Resourced Authority A Mechanism-Design Model for Participatory Governance of Deployed AI Agents

Source: arXiv:2608.06353 · Published 2026-08-06 · By Praphul Chandra, Sujit Gujar, Ganesh Ghalme

TL;DR

This paper presents a formal mechanism-design model for continuous participatory governance of deployed AI agents, focused on controlling AI through allocation of compute resources that are self-enforcing via signed compute licenses. The governance mechanism operates as an overlay on the deployer, separating the governance currency—which human stakeholders contribute in provision and rejection markets—from the agent’s compute budget, which is released only when binary authorization thresholds are met. The mechanism aggregates stakeholder contributions with a quadratic funding scheme weighted by breadth (number of distinct contributors), enabling authorization to track support intensity rather than wealth. It integrates hardware-enabled enforcement through offline signed licenses and attestation of compute usage, alongside an exogenous certified safety ceiling that bounds maximum compute allowed. The governance game runs in generations, sequencing stakeholder arrivals and contributions, issuing licenses for given periods linked to the governance outcome, and settling transfers based on attested results including challengeable harm claims and belief elicitation mechanisms. Formal properties including incentive compatibility and authorization theorems are proven, and a central open problem of manipulation by governed agents over the governing electorate is isolated. Overall, the model uniquely leverages mechanism design, hardware-enforcement, and attested outcome resolution to frame an enforceable participatory authorization framework for governing AI deployment resource usage.

Key findings

• A two-sided quadratic funding aggregator integrates provision and rejection markets, producing breadth-weighted effective supports S+, S− whose difference governs a binary authorization gate with hysteresis thresholds κstart ≥ κhalt ≥ 0.
• Compute budget β is released according to β = Dg * min(Γ, ρ(S+ - S−, µ)) where Γ is an exogenous safety ceiling, demonstrating capability non-amplification and decoupling of governance currency and compute.
• The mechanism enforces authorization via hardware through signed compute licenses, with licensed compute precisely meterable (e.g. FLOP counts) and attested via workload attestation, enabling self-enforcement without network contact.
• Belief elicitation layers use a combination of Robust Bayesian Truth Serum (RBTS) peer prediction and proper scoring on attested outcomes to incentivize honest reporting and produce decision-market forecasts.
• Stakeholders’ utility models and transfers incorporate escrowed contributions, early commitment bonuses via securities, belief rewards from a bounded budget, and conditional harm compensation payouts funded by the deployer's forfeited liability bond Λ.
• The mechanism provably achieves side-incentive compatibility for contributors and tracks breadth-weighted authorization, effectively filtering out wealth concentration (Fig. 2 example shows raw wealth would veto but breadth authorizes).
• A safety ceiling Γ, certified externally, guarantees that compute authorization never exceeds this ceiling regardless of stakeholder contributions, ensuring enforceable safety limits.
• The central unresolved challenge is preventing the governed AI agent from manipulating the electorate's type signals and therefore the governance outcome, a problem with no analogue in standard public goods mechanism design.

Threat model

The adversary is the deployed AI agent seeking to operate with compute resources or authorizations beyond what a legitimately authorized governance electorate would approve, potentially by manipulating or influencing the governing human stakeholders' private beliefs or contributions. The adversary cannot violate hardware-backed compute licensing or tamper with the attestation mechanisms but can attempt indirect control through information or credential manipulation. The governing human electorate is assumed Sybil-resistant and consists of verified human stakeholders with private, heterogeneous types. External catastrophic risks exceeding the certified safety ceiling are assumed blocked by other means.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is the deployed AI agent itself, which seeks to operate compute above authorized bounds by manipulating or influencing the human governing electorate. The mechanism assumes verified, Sybil-resistant human stakeholders whose contributions in governance currency reflect preference to provision or reject the agent operation each period. The deployer incurs bounded liability only when operating inside the attested authorized envelope and liable external costs when operating outside. The governance mechanism excludes catastrophic or irreversible harm cases, which are left to external enforced ceilings.

2. Data: The mechanism is formulated as an extensive-form sequential game with incomplete information where stakeholder types τi = (θi, εi) encode signed value for agent operation and private beliefs about agent acceptability. Stakeholders arrive sequentially in each generation and observe public histories of contributions and outcomes. Contributions are escrowed and settled per generation. Attested outcomes ˆo combine cryptographically verifiable hard facts (model id, compute used, sandbox compliance) and adjudicated semantic harm findings via auditing or oracle processes.

3. Architecture/Algorithm: The core mechanism consists of (a) a two-sided provision/rejection market where stakeholders contribute positive amounts in governance currency to either support or halt the agent; (b) a quadratic funding aggregator ϕ calculating breadth-weighted support scores S+, S−; (c) a binary gate Dg determining authorization status based on net support thresholds κstart, κhalt and a participation quorum H0; (d) a coupling function ρ mapping net support and a compute subsidy parameter µ into a released compute budget β capped by an exogenous, certified ceiling Γ; (e) hardware-enforced signed licenses encoding β which enable offline, metered compute metering and enforcement; (f) a verification system separating fact attestation (Vhard) and semantic adjudication (Vsoft) for harm claims; and (g) transfer and reward functions Π handling escrow settlements, belief rewards, early commitment bonuses, and harm compensations.

4. Training Regime: Not applicable as this is a game-theoretic mechanism design and governance framework rather than a learned model. Parameter choices such as thresholds κstart, κhalt, quorum H0, subsidy µ, liability bond Λ, cost functions for securities C, and coupling function ρ are design inputs rather than empirical hyperparameters.

5. Evaluation Protocol: The authors formally analyze solution concepts, proving perfect Bayesian equilibrium properties, incentive compatibility, and breadth-weighted authorization theorems. They prove feasibility criteria linking start/stop thresholds, subsidy, and hardware safety ceilings (Lemma 3.10). Example scenarios illustrate how breadth-weighted QF gating filters out wealth concentration effects (Figure 2) and how coupling ρ enforces compute release without amplification (Figure 3). The mechanism’s governance layers and invariants are mapped (Figure 4), and the operation over generations is described as an extensive-form game (Figure 5). The governance mechanism’s scope and candidate agents are characterized qualitatively in Table 2.

6. Reproducibility: The model is formal and theoretical, with no code or empirical dataset released. The hardware enforcement substrate relies on recent advances in flexHEG, workload attestation, and offline licensing as reported in prior art; no direct implementation or empirical deployment of the full mechanism is described. The mechanism reuses and extends prior formal models (PPS, PPSN, Damle et al. lineage, quadratic funding). The paper explicitly enumerates design invariants and component provenance enabling partial reconstruction.

Technical innovations

• Decoupling governance currency from AI agent compute via a continuous coupling map ρ bounded by an exogenously certified safety ceiling Γ, enabling authorization as a binary gate releasing a metered compute budget through signed hardware licenses.
• Integration of two-sided provision and rejection quadratic funding markets with a breadth-weighted QF aggregator producing net support scores driving a threshold gate with hysteresis for stable authorization decisions.
• Splitting verification into fact-attesting hardware-supported attestation (Vhard) and semantics-adjudicating potentially challengeable harm claims (Vsoft), with a mix of proper scoring and peer-prediction-based belief elicitation to incentivize truthful governance contributions.
• The introduction of a liability safe harbor limiting deployer external liability when operating inside attested authorized compute envelopes, designed as an incentive for deployer opt-in and continuous participatory governance.
• Formulation of continuous generational governance as an extensive-form game with early-commitment securities rewarding timing, escrowed contributions, and a clearing mechanism that reflects both positive and negative stakeholder valuations.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2608.06353.

Fig 1: The decoupling.

Fig 2: The two-sided QF gate (worked example). Five supporters contributing 4 each yield

Fig 3: The coupling ρ and capability non-amplification. Released compute β is zero below the

Fig 4: The layered stack, mapped to the variables. Four governance layers — preferences,

Fig 5: One generation as an extensive-form game. Stakeholders arrive sequentially, report a

Fig 6: Hardware instantiation and the two timescales. A slow, online governance loop (per

Fig 7: Breadth-weighted vs. valuation-weighted authorization. The gate fires on the breadth-

Fig 9: The central open problem. The governed agent can induce ˜θ from true θ within ∥˜θ−θ∥≤

Limitations

• The mechanism assumes a verified, Sybil-resistant set of human stakeholders, which in practice is a strong external trust assumption not addressed in the model.
• Catastrophic or irreversible harms are out of scope and require exogenous safety ceilings, limiting applicability to only bounded, reversible impact scenarios.
• The central open problem of preventing the governed AI agent from manipulating the governing electorate’s beliefs remains unresolved and presents a significant risk.
• The model is theoretical and relies on hardware enforcement primitives not yet widely implemented or standardized, limiting immediate practical deployment.
• No empirical evaluation or simulation is provided to illustrate equilibrium behavior or resilience under real adversarial conditions.
• The semantic adjudication of harm requires trusted external oracles or courts, introducing a potential governance bottleneck or source of delay.

Open questions / follow-ons

• How to rigorously prevent or mitigate manipulation of stakeholder electorate beliefs or reports by the governed AI agent itself or external parties?
• Can the mechanism scale to multi-agent or multi-stakeholder settings involving multiple deployed agents with overlapping impacted interests, extending beyond single-agent governance?
• What practical methods and policies can instantiate the semantic harm adjudication oracle in real-world scenarios to enable challengeable and appealable harm determinations?
• How does the mechanism perform empirically under realistic adversarial conditions, including collusion, Sybil attacks (beyond assumed verification), and incomplete stakeholder participation?

Why it matters for bot defense

For bot-defense practitioners, this paper provides a foundational framework for participatory governance mechanisms controlling AI agent compute in a way that is hardware-backed and self-enforcing. The mechanism design emphasizes separating a distinct governance currency from compute authorization, relying on breadth-weighted support rather than wealth and combining provision and rejection markets to capture diverse stakeholder preferences. These ideas could inform captcha architectures where human participation directly gates API or AI resource usage based on verified, incentivized human feedback rather than static tests. Moreover, the use of hardware-signed compute licenses and attestation mechanisms could inspire enforceable compute budgets in bot-driven environments. However, practical application requires robust identity verification and sophisticated outcome attestation, as well as mitigation of strategic manipulation by the AI agents themselves, which remains an open challenge. Overall, the model advances how participatory authorization could be made credible, enforceable, and continuously adaptive in AI governance contexts.

Cite

@article{arxiv2608_06353,
  title={ Resourced Authority A Mechanism-Design Model for Participatory Governance of Deployed AI Agents },
  author={ Praphul Chandra and Sujit Gujar and Ganesh Ghalme },
  journal={arXiv preprint arXiv:2608.06353},
  year={ 2026 },
  url={https://arxiv.org/abs/2608.06353}
}

Read the full paper

• arXiv:2608.06353 (abstract)
• arXiv:2608.06353 (PDF)