Activation inside an AI assistant

Ship the predicate, not the list

An assistant is not a display. There is no audience there, only one conversation with one person. Sending a list means disclosing it to the platform — so send a small signed function instead, and let it answer yes or no where the person already is.

This screen is a concept, not a shipped feature. Nothing about assistant-side activation is standardised yet, and the evaluator this depends on does not exist in any assistant today. We are publishing the design because we think it is the right shape and we would rather argue about it in public than discover in two years that someone shipped the list-based version first. What it would require is set out at the bottom, honestly.

A shopper talks to an assistant

Pick a question

What actually gets sent

Under 2 KB, signed by the retailer

// The whole artefact. No households, no identifiers, no list.
{
  "predicate_id": "pr-5c81f0a7",
  "issued_by":    "Meridian Markets",          // the data owner signs, not us
  "on_behalf_of": "Northfield",
  "code_sha256":  "3f17ba…c042",               // the evaluator checks this before running

  "reads_locally": [                           // what it may look at, on device
    "basket_in_progress.categories",
    "stated_dietary_constraints",
    "household_size_band"
  ],
  "never_reads":   ["identity", "history", "location"],

  "returns": { "eligible": "boolean", "offer_id": "string|null" },

  "constraints": {
    "max_impressions_per_person": 2,
    "valid_until": "2026-11-27T00:00:00Z",
    "must_disclose_as": "sponsored",          // non-negotiable, enforced by the evaluator
    "no_result_phoned_home": true             // the answer never leaves the device
  },

  "signature": { "alg": "ed25519", "by": "meridian-markets", "sig": "9a4e…71bd" }
}

What is not in there: any household, any identifier, any score, any count. The audience was never a list in the first place — it is the set of people for whom this function happens to return true, and nobody ever enumerates that set, including us.

Against the way everyone does it today

	Send the list	Send the predicate
What the platform receives	Hashed contacts for every household in the audience	A 2 KB function and a signature
What the platform can infer	Which of its users shop at that retailer, and roughly what they buy	Nothing about the audience; for one user, only the answer it asked for
Who learns the audience size	The platform, exactly	Nobody, including us
If the platform is breached	The audience is in the breach	A function with no data in it is in the breach
Freshness	Stale from the moment it is sent; re-upload to refresh	Evaluates against what is true in the conversation right now
Frequency control	Platform-side, on the platform's honour	In the artefact, enforced before the offer renders
Revocation	Request deletion and hope	Expiry is in the signature; after it, the predicate simply stops answering

What would have to be true for this to work

The assistant has to run a trusted local evaluator. Something that verifies the signature, enforces the declared reads and the constraints, and refuses a predicate that asks for more than it declared. No assistant ships this today. It is not exotic — browsers do comparable work for other sandboxed code — but somebody has to build and standardise it.
The predicate language has to be small enough to audit and expressive enough to be useful. Those pull in opposite directions, and getting the balance wrong in either direction kills it: too small and it cannot express a real audience, too large and no platform will run it.
Measurement has to survive the privacy. If the result never leaves the device, you cannot count conversions the usual way. The honest answer is aggregate-only reporting with noise, or a holdout at the predicate level — both are weaker than what list-based activation gives you today, and any pitch that does not admit that is lying.
Somebody has to want it. Platforms benefit from receiving data, not from refusing it. The argument that moves them is regulatory exposure and the fact that a conversational surface with an undisclosed advertising layer is a trust problem waiting to happen.

Where we think this is weakest

We are describing a standard, and standards are not set by the company with the best argument. They are set by whoever has distribution. We do not.
A predicate that returns true rarely enough is itself an identifying signal. If an audience is small, the fact that it fired tells the platform something. This needs minimum-population constraints inside the predicate, which we have specified and not yet proven.
The entire mechanism rests on the evaluator being honest. Hardware attestation on the assistant's side would close that, which is a far heavier lift than anything on the rest of this site.
None of this is required for the measurement product that pays the bills today. If you are evaluating Lift Mosaic as a buyer, judge it on the other screens; this one is where we are pointed, not where we are.

Demonstration of a design, not of a running system. The conversation above is simulated; the predicate shown is a specification we have written, not a format anyone has adopted. The measurement capabilities on the rest of this site are a different matter and are described there with their own status.