will never read the terms. Which means the convergence conversation should stop asking users to be heroic and start asking what a default can be made to guarantee. Four things, concretely: portable identity that travels between platforms, exportable data in a form someone else can actually read, revocation that works without a support ticket, and a signed record of every automated action taken on a person's behalf. If those four can be defaults, sovereignty becomes invisible, like plumbing, and the argument is won by attrition rather than by manifesto. If they cannot, sovereignty remains a hobby for the principled and a product for nobody. Core — The Rebranding Economy When capital is scarce, narratives get recycled rather than invented. A substantial fraction of what is currently marketed as AI crossed with crypto is a data indexer with a redesigned landing page and a new lexicon. This is structurally identical to the wave of so-called Bitcoin Layer 2s that arrived with a heritage slide, an Ethereum virtual machine underneath, and a rhetorical commitment to a community whose tooling they had never used. The real Bitcoin community did not acknowledge most of them, and it was right not to. I lost arguments and, in a few cases, friendships for saying so at the time. The test is boring and reliable, which is why it is unpopular. Remove the narrative and inventory what remains. Does the protocol settle something? Does anybody pay for it? Does it emit a receipt a counterparty would accept during a dispute? Could a lawyer subpoena the record and get an answer? If the honest response is no, then what exists is a story with a token attached to it, and stories have a half-life measured in quarters rather than cycles. Every bear market applies this test whether or not we volunteer for it. Contrarian — The Pragmatism Test Here is the uncomfortable argument, and I make it knowing it will cost me readers who prefer the cleaner version. The purist response to default-layer capture — refuse it, build parallel infrastructure, demand that users opt out and run their own nodes — has failed repeatedly, and it has failed for a structural reason rather than a marketing one. It inverts the burden. It asks ordinary people to perform the labor of institutions in exchange for a benefit they cannot perceive. Nobody runs a node to read email. Nobody audits a proof to send a message to a colleague. The pragmatic response is to accept the default layer as terrain and build the thing terrain cannot supply: verifiability, portability, settlement, and revocation. A sharper claim follows. Decentralized AI is largely solving the wrong layer. The industry's instinct is to decentralize training — distributed compute, federated data contribution, model marketplaces, tokenized incentive schemes for gradient sharing. This is technically admirable, intellectually satisfying, and commercially weak. Training is a capital-intensive commodity race with perhaps five plausible winners, and one of them has an unlimited balance sheet and a distribution channel measured in hundreds of millions of seats. Verification, by contrast, is a public-good-shaped market with regulatory demand attached to it, and demand attached to something is worth more than elegance attached to nothing. Crypto's comparative advantage was never compute. It was the capacity to produce a neutral, timestamped, tamper-evident record that no single party controls and any party can check. Third, and least comfortable: verifiability will be demanded by auditors, not by users, and auditors answer to institutions. The demand will exist. The architecture will be shaped to satisfy procurement, not liberty. Unless the standards are written now — deliberately, in public, before the templates harden — the result will be compliance theater with a cryptographic garnish, which is worse than no verification at all because it launders the appearance of trust while leaving the substance untouched. And the deepest pragmatism of all, the one that stings: the reason this office integration matters is that it works, on the first try, for most people, without instruction. Our movement has spent a decade producing alternatives that require conviction to adopt and stamina to maintain. Conviction is not a product feature. Stamina is not a user interface. The bear market is the honest moment to say this, because in a bull market nobody listens and in a bear market nobody can afford the illusion any longer. Takeaway What is being watched here is not a product update. It is a boundary being drawn around human intent, quietly, by a checkbox most people will never see. Somewhere a toggle is on, and three hundred thousand people are already working inside it. The forward question is not whether the assistant will mediate our work — it will, and it will be convenient. The question is whether the proof of what it did on our behalf will be a right we hold, or a service sold back to us by the institutions that took it. Truth is immutable, unlike the price action. The rest is a design decision, and design decisions are made by whoever arrives at the third tab first.