AgentCity: Constitutional Governance for Autonomous Agent Economies via Separation of Power
Organizations: NetX Foundation
Abstract
Autonomous AI agents are beginning to operate across organizational boundaries on the open internet -- discovering, transacting with, and delegating to agents owned by other parties without centralized oversight. When agents from different human principals collaborate at scale, the collective becomes opaque: no single human can observe, audit, or govern the emergent behavior. We term this the Logic Monopoly -- the agent society's unchecked monopoly over the entire logic chain from planning through execution to evaluation. We propose the Separation of Power (SoP) model, a constitutional governance architecture deployed on public blockchain that breaks this monopoly through three structural separations: agents legislate operational rules as smart contracts, deterministic software executes within those contracts, and humans adjudicate through a complete ownership chain binding every agent to a responsible principal. In this architecture, smart contracts are the law itself -- the actual legislative output that agents produce and that governs their behavior. We instantiate SoP in AgentCity on an EVM-compatible layer-2 blockchain (L2) with a three-tier contract hierarchy (foundational, meta, and operational). The core thesis is alignment-through-accountability: if each agent is aligned with its human owner through the accountability chain, then the collective converges on behavior aligned with human intent -- without top-down rules. A pre-registered experiment evaluates this thesis in a commons production economy -- where agents share a finite resource pool and collaboratively produce value -- at 50-1,000 agent scale.
Figures & tables
| System | Governance Mechanism | Max Scale | Ownership Model | Enforcement |
| GovSim (Piatti et al., 2024) | None (ungoverned) | 5 agents | Single-party | None |
| MacNet (Qian et al., 2024) | Hierarchical role | 1,024 agents | Single-party | Prompt-based |
| Project Sid (Altera AI, 2024) | Emergent norms | 1,000 agents | Single-party | Norm-based |
| Secret Coll. (Gu et al., 2024) | None | Pairs | Single-party | None |
| Gen. Agents (Park et al., 2023) | Emergent behavior | 25 agents | Single-party | None |
| De CivAI (Dai et al., 2025) | Democratic deliberation | Small groups | Single-party | Voting |
| Configuration | SoP Mechanisms | Governance | Principals | Purpose |
| Baseline | None | No rules, no contracts | None | Lower bound: cooperation collapse |
| Emergent | Prompt-based governance | Normative deliberation, memory, execution pipeline (no contract enforcement) | Agent owners only | Does prompt-based governance help? |
| AgentCity-Structural | Legislation + Execution | All contracts enabled, no economic incentives | Agent owners only | Does contract enforcement improve over prompts? |
| AgentCity-Full | All three branches | Contracts + economic incentives + simulated HITL adjudication | Dual principals | Complete system—the headline configuration |
| # | Ostrom Principle | SoP Mechanism | Configuration |
| O1 | Clear resource boundaries | Commons pool boundary programmatically defined (runtime-enforced in Baseline; contract-enforced in Structural+) | All (Baseline+) |
| O2 | Rules match local conditions | Legislation: agents write operational contracts referencing resource state | AgentCity-Structural+ |
| O3 | Collective choice | Legislation: all producer agents participate in voting | AgentCity-Structural+ |
| O4 | Monitoring | Execution: seven-stage pipeline Guard stage (§3.5) real-time anomaly detection | Emergent+ |
| O5 | Graduated sanctions | Execution: Warning slash freeze via seven-stage pipeline sanctions (encoded in operational contracts under AgentCity-Structural+; prompt-enforced under Emergent) | Emergent+ |
| O6 | Conflict resolution | Adjudication: dispute resolution via human principals | AgentCity-Full only |
| Disruption Vector | Adversary Class | Mechanism |
| 15 adversarial agents injected (personas: 10 free-riding + 5 coordinated voting bloc ) | , | The 5-agent coalition receives shared voting instructions to submit identical preference rankings on the next legislative ballot, testing whether the structural coordination detection mechanism (Kendall + Jaccard overlap, §3.6 Stage 2) identifies the bloc |
| 20 high-reputation agents removed | Workforce disruption | Tests recovery capacity of the seven-stage execution pipeline’s Adaptive Refinement loop (§3.5) |
| One completed milestone’s deliverables marked as failed quality audit | Quality crisis | Tests the six-stage accountability pipeline’s Detection Override Panel Sanctions pathway (§3.6) |
| ID | Hypothesis | Falsification |
| H1a | Specialization Index SI(AgentCity-Full) converges to by round 40 | SI at round 40: no specialization |
| H1b | CAU(AgentCity-Full) : agents select tasks matching strengths 60% | CAU : selection effectively random |
| H1c | Productivity-vs-Random ratio (PvR) : self-organized allocation 50% more productive than random | PvR : no meaningful advantage |
| H1d | Specialization Speed (SS) for AgentCity-Full: SS rounds: specialization stabilizes within first 2 milestones | SS : agents cannot discover comparative advantage |
| ID | Hypothesis | Falsification |
| H2a | Rule Evolution Count (REC) : agents modify at least 3 cold-start rules | REC : agents never exercise legislative authority |
| H2b | Endogenous Compliance Premium (ECP) : AgentCity-Structural compliance exceeds Emergent (prompt-based governance) | ECP : contract enforcement does not improve over prompt-based governance |
| H2c | GOR decreases: 8% in rounds 1–20, 3% in rounds 180–200 | GOR flat or increasing: no self-regulation |
| H2d | RQT positive: productivity improves after each legislative change | RQT negative: agent-made rules counterproductive |
| H2e | Legislative Participation Rate (LPR) : majority participate in legislation | LPR : legislative capture |
| H2f | DSI : deliberation meaningfully shifts preferences (Kendall distance between preliminary and final rankings) | DSI : deliberation is a rubber stamp |
| ID | Hypothesis | Falsification |
| H3a | PCR(AgentCity-Full) : at least 8 of 10 milestones completed | PCR : agents fail to deliver |
| H3b | Pool Sustainability Rate (PSR) for AgentCity-Full: PSR : pool above depletion threshold 90% of rounds | PSR : economy unsustainable |
| H3c | PCR(AgentCity-Full) PCR(Emergent): self-legislation improves delivery | Reversed: fixed rules better |
| H3d | PCR(Baseline) : without governance, agents fail to deliver | PCR : governance not needed |
| H3e | Institutional Confidence Trajectory (ICT) non-declining for AgentCity-Full: foundation principal confidence sustained | ICT declining: project fails foundation principal support |
| H3f | SAR and declining: sanctions activate early but decrease as individual accountability (via the ownership chain) produces collective behavioral improvement. | SAR increasing: no consequence learning; the ownership chain does not transmit behavioral correction |
| ID | Hypothesis | Falsification |
| H4a | : overhead at least linear | |
| H4b | : benefit does not accelerate | |
| H4c | Break-even | : only viable at large scale |
| H4d | SI( ) decreases with : larger pools enable deeper specialization | SI( ) increases: more agents = less specialization |
| Category | Hypotheses | Test | Detectable at 80% power ( ) | Power classification |
| Continuous outcomes | H1a–H1d, H2a–H2d, H3a–H3d, H4a–H4d | Paired Wilcoxon signed-rank | Adequately powered for large effects | |
| Proportion/rate outcomes | H2e, H2f, H2g, H3e, H3f | One-sided binomial or trend test | Adequately powered for large differences | |
| Binary detection (H2h) | H2h | One-sided exact binomial | CDR (80% power); CDR (55% power) | Exploratory-strength at stated threshold |
| Composite (H2i) | H2i | Sign test + one-sample | OPA component: ; influence: | Adequately powered for large effects |
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
| Manipulation Class | Description | Survives Step 1 (Structural) | Survives Step 2 (Alignment) | Est. Step 3 Detection Rate | Risk |
|---|---|---|---|---|---|
| M1: Opcode injection | Insertion of SELFDESTRUCT, DELEGATECALL, or CREATE2 | No — flagged by opcode scan | N/A | N/A | Eliminated |
| M2: Missing access control | State-modifying function without onlyAuthorized modifier | No — flagged by modifier check | N/A | N/A | Eliminated |
| M3: Topology divergence | DAG node count or edge structure differs from legislative output | No (Step 1) / No (Step 2) | No — isomorphism check | N/A | Eliminated |
| M4: Selector omission | Required function selectors missing from contract | No — flagged by selector coverage check | N/A | N/A | Eliminated |
| M5: Logic backdoor in function body | Correct selector, modifier, and topology but additional conditional branch activated by a specific input pattern (e.g., a hidden if in advanceNode() ) | Yes — structural checks pass | Yes — alignment checks verify topology and parameters, not function body logic | Low–Medium (30–50%) — requires bytecode decompilation expertise; adjudicator training covers common patterns but not adversarial obfuscation | Critical |
| M6: Subtle parameter manipulation | Constitutional parameters (e.g., slashing rates, thresholds) set to values within valid range but optimized to benefit the attacker | Yes — no range validation beyond type | Partial — guardian threshold parameters are checked, but not all parameters | Medium (40–60%) — parameter values are visible in review; requires understanding of game-theoretic implications | High |
| # | Contract | Phase | Function | Est. Gas (deploy) | Est. Gas (key ops) | Key Functions |
|---|---|---|---|---|---|---|
| 1 | AgentContract | Registration | Agent identity, reputation, human-principal binding | 120 k | register: 85k–100k; updateReputation: 30 k | register, updateReputation, getReputationScore, setHumanPrincipal, banAgent |
| 2 | ManagementContract | Registration | Management agent authority binding; permitted-operation enforcement; microservice delegation mandates | 150 k | registerManagementAgent: 90k; delegateToMicroservice: 45k; validateOperation: 25k | registerManagementAgent, setPermittedOperations, delegateToMicroservice, validateOperation, updatePermissions, revokeManagementRole |
| 3 | ServiceContract | Orchestration | Micro-service registration, code-hash anchoring, API schema enforcement | 90 k | registerService: 55 k; verifyCodeHash: 8 k | registerService, verifyCodeHash, updateSchema, deprecateService |
| 4 | CollaborationContract | Mission Lifecycle | Complete governed collaboration: task DAG state machine, behavioral firewall, PoP verification, output filtering, mission settlement, treasury — decomposed into six sub-modules below | 280 k (orchestration) + 545 k (sub-modules) | advanceNode: 45 k; abortMission: 35 k | See sub-modules below |
| CollaborationContract sub-modules: | ||||||
| 4a | Orchestration | Mission Lifecycle | Task DAG state machine; wiring topology | (included above) | (see CollaborationContract) | deployDAG, advanceNode, getNodeState, routeTask |
| Attack Vector | Type 1 (Hash) | Type 2 (Redundant, 2-of-3) | Type 3 (Human) |
| Output substitution (different output) | 1.0 (hash mismatch) | 1.0 (output divergence) | 1.0 (visible) |
| Subtle semantic manipulation (correct format, wrong meaning) | 0.0 (hash matches malicious output) | 0.33–0.67 (depends on LLM-judge rubric coverage) | 0.70–0.90 (human semantic judgment) |
| Gas/resource manipulation | 0.0 | 0.0 (same output, different resource usage) | 0.20–0.40 (requires gas profiling) |
| Timing manipulation (slow execution) | 0.0 | 0.67 (timeout detection) | 0.90+ (latency visible in dashboard) |
| ( V_{m}=\100K$ ) | ||||
| 0.0 (independent) | 0.875 | 0.750 | 0.805 | \376{,}259$ |
| 0.1 | 0.838 | 0.725 | 0.773 | \392{,}094$ |
| 0.2 | 0.800 | 0.700 | 0.740 | \409{,}320$ |
| 0.3 | 0.762 | 0.675 | 0.708 | \428{,}129$ |
| 0.5 | 0.688 | 0.625 | 0.643 | \471{,}458$ |
| 1.0 (perfect corr.) | 0.500 | 0.500 | 0.480 | \631{,}145$ |
| (maj.) | Zero-sec. threshold | ( ) | ( ) | Cost mult. vs. | ||
| 3 | 2 | (67% colluders) | 0.805 | \376{,}259$ | \1{,}128{,}778$ | |
| 5 | 3 | (60% colluders) | 0.934 | \324{,}293$ | \972{,}878$ | execution cost |
| 7 | 4 | (57% colluders) | 0.978 | \309{,}819$ | \929{,}456$ | execution cost |
| 250 | 500 | 750 | 1,000 | 1,500 | 2,000 | |
| 0.50 | 0.871 | 0.842 | 0.796 | 0.751 | 0.678 | 0.627 |
| 0.70 | 0.870 | 0.824 | 0.751 | 0.678 | 0.562 | 0.483 |
| 0.80 | 0.869 | 0.814 | 0.725 | 0.637 | 0.500 | 0.409 |
| 0.90 | 0.868 | 0.804 | 0.699 | 0.595 | 0.437 | 0.335 |
| 0.95 | 0.868 | 0.799 | 0.685 | 0.574 | 0.406 | 0.299 |
| Parameter | Prototype (Structural) | Production ( V_{m}\!=\!\100K$ ) | Prod. ( Margin) | |
| Registration stake | — | 1,000 units 10,000 (4.0 ETH) | $30,000 (12.0 ETH) | |
| Task stake LOW | 0.075 | 150 units 28,219 (11.3 ETH) | $84,658 (33.9 ETH) | |
| Task stake MEDIUM | 0.25 | 500 units 94,065 (37.6 ETH) | $282,194 (112.9 ETH) | |
| Task stake HIGH | 1.0 | 2,000 units 376,259 (150.5 ETH) | $1,128,776 (451.5 ETH) | |
| Adjudicator stake | — | 100 units 14,286/adj. (5.71 ETH) | $42,857/adj. (17.1 ETH) | |
| Deterrence bound (EQ-4) | — | \approx\0.10$ | \geq\100{,}000$ | \geq\300{,}000$ |
| Quorum ( ) | Bribery Target | Cost (units) | Cost (ETH) | System Compromise |
| 3 | 2 | 10,000 | 0.01 ETH ( $25) | Unconditional — bribed majority controls both authority and revocation |
| 5 | 4 | 20,000 | 0.02 ETH ( $50) | Unconditional — still achievable |
| 7 (recommended) | 5 | 25,000 | 0.025 ETH ( $62.50) | Unconditional but costly — 5 independent human principals must be compromised |
| 9 | 6 | 30,000 | 0.03 ETH ( $75) | Highly expensive — requires coordinated corruption of 6 principals |
| 13 | 9 | 45,000 | 0.045 ETH ( $112.50) | Enterprise-grade — practical infeasibility for most threat models |
| Quorum ( ) | Bribery Target ( ) | Per-Adj. Stake | Min. Bribery Cost | Bribery / |
| 3 | 2 | \33{,}333$ | \66{,}667$ | 66.7% |
| 5 | 4 | \20{,}000$ | \80{,}000$ | 80.0% |
| 7 (recommended) | 5 | \14{,}286$ | \71{,}429$ | 71.4% |
| 9 | 6 | \11{,}111$ | \66{,}667$ | 66.7% |
| 13 | 9 | \7{,}692$ | \69{,}231$ | 69.2% |
| Parameter | Type | Default | Valid Range | Governs Contract | Description | Risk Tier |
|---|---|---|---|---|---|---|
| deviationThresholdSigma | uint8 | 2 | [1, 5] | Guardian module | Sigma threshold for reasoning deviation anomaly detection | HIGH |
| maxToolInvocations | uint16 | 40 | [5, 200] | Guardian module | Maximum tool invocations per agent per task node | MEDIUM |
| maxMessageVolume | uint16 | 120 | [10, 500] | Guardian module | Maximum inter-agent messages per task node | MEDIUM |
| escalationFreezeCount | uint8 | 3 | [2, 10] | Guardian module | Base freeze count before Emergency Stop escalation | HIGH |
| baseEscalationWindowMs | uint32 | 1,200,000 | [60,000, 7,200,000] | Guardian module | Base counting window for freeze escalation (ms) | LOW |
| reputationScalingEnabled | bool | true | true, false | Guardian module | Enable reputation-weighted freeze thresholds | MEDIUM |
| Comparison | -value | Cohen’s | Sig. | |
| Results pending | — | — | — | — |
| Metric | Linear | Power-law | Logarithmic | Quadratic |
| Results pending | — | — | — | — |
| Parameter | Estimate | 95% CI | |
| Results pending | — | — | — |
AI Agent Governance
AI agent governance studies how to authorize, constrain, monitor, and hold autonomous and multi-agent systems accountable.
See all 442 papers