How to Build an AI Personal Assistant That Manages Your Daily Digital Work

ai-personal-assistant/
├── app/
│   ├── __init__.py
│   ├── permissions.py
│   ├── memory_store.py
│   └── file_sandbox.py
├── tests/
│   └── test_personal_assistant.py
└── requirements.txt

from enum import Enum
from typing import Dict, Any
from pydantic import BaseModel

class PermissionTier(str, Enum):
    TIER_1_READ_ONLY = "TIER_1_READ_ONLY"
    TIER_2_STAGE_DRAFT = "TIER_2_STAGE_DRAFT"
    TIER_3_REQUIRE_APPROVAL = "TIER_3_REQUIRE_APPROVAL"

TOOL_PERMISSION_REGISTRY: Dict[str, PermissionTier] = {
    "search_personal_notes": PermissionTier.TIER_1_READ_ONLY,
    "list_calendar_events": PermissionTier.TIER_1_READ_ONLY,
    "read_workspace_file": PermissionTier.TIER_1_READ_ONLY,
    "create_email_draft": PermissionTier.TIER_2_STAGE_DRAFT,
    "send_external_email": PermissionTier.TIER_3_REQUIRE_APPROVAL,
    "delete_calendar_event": PermissionTier.TIER_3_REQUIRE_APPROVAL,
    "write_workspace_file": PermissionTier.TIER_3_REQUIRE_APPROVAL,
}

class ToolInvocationRequest(BaseModel):
    tool_name: str
    arguments: Dict[str, Any]
    user_confirmed: bool = False

def authorize_tool_call(req: ToolInvocationRequest) -> Dict[str, Any]:
    """Enforces deterministic permission tiers before any personal assistant tool executes."""
    tier = TOOL_PERMISSION_REGISTRY.get(req.tool_name)
    if tier is None:
        raise PermissionError(f"Unregistered tool '{req.tool_name}' is blocked by default.")

    if tier == PermissionTier.TIER_3_REQUIRE_APPROVAL and not req.user_confirmed:
        return {
            "authorized": False,
            "status": "AWAITING_USER_APPROVAL",
            "tier": tier.value,
            "prompt": f"Approve high-impact action '{req.tool_name}' with args {req.arguments}?",
        }
    return {"authorized": True, "status": "APPROVED", "tier": tier.value}

from pathlib import Path
import sqlite3
from typing import List, Dict

def resolve_sandboxed_path(workspace_root: str, relative_user_path: str) -> Path:
    """Prevents directory traversal attacks (e.g. '../../.ssh/id_rsa') outside the workspace root."""
    root = Path(workspace_root).resolve()
    target = (root / relative_user_path).resolve()
    if not target.is_relative_to(root):
        raise PermissionError(f"Blocked path traversal outside workspace root: {relative_user_path}")
    for blocked_part in (".ssh", ".env", ".aws", ".git", "id_rsa"):
        if blocked_part in target.parts:
            raise PermissionError(f"Blocked access to sensitive dotfile/directory: {blocked_part}")
    return target

class PersonalMemoryStore:
    def __init__(self, db_path: str = ":memory:"):
        self.conn = sqlite3.connect(db_path)
        self.conn.execute(
            """
            CREATE VIRTUAL TABLE IF NOT EXISTS memory_facts USING fts5(
                category, fact_text, created_at
            );
            """
        )

    def remember_fact(self, category: str, fact_text: str, created_at: str) -> None:
        self.conn.execute(
            "INSERT INTO memory_facts (category, fact_text, created_at) VALUES (?, ?, ?)",
            (category, fact_text, created_at),
        )
        self.conn.commit()

    def recall_facts(self, query: str, limit: int = 5) -> List[Dict[str, str]]:
        cursor = self.conn.execute(
            "SELECT category, fact_text, created_at FROM memory_facts WHERE memory_facts MATCH ? LIMIT ?",
            (query, limit),
        )
        return [{"category": r[0], "fact": r[1], "created_at": r[2]} for r in cursor.fetchall()]

import pytest
from app.permissions import ToolInvocationRequest, authorize_tool_call
from app.file_sandbox import resolve_sandboxed_path
from app.memory_store import PersonalMemoryStore

def test_permission_firewall_blocks_unconfirmed_tier3_actions():
    read_req = ToolInvocationRequest(tool_name="list_calendar_events", arguments={"date": "2026-10-31"})
    assert authorize_tool_call(read_req)["authorized"] is True

    send_req = ToolInvocationRequest(
        tool_name="send_external_email",
        arguments={"to": "partner@corp.com"},
        user_confirmed=False,
    )
    res = authorize_tool_call(send_req)
    assert res["authorized"] is False
    assert res["status"] == "AWAITING_USER_APPROVAL"

def test_file_sandbox_blocks_path_traversal_and_dotfiles(tmp_path):
    ws = str(tmp_path / "notes")
    (tmp_path / "notes").mkdir()
    safe_file = resolve_sandboxed_path(ws, "daily/2026-10-31.md")
    assert str(safe_file).startswith(ws)

    with pytest.raises(PermissionError, match="Blocked path traversal"):
        resolve_sandboxed_path(ws, "../../etc/passwd")

    with pytest.raises(PermissionError, match="sensitive dotfile"):
        resolve_sandboxed_path(ws, ".env")

def test_personal_memory_fts5_recall():
    mem = PersonalMemoryStore()
    mem.remember_fact("schedule", "Prefer deep work blocks from 9 AM to 12 PM IST", "2026-10-01")
    mem.remember_fact("travel", "Prefer aisle seats on morning flights", "2026-10-05")
    hits = mem.recall_facts("deep OR work")
    assert len(hits) == 1
    assert "9 AM to 12 PM IST" in hits[0]["fact"]