One, the private agent platform

TL;DR: One is Hussh's private-agent platform: the relationship layer where you own context, grant consent, and summon specialists such as Kai, Nav, KYC, and Gmail Agent. One runs on your own data plane (your pod), while Hussh is the control plane that enables exchange and holds none of your holdings.

Relations

What One is

A private agent platform: your context becomes useful only through consented specialists and clear receipts. One is the relationship layer; PCHP is the consent protocol underneath; specialists such as Kai, Nav, KYC, and Gmail Agent do bounded jobs instead of collapsing into one generic assistant.

The naming discipline is deliberate. As of mid-2026 the agentic-product market is racing to ship "an AI assistant" or "a personal agent." The risk for Hussh is that One becomes a generic noun, the platform name disappears, and the brand collapses into another assistant SKU. The capitalized One plus named specialists gives users, builders, and partners a vocabulary for separate responsibilities.

Control plane, not custodian

Hussh is the control plane, not the custodian of your holdings. Your private agent, One, runs on your own data plane: a small container (a pod) in your own cloud (BYOC), with keys on your own device (BYOK). Hussh operates that pod on your behalf but holds none of your information.

The division of labor is the whole point.

What Hussh keeps is public metadata only: an identifier and the pod's public key. Hussh relays sealed ciphertext between parties and authorizes consent. There is no Hussh vault of your information and no Hussh backup-of-record.
Where plaintext lives is inside your pod and on your device, nowhere else. Everything Hussh and the network see is encrypted. The durable backup is your own, in your own cloud, unlockable only with material that never leaves your device.
What flows across the network is sealed. Hussh enables the exchange; it never becomes the holder of what is exchanged.

This is what "Own your AI. Own your data. Own your compute." means in practice. One is your agent on your own plane. Hussh is the enabler that lets your agent reach the world without surrendering your records to reach it.

Every exchange rides PCHP: a single-use, signed, revocable grant scoped to exactly what the moment requires. Consent is not a one-time toggle buried in settings; it is issued per exchange, legible, and revocable. A specialist that needs a slice of context gets that slice for that purpose and no more, and every grant leaves a receipt you can read.

Because Hussh authorizes consent without holding the underlying records, the grant and the holdings stay separate concerns: Hussh can verify that an exchange is permitted while remaining unable to read what crosses.

Core Interaction Surfaces

Home & Voice Head: Voice plus glanceable cards anchored by the grounded One persona and native audio voice relays.
One Activity Feed: A cross-domain, read/unread-tracked activity surface aggregating events from Consent, Location, Kai, KYC, Connected Systems, and Connections.
Specialist Hubs: Analysis, Consent Center, and Marketplace surfaces standardized on canonical swipeable-tab primitives and unified card design tokens.

Specialist model

One should feel simple to the user, but the system underneath should stay separated by responsibility.

Kai: finance and investor specialist. Warm, present, brief. Assembles financial context, portfolio and import state, market questions, and decision receipts. Portfolio Advisor (RIA) and Investor are fully consolidated as nested subagents under Kai (rather than One-level siblings), aligning all finance turns under a single agent.
Nav: privacy and consent guardian direction. Precise, composed, audit-grade. Makes scope, exposure, revocation, and audit legible. Nav now directly manages the consolidated Consent Center including the relationships graph.
KYC: identity and verification specialist lane. It should not be erased into Kai or Nav when identity proof is the real job.
Email Agent: inbox specialist. Quiet, structured, efficient. Automates inbox scanning for priority nudges and inline chat drafts, while inbox triage stays with general email.
Gmail Agent: receipts and purchase-memory specialist. Binds to the user's email tile, indexing purchase records, flight confirmation receipts, and travel reservations into secure memory (formerly Personal Data), feeding other specialists like Kai without full email exposure.

The split is on purpose:

The specialist that helps you and the guardian that protects you should not be the same unchecked authority.

What One is not

Not a chatbot. The interaction surface is voice plus glanceable cards, not a chat log.
Not an LLM router. Models are interchangeable underneath (BYOA); the user never picks one.
Not a data lake. You own the vault context (renamed to Memory) on your own pod; partners do not receive broad memory mirrors.
Not an SSO. PCHP is a consent protocol, not an identity provider.
Not a custodian. Hussh is the control plane, not the holder of your records; the durable backup is yours, in your own cloud.

Brand discipline

"One" is always capitalized in Hussh product contexts. The numeral "one" used non-product-wise is the only allowed lowercase.

Direction and boundary

Current direction: One is the approved top private-agent direction, the relationship layer that summons specialists such as Kai, Nav, KYC, and Gmail Agent through scoped consent and policy boundaries.
Architectural direction: One runs on your own data plane (your pod) while Hussh stays the control plane, enabling exchange, relaying sealed ciphertext, and authorizing consent without holding your holdings.
Consistency rule: where an implementation diverges from the private-agent north star, the implementation moves toward it, not the other way around.

Sources

Kai
Nav
PCHP
BYOA
Three-layer architecture
hushh-research monorepo: github.com/hushh-labs/hushh-research