Abstract

Open the Door, Keep the Keys: How Phones Can Let Rival AI Assistants In Without Handing Over Control — A Technical Way Through the Siri AI and EU Digital Markets Act Article 6(7) Deadlock

Abstract

In June 2026 Apple said its new Siri AI would not launch on iPhone and iPad in the European Union, citing the Digital Markets Act (DMA) and the difficulty of giving rival assistants deep device access without weakening privacy and security. The European Commission replied that the DMA does not prohibit the launch and that compliant interoperability is possible. Behind this disagreement sits one engineering question that every platform now faces: how can any AI assistant, first-party or third-party, request messages, payments, files, sensors and settings without automatically gaining authority to make every requested consequence happen?

Permissions, sandboxing, app intents, OAuth, fine-grained authorisation (RFC 9396), sender-constrained tokens (RFC 9449), trusted execution environments and attestation are essential building blocks. None of them, by itself, guarantees that the exact operation about to leave the device is still the one that was approved, with the same recipient, amount, file and current policy.

This disclosure describes an execution-finality architecture that separates the power to request from the power to execute:

  • Staging. An assistant’s proposed operation is held as a non-effective Candidate Act.
  • Validation. A Protected Execution Domain checks identity, policy, user intent where required, revocation, epoch, freshness, quota and integrity, and commits pre-effect validation evidence.
  • Narrow authority. It then issues non-bearer authority bound to the exact act, requester, resource, destination, sink, policy generation and a single-use nonce.
  • Final gate. A mandatory Finality Sink re-derives the actual pending effect from real system state and compares it field by field with what was authorised. It re-checks current state and consumes the authority atomically before anything happens.
  • Fail-closed. Any mismatch, replay, staleness or uncertainty stops the action.
  • Hardened variant. A fresh sink-issued challenge and a live, challenge-bound requester presentation make captured presentations useless for replay.

The disclosure includes fifteen independently testable enforcement points, formal invariants, and an explicit comparison with OAuth at the final boundary. It answers about forty anticipated objections, covering privacy, accessibility, user autonomy, background agents, crashes, parity and gatekeeper entrenchment. Two runnable reference implementations are included. The result is one technical pattern for open participation with bounded, verifiable effect authority, applied equally to every assistant.

Industry relevance (AI-generated): the architecture concerns publicly described assistant and agent ecosystems, including:

  • Apple Siri AI, Apple Intelligence and App Intents, in the EU DMA interoperability context
  • Google Gemini on Android and Android AppFunctions
  • Samsung Galaxy AI
  • Microsoft Copilot with MCP and Agent2Agent patterns
  • OpenAI ChatGPT and the Agents API
  • Anthropic Claude and the Model Context Protocol
  • AWS MCP Server and agent services
  • Mistral AI Le Chat and Vibe
  • the Deutsche Telekom Magenta AI Call Assistant

These products are named only as examples of environments where assistants request consequential device, app, network or cloud actions. Naming them does not allege that any product is insecure, non-compliant or infringing. It does not describe undisclosed internal architectures and does not imply endorsement. This document takes no position on the legal dispute. The Siri AI and DMA context and all industry-relevance material are AI-generated summaries of public reports and must be cross-checked against the original PCT filings and primary sources before drawing any conclusion.

This technical disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026 (WO 2026/150382). That application claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026 (WO 2026/115520). A related family application on device-side AI agent governance is PCT/IB2026/055870, filed 10 June 2026 and published 16 July 2026 (WO 2026/150384). The architecture details are as published in Internet-Draft draft-das-execution-finality-ai-interoperability-05 on 19 September 2026, and related family applications can be cross-checked on WIPO PATENTSCOPE. Licensed under CC BY-NC 4.0. The author is open to acquihire or strategic collaboration.

Keywords

Digital Markets Act Article 6(7); Siri AI; Apple Intelligence; App Intents; Gemini on Android; AppFunctions; Galaxy AI; Copilot; ChatGPT; Claude; Model Context Protocol; A2A; Mistral; AI interoperability; third-party AI assistant; execution finality; non-bearer authority; Finality Sink; reference monitor; policy enforcement point; complete mediation; confused deputy; prompt injection; DPoP; RFC 9396; TOCTOU-resistant commit; anti-replay; trusted execution environment; attestation; parity; privacy by design; machine enforcement.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS