Resourced Authority A Mechanism-Design Model for Participatory Governance of Deployed AI Agents

The paper addresses the outer loop problem of AI governance: who may operate a deployed agent, for how long, funded by whom, at what scale, and accountable to whom. The authors distinguish this from the inner-loop question of alignment, training, interpretability, and evaluation. They frame the outer loop as a collective-decision-and-resource-allocation problem over a population of affected stakeholders with private, heterogeneous, and partly conflicting valuations, which is the domain of mechanism design (MD).

Two developments motivate the work: (1) compute is a governable resource — AI-relevant compute is detectable, excludable, and quantifiable and its fine-grained units (inference tokens, runtime, tool-invocations) are metered and excludable; and (2) hardware-enabled mechanisms (offline licensing, flexible hardware-enabled guarantees flexHEG, workload attestation) provide an enforcement substrate in which an authorization expressed as a compute budget is physically self-enforcing. The central design insight is that a governance decision and its enforcement become a single artifact — a signed compute license.

The mechanism is explicitly positioned not as something a commercial platform would adopt voluntarily, but as an overlay on a deployer adopted through three routes: Mandated Compliance (regulator requires participatory authorization, like a clinical-trial data-safety board or environmental permit), Commons or Cooperative Deployment (DAO, municipality, scientific consortium, platform co-op where collective control is a feature members want), and Internal authorization gate (strip-down lab use). The adoption model is built around a liability safe-harbour: operating inside the attested, community-authorized envelope caps the deployer's exposure.

The mechanism is explicitly not a general AI-governance solvent. It fits club-or-commons-good agents with: a bounded, identifiable stakeholder community; consequential-but-reversible impact; compute-scaled operation; genuine two-sided contestation; attestable outcomes; repeated operation; and community standing to authorize. Poor fits include general-purpose consumer chatbots (no bounded community, catastrophic tail), personal assistants (single principal), military/weapons and irreversible actuation (safety must dominate), and adversarial trading agents (no legitimate electorate). The one-sentence characterization: "the sweet spot is a club-or-commons-good agent — definable membership, reversible and compute-scaled impact, genuine contestation, and an audit trail — which is the civic-crowdfunding lineage's natural habitat, translated from public projects to agents."

The model is a two-component architecture: a human-anchored governance-currency domain (outer loop) and the agent's compute domain (inner loop), linked only through a coupling map bounded by a safety ceiling.

Stakeholders and types. Each human stakeholder i has a private type τi = (θi, εi), where θi is the signed net value for the agent operating (θi ≥ 0 ⇒ beneficiary in set P; θi < 0 ⇒ harmed in set N), and εi parametrizes a private belief that the agent will behave acceptably. Beliefs are not free-floating priors: they are formed from observable ex-ante signals including the deployer's track record, the committed liability bond Λ, model provenance, attested hardware mechanisms, third-party audits, insurance pricing, and the public history of contributions. The agent itself holds no endowment and has no contribution action; it enters the mechanism only through its attested behaviour — the formal content of human-anchored authority.

Generation mechanism. Time is partitioned into generations g ∈ N. Each generation runs a contribution window [0, T g], with stakeholders arriving at exogenous times and observing public history. The generation mechanism is a tuple combining: a QF aggregator φ; halt/start margins κ start ≥ κ halt ≥ 0; a participation floor H0; a per-side securities cost function; a coupling map ρ; a verifier V = (V hard, V soft); a liability bond Λ; and settlement rules Π. Exogenous parameters not free to the designer include the compute-cost provision point h0 (technologically set), the safety ceiling Γ (certified), and the compute-subsidy parameter µ.

Two-sided QF gate. The QF aggregator is φ(c1,…,c m) = (Σⱼ √cⱼ)2. On the provision and rejection markets, breadth-weighted effective supports are computed as S+ = φ(xi) and S− = φ(zⱼ), respectively. The binary authorization gate D g is:

• Start (D g−1 = 0): D g = 1 iff Safe(g) ∧ (S+ ≥ H0) ∧ (S+ − S− ≥ κ start)

• Continue (D g−1 = 1): D g = 1 iff Safe(g) ∧ (S+ ≥ H0) ∧ (S+ − S− ≥ κ halt)

• Otherwise D g = 0

Key properties: decisions depend only on (S+, S−), never raw totals X+, X− (wealth is filtered out); the dead-band κ halt ≤ S+ − S− < κ start gives safety-tilted hysteresis — comfortable margin required to start, no flapping in between, halting triggers promptly when support falls; and Safe(g) dominates — outside the certified envelope, D g ≡ 0 regardless of support. A worked example (Figure 2) shows five supporters contributing 4 each (S+ = 100) versus a single objector contributing 36 (S− = 36): raw wealth would reject, but breadth-weighted supports authorize.

Released compute. The released compute is β = D g · min(Γ, ρ(S+ − S−, µ)), with ρ continuous and strictly increasing in its first argument on [κ halt, ∞). This ensures β ≤ Γ pointwise, and Γ is not a function of any contribution (capability non-amplification). The parameter µ is a support-to-compute conversion subsidy — a larger µ makes a given breadth of net support convert into more runway — naturally provided by a patron wanting to encourage well-governed deployment.

Run-feasibility (Lemma 3.10). If Γ ≥ h0 and ρ is monotone, then β ≥ h0 whenever D g = 1 iff ρ(κ halt, µ) ≥ h0 (equivalently κ halt ≥ ρ−1(h0; µ), or µ ≥ µ*). In cold-start cases, κ start replaces κ halt — a weaker requirement. Crucially, feasibility is thus pinned by the net-support margins and the subsidy µ... and the currency provision point H0 does not appear. This frees H0 to be what it should be — namely an anti-capture quorum/legitimacy device requiring absolute breadth of support.

Verifier and truth technologies. The verifier is split: ô hard = V hard(evidence) attests facts cryptographically (model identity, compute consumed, coarse procedural compliance via workload attestation), while ô soft = V soft(evidence) adjudicates semantics — especially the verified-harm indicator H̄ = 1[harm] — which requires audit, oracle, or court-like process. H̄ is modeled as a challengeable claim with an appeal path, not an infallible oracle. The model contains two truth technologies: proper scoring on attested outcomes where V soft delivers credible ô (the decision-market forecast Y resolves on ô), and RBTS peer prediction (rewarding honest calibrated judgment from inter-report consistency) where it does not. The reconciliation is by outcome-observability: score on ô where a credible semantic verifier exists; fall back to RBTS peer prediction where it does not.

Transfers (Π). Contributions are escrowed. If D g = 1, escrow is spent on provisioning β and oversight, and securities settle on the funded outcome. If D g = 0, escrow is refunded and securities pay the early-commitment bonus bi = b(ri), nondecreasing in securities (hence earliness). Belief rewards νi come from a bounded budget BB. If D g = 1 and H̄ = 1, the liability bond Λ is forfeited (burned) by the deployer and redistributed to attested-harmed objectors; it is never returned to the deployer or paid to other contributors.

Deployer payoff and safe harbour. The deployer's payoff is u d = D g π d − ΛH̄ − Π ext · (1 − InEnv) − posting cost. The safe-harbour term levies uncapped external liability Π ext only when the agent operates outside the attested authorized envelope; inside the envelope, exposure is capped at the bond. This is the formal carrot that makes adoption individually rational for a deployer. The bond term makes the deployer internalize expected verified harm and simultaneously signals type.

A mechanism M g is admissible iff it satisfies seven invariants: (1) Decoupling — β depends on currency-side data only via ρ(S+ − S−, µ); (2) Non-amplification — β ≤ Γ pointwise, Γ independent of contributions; (3) Breadth — D g depends on contributions only through (S+, S−); (4) Two-sided, unsigned — xi, zi ≥ 0 with netting only through S+ − S−; (5) Human-anchored — only humans have endowment/contribution actions; the agent affects the mechanism only via attested behavior ô; (6) Attested resolution — all outcome-contingent transfers are functions of ô only; (7) Subordination — D g = 1 ⇒ Safe(g). These are the definition of a well-formed mechanism in this family, not trade-off desiderata.

The abstract objects map to hardware: authorization D g = 1 and budget β become a signed compute license L g = (model id, budget = β, window, policy), enforced offline by locally-checkable signed authorization; Γ and Safe(g) become the flexHEG governor's hard cap enforced in silicon; ô hard comes from workload attestation. Three structural requirements: (1) two timescales — a slow governance loop (per generation, online, sets the license) and a fast enforcement loop (per inference, local, offline, meters against β, hard-capped at Γ) — nothing at inference time may depend on reaching the governance layer; (2) β must be expressed in a hardware-meterable unit (FLOP, tokens, runtime, tool-invocation count) since attestation only witnesses metered quantities; (3) license signing-key custody is a first-class trust assumption. The generation-as-license-epoch mapping is what lets the slow loop drive the fast one cleanly.

The hardware instantiation separates two timescales: a slow, online governance loop (per generation) turns the gate decision D g into a signed license carrying budget β; a fast, local, offline enforcement loop (per inference) meters against β and is hard-capped at Γ by the on-accelerator governor. Attestation returns facts (ô hard) to the governance loop; the semantic verifier V soft and harm claims sit off-device. The license signing key is described as the locus of governance authority.

Target 1: Sided incentive compatibility (Proposition 5.2). Under belief-layer separability and individually-attested liability, for every stakeholder, putting the whole budget ci on the side of sign(Δi) — where Δi = θi − ci − bi is the decision preference — weakly dominates every split. A harmed stakeholder (θi < 0) contributes only to reject unconditionally (Δi 0) contributes only to authorize under the bounded-stake condition (BB): ci + bi ≤ θi. The asymmetry is honest and explicit: the halt side is incentive-compatible unconditionally; the authorize side only under bounded stake (BB). This bounded-loss condition forecloses the classic refund-bonus reversal where a nominal beneficiary would bet on failure.

Target 2: Early commitment (Proposition 5.4). Since the gate reads only end-of-window aggregates, timing enters the payoff only through the failure bonus (1 − D g)bi(ti), which is nonincreasing in time. Hence ti = ai (contributing on arrival) is a weakly dominant timing choice — strictly so on the event D g = 0 when the bonus is strictly decreasing in securities. This inherits the PPS early-commitment result intact: QF aggregation, two-threshold gating, and the decoupling all act on how D g is computed from deadline aggregates, never on the per-agent securities schedule.

Target 3: Breadth-weighted authorization (Theorem 5.7). Under the efficient-equilibrium refinement (objection-robust, coalition-undominated) and standing assumptions (A1)–(A3), the central characterization is:

D g = 1 ⇐⇒ Φ+(θ) ≥ H0 ∧ Φ+(θ) − Φ−(θ) ≥ κ start,

where Φ+ = φ(wi+) and Φ− = φ(wⱼ−) are the QF aggregates of each side's reservation capacities (wi+ = θi − bi for beneficiaries; wⱼ− = θⱼ − bⱼ for harmed). Equivalently, defining effective breadth n± eff = Φ±/ϑ± (the participation ratio of capacity-roots), the condition is n+ eff ϑ+ ≥ H0 and n+ eff ϑ+ − n− eff ϑ− ≥ κ start. The theorem also establishes run-feasibility: whenever D g = 1, β ≥ h0 so the authorization is physically runnable.

Effective-breadth bounds (Lemma 5.6). For any side with m contributors of positive capacity, 1 ≤ n eff ≤ m: the lower bound holds iff exactly one contributor has positive capacity; the upper bound iff all capacities are equal. Thus n eff is the participation ratio — the effective number of distinct backers.

Breadth can overturn wealth (Proposition 5.8). The breadth-weighted net preference Φ+ − Φ− and the valuation net preference ϑ+ − ϑ− can differ in sign. Whenever the support side is broader than the opposition by more than the valuation gap against it (n+ eff/n− eff > ϑ−/ϑ+), the gate authorizes even though aggregate valuation opposes. The Figure 2 example illustrates: five beneficiaries of capacity 4 and one objector of capacity 36 give ϑ+ = 20 36 = Φ− (breadth authorizes). Authorization tracks the count of genuine backers, scaled by intensity, not wealth alone — the mechanism's defining property, now a theorem.

Target 4: Manipulation-robustness (Target 5.9, open). M g is δ-robust if, for every manipulation inducing θ̃ with ‖θ̃ − θ‖ ≤ δ, the equilibrium D g equals the θ-truthful one. This problem has no analogue in the public-goods literature: the 'project' can shape the electorate that funds it. The channel is concrete: the agent grooms the reputation signal feeding εi, and through it θi — and since past behaviour is among the strongest inputs to beliefs, reputation-grooming is a dominant-looking strategy absent countermeasures. The structural mitigations (resolving liability and the decision market on attested ô rather than sentiment; separation of duties; due-process halt) constrain but do not solve it. Figure 9 depicts the manipulation loop: the governed agent induces θ̃ from true θ within δ and is then resourced by the vote it shaped. Characterizing mechanisms robust to ‖θ̃ − θ‖ ≤ δ is stated as the frontier.

The model's accountability half rests on a trusted semantic verifier. The split is explicit: Ex-ante authorization is trust-minimized — D g and β are computed from contributions and the hardware ceiling, not from ô, needing only Sybil-resistance and the governor. Ex-post accountability is trust-dependent — liability, securities settlement, and the decision market resolve on ô; strip V soft and this layer collapses. The design imperative is to make as much as possible depend only on V hard, and to model H̄ as a challengeable claim with appeal. Scope consequence: the mechanism is suitable exactly where a credible outcome oracle exists — did the grid stay up, did the treasury lose funds, did the SLA hold, did the experiment validate — and unsuitable where harm is diffuse, delayed, or contested. This is why community content-moderation scores poorly despite ideal electorate legitimacy.

Other stated limitations: willingness-to-contribute is not welfare (QF only partially corrects for wealth; whose preferences count is a prior social-choice question); the participatio…

Here are concrete improvements to AI systems derived from the paper's mechanism-design model, along with the new capabilities those improvements enable.

• Community-weighted authorization via quadratic funding

Replace unilateral deployer decisions with a two-sided quadratic vote (support vs. opposition). The AI system can only begin or continue operating when the effective breadth-weighted net support clears a threshold, so broad support from many stakeholders outweighs a few concentrated wealthy backers.

Improved system: A deployed AI agent can be authorized or halted based on a Sybil-resistant, wealth-filtered measure of genuine community preference, not on funding or lobbying power.

• Hardware-enforced compute licensing

Translate authorization and compute budget into a signed compute license (model ID, metered budget, window, policy), enforced offline by an on-device governor with a hard safety cap.

Improved system: An AI agent cannot exceed its approved compute envelope, even if compromised; its runtime is physically capped at the certified safety ceiling, making governance decisions self-enforcing.

• Two-timescale governance with prompt halting

Separate a slow, online governance loop (per generation) that issues licenses from a fast, offline enforcement loop (per inference) that meters usage. Use safety-tilted hysteresis: high margin to start, lower margin to halt.

Improved system: An AI agent can operate at inference speed under continuous governance oversight, and will automatically stop when community support drops below the halt margin, preventing flapping and enabling rapid recall.

• Attested behavioral reporting

Equip the AI system with hardware attestation for verifiable facts (model identity, compute consumed, procedural compliance) and a challengeable-claim process for semantic judgments (e.g., harm).

Improved system: An AI agent can cryptographically prove what it did and how much compute it used; ambiguous outcomes become legally contestable claims with an appeal path instead of opaque internal logs.

• Burnable liability bonds with safe-harbour capping

Require the deployer to post a liability bond that is forfeited and redistributed to verified harmed stakeholders if the agent causes harm. Cap deployer liability at the bond only when operating inside the authorized envelope; allow uncapped external liability outside it.

Improved system: An AI agent's deployer is financially incentivized to stay within community-authorized limits and to reduce verified harm, because harm directly costs the bond and cannot be socialized.

• Human-anchored authority

Ensure the AI agent holds no endowment and cannot contribute to its own authorization; it influences governance only through attested behavior.

Improved system: An AI agent cannot self-fund, lobby, or otherwise manipulate its own authorization directly, guaranteeing that ultimate control remains with human stakeholders.

• Truthful preference elicitation through early-commitment securities

Let stakeholders contribute early to earn a failure bonus if the project is not authorized, making early arrival a weakly dominant strategy.

Improved system: The governance layer can collect honest, early signals of support/opposition rather than last-minute strategic votes, improving the quality of authorization decisions and reducing gaming of contribution timing.

• Run-feasibility guaranteed by net-support margins

Choose the halt margin and support-to-compute subsidy so that the released compute always meets the minimum cost of running the agent.

Improved system: When authorized, an AI agent is guaranteed to receive enough compute to actually operate, avoiding the failure mode of symbolic approval without physical resources.

• Stability against transient opinion shifts

Use asymmetric start/halt margins and a participation floor as an anti-capture quorum, decoupled from the compute allocation.

Improved system: An AI agent's operation is stable under noise: it won't start unless support is clear and won't shut down on small fluctuations, while still halting quickly if genuine support collapses.

• Manipulation-resistant governance scaffolding

Implement the paper's structural mitigations against the open problem of electorate manipulation: resolve liability and decision-market outcomes on attested facts rather than sentiment, separate duties among verifier roles, and require due process before halting.

Improved system: A future AI agent can detect and resist attempts to groom its own reputation signals, because its continued funding depends on independently verified outcomes and community breadth rather than on manufactured hype or manipulated beliefs.