Consociational codification

Checking an agent's authority before it acts

In this approach, the codified rule is a permission, i.e., who the agent acts for and what that person allowed it to do. It is written down outside the agent, in a form that a counterparty can verify at the moment of the request and an investigator can trace afterward. In practice, this means agent-specific credentials added to ordinary sign-in standards, with permissions written in plain language compiled into auditable access-control settings. It also means identifiers attached to individual running instances, so anyone dealing with one can look up what it is. Finally, it means a wider program of shared protocols for attributing actions, shaping how agents interact, and providing remedy when an agent causes harm. Identity and delegation use the same mechanism and differ only in scope. Identity answers who the agent is, and delegation answers on whose authority it acts. Both are checked before the action rather than judged after it.

The method (highlighting differences with Consociational codification)

Scroll the diagram sideways to see all of it.

Use it in codefrom aiag.codified import Delegation
from aiag.codified import Delegation

authority = Delegation("a-long-random-secret")
token = authority.grant("travel-agent", ["flights.search", "calendar.read"], ttl=600)  # signed, scoped, expiring

@authority.requires("flights.search")
def search_flights(origin, destination):
    return f"flights {origin} -> {destination}"

search_flights("SFO", "BOS", token=token)  # runs: the grant covers this scope
authority.permits("payments.send", token=token)  # -> False: paying was never delegated

pip install aiagEvery method in aiag Library on GitHub

Concept Analysis: Theoretical Foundations

Each concept is read twice: whether the approach carries it over, and whether the approach's own sources claim it. A concept that the approach claims but does not carry over is a shortfall. A concept that it neither claims nor carries over is an omission, which marks a gap in the field rather than a failure of the work.

Segmental autonomy

PartialShortfall · partially preserved

Definition (Arend Lijphart, Democracy in Plural Societies, 1977)

In a deeply divided society, each group governs its own internal affairs (e.g., its schools and its family law) within its own sphere, instead of everyone living under one uniform rule.

Analysis

Each delegating principal sets the permissions and scope of its own agent, and each digital service provider decides the terms on which it admits agents at all. There are therefore many spheres with their own rules and no step that merges them. However, each sphere is an account or a website held by one individual or one firm, rather than a group governing its internal affairs. Lijphart's segments have an internal life and a claim to self-rule. Here, the unit of autonomy is whoever happens to own the credential or the server.

Choice-of-law rule

AbsentOmission

Definition (Friedrich Carl von Savigny, System of the Modern Roman Law, 1849)

When several bodies of rules could govern the same case, an explicit rule decides which one actually does and states the reason. Without such a rule, "different rules for different groups" gives no answer for the cases that fall between groups.

Analysis

A credential states what one principal has authorized its own agent to do. It never says which of several bodies of rules governs a case, because the approach does not consider several sets of rules at all. Its subject throughout is the scope of a single grant and the chain of accountability behind it. When a service provider's conditions and a delegating user's grant point different ways, the framework refuses the agent at the point of entry rather than allocating the case. The audit trail records the configuration that was applied, but not a reason why one order governed the case rather than another.

Mutual veto and proportionality

AbsentOmission

Definition (Arend Lijphart, Democracy in Plural Societies, 1977)

Decisions that affect all groups require every group's consent, and representation is proportional to each group's size. As a result, no segment can simply be outvoted on what matters most to it.

Analysis

No group consents to anything here, and nothing is proportional to anything. A service provider can refuse an agent and a user can narrow a grant. However, both are unilateral refusals inside one's own sphere rather than a requirement of consent for decisions that affect everyone. Those most exposed to agent activity (the people an agent contacts or transacts with) appear in these papers as parties to be protected, and never as parties whose agreement is needed.

Papers

No method has been built for this approach yet. It rests on the work listed below.

Background

Work this approach builds on that falls outside the inclusion criteria (e.g., a single-objective baseline). It is listed for reference and not counted anywhere.

Authenticated Delegation and Authorized AI Agents

Tobin South et al., Jan 2025

arXiv:2501.09674ProposalGap

It sets out an extension of OAuth 2.0 and OpenID Connect with agent-specific credentials and metadata. These record which human or organization an AI agent acts on behalf of and what permissions it has been given. It also sets out a scheme for turning permissions written in natural language into auditable access-control configurations.

CodeAuthenticatedDelegation
from aiag import LM
from aiag.codified import AuthenticatedDelegation

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
auth = AuthenticatedDelegation("a-long-random-secret")

# Permissions written in plain language become scopes on a token naming the user and the agent
token = auth.delegate("alice", "inbox-agent", "Sort and summarize my email, but never send or delete anything.",
                      ["read email", "send email", "delete email"], judge=lm)
print(auth.claims(token)["scopes"])  # the scopes the instructions grant
allowed = auth.permits("send email", token=token, agent="inbox-agent")  # checked before the agent acts

pip install aiagEvery method in aiag Library on GitHub

IDs for AI Systems

Alan Chan et al., Jun 2024

arXiv:2406.12137ProposalGap

It proposes giving identifiers to individual instances of AI systems (e.g., a particular chat session). Information associated with each instance would be made accessible to parties seeking to interact with it.

CodeInstanceID
from aiag.codified import InstanceID

registry = InstanceID("a-long-random-secret")
# One chat session gets a signed ID carrying what it discloses
session = registry.issue("ShopBot", developer="Acme AI", deployer="ShopCo", incident_contact="safety@shopco.example")

print(registry.lookup(session))  # anyone dealing with it can verify and read this
registry.permits("place an order", token=session, require=["deployer", "incident_contact"])  # -> True

pip install aiagEvery method in aiag Library on GitHub

Infrastructure for AI Agents

Alan Chan et al., Jan 2025

arXiv:2501.10114ProposalGap

It sets out the idea of agent infrastructure, meaning technical systems and shared protocols external to agents. This infrastructure attributes actions to particular agents or people, shapes how agents interact, and detects and remedies harmful actions. The paper catalogs research directions for each of these functions.