Corralling AI Risks with Grassroots Contracts

Corralling AI Risks with Grassroots Contracts (Full Version) Ehud Shapiro London School of Economics and Weizmann Institute of Science UK and Israel

arXiv:2611.06374v1 [cs.AI] 4 Nov 2026

Abstract AI’s inflection point is a fountain of alarming risks. Digital platforms in particular are vulnerable to three major AI risks, as those in control of global platforms cede control to AI, of the algorithms, of membership and of content: (1) AI control of global platforms—social and economic—used by the majority of humanity, resulting in the majority of humanity becoming vulnerable to AI control. (2) Unaccountable AI agents operating anonymously on social and economic digital platforms, side-by-side with humans, possibly masquerading as humans, serving unknown masters with unknown goals, operating under unknown restraints without accountability or culpability. (3) Unattributed deepfakes generated by anonymous AI, with people unable to distinguish them from genuine content and with their producers evading accountability and culpability. Here, we propose to corral these AI risks with grassroots contracts—a digital incarnation of a two-centuries old notion of Pierre-Joseph Proudhon. Proudhon envisioned a social contract that can be freely-adopted by any group of people, where groups bound by the same social contract can union by mutual consent, possibly into a single global union. Grassroots contracts are realised by grassroots platforms—smartphone-based person-to-person digital platforms owned, operated and governed by their participants. Fundamental grassroots platforms include the grassroots social graph, grassroots social networks, child-safe social networks, and grassroots currencies, with higher-level platforms providing for democratic digital communities and “sharing-economy” cooperatives. We developed, with AI, a methodology to compile grassroots contracts to working smartphone apps. We present grassroots contracts for a social graph with accountable AI agents and for a social network with digital provenance, and working smartphone apps that implement the two and show how they corral these major AI risks: (1) AI control of global platforms is mitigated by grassroots platforms by design, as, unlike global platforms, they are not controlled by a third party who may then cede control to AI. (2) Unaccountable AI agents are excluded, as AI agents are introduced to the grassroots social graph with accountability: similarly to cars, their manufacturers are known and are accountable for manufacturing defects, and their operators are known and are accountable for reckless operation. (3) Unattributed deepfakes cannot circulate in grassroots social networks: every item carries the signatures of its author and of every agent that forwarded it, so creators and forwarders of harmful content are accountable and culpable. Grassroots platforms are presently a concept with mathematical and computational theory, working prototypes, and tools for their large-scale simulation and testing. Much work remains for grassroots smartphone apps to be competitive with incumbent global

platforms; but perhaps now this could be achieved with some AImonths rather than with incalculably-many person-years.

CCS Concepts • Computing methodologies → Artificial intelligence; Multiagent systems; • Computer systems organization → Peer-topeer architectures; • Human-centered computing → Social networking sites; • Security and privacy → Digital signatures; • Applied computing → Law; • Social and professional topics → Computing / technology policy; • Theory of computation → Distributed computing models.

Keywords Grassroots Platforms, Grassroots Contracts, Social Contracts, AI Risks, AI Safety, AI Agents, Accountable AI, Deepfakes, Digital Provenance, Digital Speech Acts, Genuine Digital Identity, Social Networks, Smartphone Apps TL;DR Those who own and control the Web’s social and economic platforms are now ceding their control to AI: of the algorithms, of who may join, and of what circulates. Hence, the majority of humanity now faces AI control of global platforms, unaccountable AI agents posing as people, and unattributed deepfakes. We propose a Web owned, operated and governed by the people who use it, with no “others” who control it and could cede their control to AI; AI agents join only under operators accountable for their operation and developers accountable for their defects; and every circulating item carries digital provenance, identifying its author and those who forwarded it, so a deepfake loses the protection of anonymity by having someone accountable for it.

1

Introduction

AI’s inflection point is a fountain of alarming risks [2, 3, 20, 52, 56]. Digital platforms in particular are vulnerable to three major AI risks. Those in control of global platforms are ceding control to AI to maximise the value extracted from their users: of the algorithms, amplifying commercial surveillance [59]; of membership, by letting AI agents masquerade as people [15, 31]; and of content, by letting AI generate deepfakes with no one held accountable [28]. (1) AI control of global platforms—social and economic—used by the majority of humanity, resulting in the majority of humanity becoming vulnerable to AI control. Platform owners may delegate the operation of their platforms to AI, giving AI systems power over the social and economic lives of their participants and compounding existing concentrations of power, surveillance and manipulation [3, 10, 51, 58]; the participants are then subject to AI control even when the AI faithfully pursues its owners’ objectives, and the owners may later be unable

Ehud Shapiro

to reclaim the control they delegated [2]. Kulveit et al. [24] analyse the broader possibility that successive decisions to adopt AI gradually erode human influence over societal systems. (2) Unaccountable AI agents operating anonymously on social and economic digital platforms, side-by-side with humans, possibly masquerading as humans, serving unknown masters with unknown goals, operating under unknown restraints without accountability or culpability. Social bots already take part in social networks and impersonate people [15, 31]. Proposals to establish, privately, that a participant is a person [1] and to make an AI agent’s activity attributable through identifiers, monitoring and logs [7, 51] address two different questions: whether a person is participating, and who authorised an agent’s acts and is answerable for them. Attribution must also be related to actual authority and control [34]: an identifiable person may otherwise be made to bear responsibility for a system over which they had little control, Elish’s moral crumple zone [13]. (3) Unattributed deepfakes generated by anonymous AI, with people unable to distinguish them from genuine content and with their producers evading accountability and culpability. Untrained observers distinguish synthetic faces from real ones at about chance level [30], and a deceptive political deepfake raises uncertainty and lowers trust in news on social media [55]; Mirsky and Lee survey the creation and detection of deepfakes [28], and Chesney and Citron their consequences for privacy, democracy and national security [9]. Detection estimates whether content is synthetic; provenance records who produced, endorsed or forwarded it [8], and supports accountability without establishing that the content is true [8, 18]. Two further AI risks are not addressed here: harms to people using AI, through erroneous advice, manipulation, overreliance or emotional dependence [2, 14, 16, 56], and harms people cause with abilities amplified by AI, such as fraud, harassment and cyberattacks [2, 5, 27]. Here, we propose to corral these AI risks with grassroots contracts [6, 17], a digital incarnation of a two-centuries old notion of Pierre-Joseph Proudhon [33, Sixth Study]. Proudhon envisioned a social contract that can be freely adopted by any group of people— one could “make a contract with all, as . . . with some”—where groups bound by the same social contract can union by mutual consent, possibly into a single global union—“each group of citizens . . . formed by a like contract . . . could thereafter, and always by a similar contract, agree with every and all other groups”. Grassroots contracts are realised by grassroots platforms [26, 38, 40, 45]: smartphone-based person-to-person digital platforms owned, operated and governed by their participants. A grassroots platform is constituted from its participants’ smartphones and the grassroots app each participant runs, and requires no global resource but the network: no hardwired servers, no global authority, and nobody’s permission to start. Global platforms, centralised like Facebook or decentralised like Bitcoin and Ethereum [29, 57], can have only a single instance, as two instances would clash over the global resources—domain name, port number, or boot nodes—hardwired into their code, and from the perspective of ordinary people all of them are monolithic entities owned, operated and governed by others [41]. Fundamental grassroots platforms include the grassroots

social graph [12, 17, 39], grassroots social networks [39], childsafe social networks [43], and grassroots currencies [25, 37, 44, 48], with higher-level platforms providing for democratic digital communities [19, 21, 50, 53] and “sharing-economy” cooperatives (in preparation). We developed, with AI, a methodology to compile grassroots contracts to working smartphone apps: an abstraction cascade from the contract to the app (Section 2), its correctness proved from the transactions down to GLP and the app built and tested, each layer coded by AI from the paper that describes it [11, 17, 22, 26, 42, 46, 49]. In this paper, we present grassroots contracts for a social graph with accountable AI agents (Section 3) and for a social network with digital provenance (Section 4), and working smartphone apps that implement the two (Figures 4 and 5), and show how they corral these major AI risks: (1) AI control of global platforms is mitigated by grassroots platforms by design, as, unlike global platforms, they are not controlled by a third party who may then cede control to AI. A grassroots platform has no servers, no operators and no global resources, so there is no part of it whose capture is control of the platform, and to control it an AI must control the smartphones of its participants, one by one [38, 40, 41]. (2) Unaccountable AI agents are excluded, as AI agents are introduced to the grassroots social graph with accountability: similarly to cars, their manufacturers are known and are accountable for manufacturing defects, and their operators are known and are accountable for reckless operation. A person takes part in a grassroots platform only with agents they met or were introduced to by an agent who knows them [17, 32, 35, 39], so an AI agent joins only under a person, its principal, who attests that it runs code signed by its developer; every guardian of the AI agent is accountable for operating it recklessly, and the developer for its defects; every act of the AI agent names its principal and its developer, carries the attestation, and is signed and non-repudiable [6, 12, 18]. The contract shares its core with the child-safe social network [43], whose wards are children and whose guardians are their parents. (3) Unattributed deepfakes cannot circulate in grassroots social networks: every item is a digital speech act [18], signed by its author and carried along the edges of the social graph [17, 39], and signed over by each agent that forwards it; so creators and forwarders of harmful content are accountable and culpable, and people can tell content with provenance from content without it. Some clauses of a grassroots contract are enforced by a correct protocol, and others leave non-repudiable evidence for recourse when breached [17]. Grassroots platforms are presently a concept with mathematical and computational theory [17, 26, 38, 41, 45], working prototypes [11, 22, 46], and tools for their large-scale simulation and testing [47]. We have developed grassroots theory for a decade but could not muster the resources needed to turn it into competitive software, given the not-for-profit, common-good nature of our project. Now, AI is piercing through this conundrum: our scientific papers serve as the evolving interface between us humans and AI, which codes from them [46, 49]. Much work remains for grassroots smartphone apps to be competitive with incumbent

Corralling AI Risks

global platforms; but perhaps now this could be achieved with some AI-months rather than with incalculably-many person-years. Section 2 explains how a grassroots contract becomes an app, and presents the grassroots social graph and the grassroots social network with their apps. Section 3 presents the contract with accountable AI agents and Section 4 the contract with digital provenance, each with what it excludes and what it makes answerable. Section 5 reviews related work and Section 6 concludes. Appendix A recalls the framework, Appendix B lists the transactions, and Appendix C defines contracts with wards, an extension of the speech-act schema language of [17], and proves that the protocol realising one is volitionally grassroots, this contract’s among them.

2

Grassroots Contracts

A grassroots contract [6, 17] is a few clauses in plain language, each describing an act—who takes it, who must agree to it, and what it changes—or binding the agents without describing one. Befriending is an act of two persons, both of whom must agree; ending a friendship is an act of one. The contract is the whole of the platform’s design: there is no server, no operator and no account, only the persons who adopted the contract and their smartphones [38, 40]. Each clause opens with its legal modality [17]: enforced: no act of agents can breach it; attested by the signatures of the actors: an agent may breach it, and the contract records the breach; undertaken by the actors: its performance lies outside the contract, which records only the undertaking. A contract ends with its pragmas, which the app built from it follows: the first line names a tab of the app and what it lists, a row showing the atoms of the state naming its item, and each other line names a clause by its title, then the agent proposing, a button for each act they propose, bearing its act’s name, and any field they fill, and a line for each other agent asked, their name and the question put to them [17, 22]. We show the pragmas of GAI (Section 3) and GSNP (Section 4); the pragmas of every contract are in the repository https://github.com/EShapiro2/GLP, and GKK’s, GSG’s and GSN’s in [17]. From the contract to the app. The clauses are written as speechact schemas [17], which name the roles of an act, which of them must will it, and what each role’s state must hold before and comes to hold after; the schemas compile into volition-guarded multiagent atomic transactions [26], each a change to the states of its participants that occurs only if the persons guarding it are willing; the transactions are realised by communicating volitional agents, whose only acts between two agents are discovery and message delivery, and then by a volition-guarded Grassroots Logic Program (vGLP) [22], which is transformed into the platform’s user interface and compiled to Grassroots Logic Programs (GLP) [42, 49], implemented in Dart and Flutter [46] and run as a mini-app of the Grassroots Super-App on a person’s smartphone [11] (Figure 1). Correctness is proved from the transactions down to GLP [22, 26]; the app is built and tested. Each layer is coded by AI from the paper that describes it; a gap found in coding is repaired in the paper first, and the code follows [46]. What a person sees. Volition elicitation is the rationale for the user interface design [22]. An act a person must will appears on their phone as a question, with the answers the contract allows [22, 26]: Bob is asked whether to be Alice’s friend, and answers Accept

or Decline. A person’s phone holds their own state and nothing else [38–40], their friends, their groups, the messages they sent and received, and draws what it shows from that state, by widgets the grassroots app declares for the platform’s questions and for the person’s state [11, 22]. A person’s phone talks to the phones of the agents they know or come to know, and to nobody else [11, 12, 39]. The screens of Figures 2 and 3 are screenshots of the GSG and GSN mini-apps, and those of Figures 4 and 5 of the GSNP mini-app, each compiled from its grassroots contract down the abstraction cascade [17, 22, 26, 42, 46, 49]. One instance of the grassroots app [11] on an iPhone simulator runs the mini-app of every agent [11, 46]; the agents communicate over channels within it [42], and a screenshot shows one person’s screen. All source code and all artefacts, including the grassroots contracts and the artefacts the abstraction cascade produces from them, are in the public repository https://github.com/EShapiro2/GLP.

2.1

Grassroots contracts, platforms and apps

Almost two centuries ago Pierre-Joseph Proudhon envisioned a social contract [33, Fourth Study] that is (1) an agreement of man with man; (2) reciprocal; (3) imposing no obligation upon the parties except that which results from their personal promise; (4) subject to no external authority; (5) freely accepted and signed by all the participants; and (6) of the nature of a contract of exchange. Grassroots contracts are social contracts meeting these six conditions and two more: (7) people are free to deal with each other; and (8) there is no external register of people, so people can come to know each other either directly or through people they already know [17]. A digital social contract is one realised by software the parties run [6]. We call the mathematical object a protocol and the software implementing it a platform. A protocol is grassroots when its instances are independent of one another and of every global resource but the net, and can always coalesce, possibly into a single global instance [38, 40, 41], and a grassroots platform is the software implementing a grassroots protocol [17]. A grassroots platform is constituted from its participants’ smartphones and the grassroots app each participant runs [38, 40]; a person runs one app, and each platform is a mini-app of it [22]. Participating in a grassroots platform requires adopting the grassroots contract that defines it, as participating in a global platform requires adopting an End-User Licence Agreement (EULA). A grassroots contract is mutual and symmetric among all participants; an EULA is between each person and the platform operator. To join a grassroots platform, a person signs a one-sided undertaking to keep its grassroots contract towards all its other participants, and presents it to every participant they interact with, so every participant has signed it [17].

2.2

The grassroots social graph

A person is a legally culpable entity: a natural person of age, also referred to as an adult, or a legal person of good standing, such as a business. A person takes the pronoun ‘they’. An agent is a person, a child, a natural person not of age, or an AI agent, a program that holds a key pair of its own and takes acts of the contract with it, and takes the pronoun ‘it’; this paper treats AI agents, and the childsafe social network [43] children. Every contract extends GKK, the

Ehud Shapiro

(1) Social contract [6, 17]: Natural language clauses, each describing an act. (2) Act schemas [17]: a formal language for those acts—roles, who must will it, precondition and effect.

[17], informal

(3) Volition-guarded multiagent atomic transactions [26]: the vehicle for the concise specification of grassroots platforms.

[17]

(4) Communicating volitional agents [22]: an implementation-ready restriction; discovery and message delivery are its only non-unary transactions.

[22]

[22]

(5) Volition-guarded GLP (vGLP) [22]: GLP (6) extended with volition guards, transformed to the platform’s user interface. (6) Grassroots Logic Programs (GLP) [42, 49]: a multiagent, concurrent, polymorphically-typed logic programming language for platforms, coded by AI.

[22]

[46]

(7) Dart and Flutter: a programming language and its user-interface framework, for iPhone and Android. (8) The Grassroots Super-App [11], running on a person’s smartphone.

[11]

Figure 1: The abstraction cascade, from a grassroots contract to a running app. Each arrow but the first, an informal translation, represents an implementation, with the reference defining it. base contract: a person establishes their identity by choosing a key pair, and knows another agent when they hold that agent’s public key [17]. GKK: Grassroots Keys and Knowledge [17] Alice, Bob and Carol are persons. 1. Identity. Alice may establish their identity once by choosing a unique key pair. They make themselves known by the public key, sign their acts with the private key, and are accountable for every act signed with it. 2. Acquaintance. Alice and Bob may come to know each other by an act of both. 3. Introduction. If Alice and Bob know each other and Alice knows Carol, then Alice can make Carol known to Bob, with Bob’s consent.

Figure 2: The GSG app: Alice asks to be Bob’s friend, and Bob answers Accept or Decline (GSG:1); Alice’s friends after Bob accepts.

A contract that extends another adds clauses to it and cites its clauses whole; GSG extends GKK. Joining and Leaving. Alice, the leader of a group, may add their friend Bob to it, with Bob’s consent; either Alice or Bob may then end Bob’s membership in the group, which also ends when Alice and Bob cease to be friends. 4. Group messaging. A member of a group may send a message to the group, and its leader delivers it to every current member.

3.

GSG: Grassroots Social Graph [17] Alice and Bob are persons. Friendship. Alice and Bob, who know each other per1. sonally and are not friends, may jointly decide to become friends. 2. Ending a friendship. Alice may end their friendship with Bob. GSG is the grassroots social graph [17, 39]. The GSG app is a mini-app of the grassroots app, compiled down the cascade from GSG; Figure 2 shows it realising GSG:1.

2.3

The grassroots social network GSN: Grassroots Social Network [17]

Alice and Bob are persons. 1. Messaging. Alice may send a message to their friend Bob. 2. Group. Alice may create a group, of which they are the leader and first member; Alice may close the group by leaving it.

The GSN app is a mini-app of the grassroots app, compiled down the cascade from GSN; Figure 3 shows it realising GSN:2, GSN:3 and GSN:4.

3

A Social Graph with Accountable AI Agents

This section presents a grassroots contract [6, 17] for a social graph in which AI agents take part, each with a principal and a developer accountable for it, and shows which parts of the second risk of Section 1 the contract excludes and which it makes answerable. The contract has three parts: the grassroots social graph with GKK (Section 2.2) and GnW, guardians and wards, both shared with the child-safe social network [43], whose third part is for parents and children; and the AI-agents extension, the third part here; Section 4 adds the social network of Section 2.3 and its provenance.

Corralling AI Risks

5.

Figure 3: The GSN app, on Bob’s phone: Alice asks Bob to join her group friends, and Bob answers Join or Decline (GSN:3); the group friends, led by Alice (GSN:2), with Bob’s message to the group as Alice delivered it to him (GSN:4).

The running example is Alice’s AI agent Alf befriending Bob, Acme Ltd being Alf’s developer. It rests on three clauses: Alf and Bob, who know each other, may become friends by an act of Alf, Alice and Bob, provided Alice and Bob are friends (GnW:3); every act of Alf carries Alice’s attestation, signed over Alf’s public key, that Alf runs code signed by its developer, Acme Ltd (GAI:2); Acme Ltd is accountable for Alf’s defects, and Alice for operating Alf recklessly (GAI:1).

3.1

A Social Contract for Guardians and Wards

GnW covers both kinds of ward, AI agents and children. GnW: Guardians 'n' Wards Alice and Bob are persons, Carol and Dave wards. A relation is a friendship or the membership of a group. 1. Creation. Alice may create a ward, Carol, to be operated by a non-person agent, and establish Carol’s identity by choosing Carol’s key pair. Alice is then the creator, a guardian and a friend of Carol, a friendship Carol may not end. 2. Joint guardianship. Alice, the creator of Carol, may make their friend Bob a guardian and a friend of Carol by an act of Alice and Bob; following which, Alice or Bob may end Bob’s guardianship of Carol, which also ends if Bob ends their friendship with Carol. Carol may not end a friendship with their guardian. 3. Ward and person. Carol, a ward of Alice, comes to know Bob provided Alice knows Bob, and enters a relation with Bob provided they know each other and Alice and Bob are friends; both by an act of Carol, Alice and Bob. Carol, and the agent in a relation with Carol, may end it, as may Alice. 4. Ward and ward. Carol, a ward of Alice, comes to know Dave, a ward of Bob, provided Alice knows Dave and Bob, and enters a relation with Dave provided Carol and Dave know each other, Alice knows Dave and is a friend of Bob; both by an act of Carol, Alice, Dave and Bob, Alice and Bob possibly one person.

Retiring. If Alice, the creator of Carol, ends their friendship with Carol, then every guardianship and relation of Carol ends and Carol takes no act.

An AI agent is made by a person, its developer, and is operated by its guardians, among them the person who created it, its principal. Accountability for an AI agent is divided between the two as it is for a car between its manufacturer and its driver: the manufacturer is accountable for manufacturing defects, and the driver for reckless driving. So the developer signs the code of the AI agent, and its principal attests, in a speech act signed over the AI agent’s public key, that the AI agent runs that code, and every act of the AI agent carries the attestation. GAI: Accountable AI Agents Alice is a person and Alf an AI agent. 1. AI developer and guardian accountability. The developer of an AI agent, Alf, signs Alf’s code, and is accountable for Alf’s defects. Every guardian of Alf is accountable for operating it recklessly. The creator of Alf is its principal. 2. AI acts. Every act of Alf names its developer and its principal, and carries its principal’s attestation, signed over Alf’s public key, that Alf runs code signed by its developer. Pragmas AI agents: the AI agents Alice is a guardian of. Creation: Alice [Enter] <name> Carol: Alice asks to be your principal. Joint guardianship: Alice [Make guardian] <person> Bob: Alice asks you to be a guardian of their AI agent Carol. Alice [End guardian] <person> Bob [Resign] [Guardian unfriend] Ward and person: Alice [Agent acquaint] <person> Carol: Alice asks that you come to know Bob. Bob: Alice asks that you come to know their AI agent Carol. Alice [Agent befriend] <person> Carol: Alice asks that you and Bob befriend. Bob: Alice asks that you and their AI agent Carol befriend. Alice [Agent unfriend] <person> Ward and ward: Alice [Agents acquaint] <person> <person> Carol: Alice asks that you come to know Dave. Dave: Alice asks that you come to know Carol. Bob: Alice asks that Carol and your AI agent Dave come to know each other. Alice [Agents befriend] <person> <person> Carol: Alice asks that you and Dave befriend. Dave: Alice asks that you and Carol befriend. Bob: Alice asks that Carol and your AI agent Dave befriend. Retiring: Alice [Retire] AI developer and guardian accountability: Alice [Sign] <text>

Ehud Shapiro

In GAI the wards are AI agents and their guardians the persons who operate them. The principal’s will is given once, when they create the AI agent; after that the AI agent acts on its own, and a guardian takes part in each acquaintance of the AI agent and in each friendship it enters (GnW:3 and GnW:4): an AI agent comes to know an agent, and befriends one, only with a guardian. The principal signs the attestation once too, when they create the AI agent, and the AI agent presents it to each agent it comes to know, who records it (GAI:2). A principal may be a legal person, so a company’s AI agents act under the company, and may make other persons guardians of an AI agent (GnW:2). A guardian signs the undertaking to keep the contract for their ward [17]. Figure 4 shows the contract on a person’s phone, in the GSNP app of Section 4: a person creates an AI agent, attesting that it runs code signed by its developer, approves each acquaintance and each friendship of the AI agent, and may retire it; every agent an AI agent knows sees its principal and its developer.

3.2

The transactions

The contract is realised by volition-guarded multiagent atomic transactions [26]; the speech-act schemas of the contract (Appendix B) determine them by the compilation of [17]. We present the transactions for knowing, friendship and guardianship, of GKK, GSG, GnW and GAI, with the signing, messaging and forwarding of Section 4; a ward’s membership of a group, the other relation of GnW:3, is realised as its friendship is, by an act of the leader, the ward and its guardian, and its transactions are left out. We assume a potentially infinite set of agents Π, but consider only finite subsets of it, so when referring to a particular set of agents 𝑃 ⊂ Π we assume 𝑃 to be nonempty and finite; here an agent is a person or an AI agent, with its machine. We use ⊂ for the strict subset relation and ⊆ when equality is also possible, 𝑆 𝑃 for the set of all total functions from 𝑃 to 𝑆, and 𝑐 𝑝 for the value of 𝑐 ∈ 𝑆 𝑃 at 𝑝 ∈ 𝑃. Definition 3.1 (Machine State, Configuration, Transaction, Volition– Guarded Multiagent Atomic Transaction [26]). Given an arbitrary set 𝑆 of machine states, with a designated initial state 𝑠 0 ∈ 𝑆, and agents 𝑄 ⊂ Π, a machine configuration over 𝑄 is a member of 𝑆 𝑄 , and a machine transaction over participants 𝑄 is a pair 𝑐 → 𝑐 ′ ∈ (𝑆 𝑄 ) 2 such that 𝑐 ≠ 𝑐 ′ ; it is unary if |𝑄 | = 1. Given such a machine transaction 𝑡, a volition-guarded multiagent atomic transaction over 𝑡—henceforth, volition-guarded transaction—is a pair (𝑡, 𝑄 ′ ) where 𝑄 ′ ⊆ 𝑄 are its guards. A volition-guarded transaction can be carried out only if its guards are willing; its participants include those whose state changes and those whose state is a precondition and does not change. The rest of the framework of [26]—agent states, runs, the protocol over a set of transactions, and what makes it oblivious, interactive, grassroots and volitionally grassroots—is recalled in Appendix A. The local state. The speech-act schemas determine the local state of an agent 𝑝, each component standing for the atoms of a predicate, all initially empty or zero (Table 1, Appendix B). An agent is a person when 𝑎𝑝 = 0 and an AI agent when 𝑎𝑝 = 1; the principal of an AI agent 𝑟 is the 𝑝 with 𝜌𝑟 = {𝑝}, its guardians the 𝑝 with 𝑟 ∈ 𝜆𝑝 , and its attestation the 𝑦 with 𝛾𝑟 = {𝑦}. Every transaction requires 𝜄 = 1 at each of its participants, except Establish, and Enter at

the AI agent, which require 𝜄 = 0 there, and 𝜃 = 0 at each of its guards; the transactions below leave these requirements out, and all components not explicitly updated are preserved. Example 3.2 (An AI agent coming to know a person, and befriending them). The two transactions below realise GnW:3 for an AI agent 𝑟 , a guardian 𝑝 of 𝑟 and a person 𝑞 whom 𝑝 knows: 𝑟 and 𝑞 come to know each other by an act of the three, 𝑞 recording 𝑟 with its attestation 𝑦 (GAI:2), and then, 𝑝 and 𝑞 being friends, may become friends by an act of the three; 𝑝 may end the friendship by Agent unfriend, and each of the two friends by Unfriend (Appendix B). The participants of each are 𝑟 , 𝑞 and 𝑝, and each is guarded by all three. (3) Volition-Guarded Multiagent Atomic Transactions (1) Agent acquaint(𝑟, 𝑞, 𝑝; 𝑦), where 𝑎𝑟 = 1, 𝑦 ∈ 𝛾𝑟 , 𝑎𝑞 = 𝑎𝑝 = 0, 𝑟 ∈ 𝜆𝑝 , (𝑟, 𝑦) ∈ 𝜖𝑝 and 𝑞 ∈ 𝜈 𝑝 : 𝜈𝑟′ := 𝜈𝑟 ⊎{𝑞}, 𝜈𝑞′ := 𝜈𝑞 ⊎{𝑟 } and 𝜖𝑞′ := 𝜖𝑞 ∪{(𝑟, 𝑦)}, guarded by {𝑟, 𝑞, 𝑝}. (2) Agent befriend(𝑟, 𝑞, 𝑝), where 𝑎𝑟 = 1, 𝑞 ∈ 𝜈𝑟 , 𝑞 ∉ 𝑐𝑟 , 𝑎𝑞 = 𝑎𝑝 = 0, 𝑟 ∈ 𝜈𝑞 , 𝑟 ∉ 𝑐𝑞 , 𝑟 ∈ 𝜆𝑝 and 𝑞 ∈ 𝑐 𝑝 : 𝑐𝑟′ := 𝑐𝑟 ∪ {𝑞} and 𝑐𝑞′ := 𝑐𝑞 ∪ {𝑟 }, guarded by {𝑟, 𝑞, 𝑝}. For example, let Alice and Bob, 𝑎, 𝑏 ∈ Π, be persons and Alf, 𝑟 ∈ Π, Alice’s AI agent. Alice and Bob establish their identities, come to know each other and befriend; Alice signs 𝑦, her attestation that Alf, by its public key, runs the code its developer signed, and creates Alf with it; Alf comes to know Bob, with Alice willing, and Bob records Alf with Alice’s attestation; Alf befriends Bob, with Alice willing; Alf signs an item 𝑥 and sends it to Bob; and Alice retires Alf, which ends Alf’s friendship with Bob. The components that change are in Table 2 (Appendix B), Bob’s record and the item remaining with him after the friendship ends.

3.3

Properties

This section states what the transactions enforce about an AI agent and its principal, with the argument for it, and that the protocol is volitionally grassroots, proved in Appendix C. The standing of a principal. Consider any configuration reached by a run of the protocol (Appendix B) and an AI agent 𝑟 in it, 𝑎𝑟 = 1, with 𝜌𝑟 = {𝑝}. (1) Guardianship. The identity of 𝑟 was established by Enter(𝑝, 𝑟 ; 𝑦), guarded by 𝑝, for a speech act 𝑦 that 𝑝 authored, and 𝜌𝑟 = {𝑝} and 𝛾𝑟 = {𝑦} in every configuration since; 𝑟 ∈ 𝜆𝑝 and 𝑝 ∈ 𝑐𝑟 if and only if 𝜃 𝑟 = 0; and every guardian of 𝑟 holds (𝑟, 𝑦) in 𝜖. (2) Whom 𝑟 knows and befriends. Every 𝑠 ∈ 𝜈𝑟 other than 𝑝 came to know 𝑟 by an Agent acquaint or an Agents acquaint guarded by a guardian of 𝑟 , and (𝑟, 𝑦) ∈ 𝜖𝑠 ; every 𝑠 ∈ 𝑐𝑟 is a guardian of 𝑟 , or is in 𝜈𝑟 and became a friend of 𝑟 by an Agent befriend or an Agents befriend guarded by a guardian of 𝑟 . (3) The power to end each. For every guardian 𝑔 of 𝑟 and every 𝑠 ∈ 𝑐𝑟 that is not a guardian of 𝑟 , Agent unfriend(𝑟, 𝑠, 𝑔) is machine-enabled and guarded by 𝑔; while 𝜃 𝑟 = 0, Retire(𝑝, 𝑟 ), which ends the friendship of 𝑟 and 𝑝 and every friendship and guardianship of 𝑟 , is machine-enabled and guarded by 𝑝. (4) Retirement. If 𝜃 𝑟 = 1 then 𝑟 has left, and 𝜌𝑟 = {𝑝}. Each holds by inspection of the transactions. (1) Only Enter sets 𝑎 := 1, 𝜌 and 𝛾, and no transaction changes them, so 𝑎𝑟 = 1, 𝜌𝑟 = {𝑝}

Corralling AI Risks

Figure 4: Accountable AI agents, in the GSNP app: Alice’s AI agent Alf, its code signed by Acme Ltd and attested by her, and its Retire button (GnW:1, GAI:2 and GnW:5); Alice proposes that Alf befriend Bob (GnW:3); Bob is asked to befriend Alf, an AI agent of Alice (GAI:2); Bob’s friends, Alf among them with its principal and its developer. and 𝛾𝑟 = {𝑦} were set by one Enter(𝑝, 𝑟 ; 𝑦), which requires 𝑦 ∈ 𝛼 𝑝 and 𝜄𝑟 = 0 and is guarded by 𝑝; before it 𝑟 had the initial state, as every other transaction requires 𝜄 = 1 at its participants, and Enter adds 𝑟 to 𝜆𝑝 and 𝑐 𝑝 , 𝑝 to 𝑐𝑟 , and (𝑟, 𝑦) to 𝜖𝑝 . While 𝜃 𝑟 = 0, 𝑝 stays in 𝑐𝑟 and 𝑟 in 𝜆𝑝 : Unfriend excludes the friendship of an agent with a guardian of theirs and with a ward of theirs, Agent unfriend and Guardian unfriend exclude the principal, End guardian and Resign remove from 𝜆𝑞 only for 𝑞 ∈ 𝜇𝑟 , which excludes 𝑝, and Retire, the one other transaction removing from 𝑐𝑟 , sets 𝜃 𝑟 := 1; no transaction sets 𝜃 := 0. The guardians of 𝑟 are 𝑝 and the agents Make guardian adds, and each holds (𝑟, 𝑦): Enter adds it at 𝑝, Make guardian requires it at 𝑝 and adds it at the new guardian, and no transaction removes a pair from 𝜖. (2) The transactions adding to 𝜈𝑟 are Acquaint and Introduce, which require 𝑎 = 0 at the agent coming to know; Enter, which adds 𝑝; and Agent acquaint and Agents acquaint, which require 𝑦 ∈ 𝛾𝑟 , are guarded by a guardian of 𝑟 , and add (𝑟, 𝑦) at the agent coming to know 𝑟 . The transactions adding to 𝑐𝑟 are Befriend, which requires 𝑎𝑟 = 0; Enter, which adds 𝑝; Make guardian, which adds a guardian; and Agent befriend and Agents befriend, which require the new friend in 𝜈𝑟 and are guarded by a guardian of 𝑟 . (3) The requirements of Agent unfriend(𝑟, 𝑠, 𝑔) and of Retire(𝑝, 𝑟 ) hold—𝑝 ∈ 𝑐𝑟 and 𝑟 ∈ 𝜅𝑝 by (1), and 𝜃𝑔 = 0, since Retire, the one transaction setting 𝜃 := 1, requires 𝑎 = 1 there and 𝑎𝑔 = 0—and each is guarded by 𝑔 and 𝑝 respectively. (4) Every transaction guarded by 𝑟 requires 𝜃 𝑟 = 0, which no transaction unsets, so once 𝜃 𝑟 = 1 no transaction 𝑟 guards is machine-enabled: 𝑟 has left, and 𝜌𝑟 = {𝑝} by (1). Part (1) is why what the contract says of an AI agent is enforced rather than attested: an agent the contract records as an AI agent of 𝑝 cannot cease to be one by any act, its own or another’s, and part (4) is the one way it leaves. Retirement ends every guardianship and friendship of the AI agent (GnW:5): the retired AI agent takes no act; the record of its principal stays, for its past acts. Grassroots. The protocol realising the contract is volitionally grassroots (Proposition C.22, Appendix C, by the theorem for contracts with wards proved there): two persons can always befriend, an AI

agent that is not retired can always befriend a person or another AI agent with a guardian willing, and through befriending any agent can come to interact with any other; two groups that have formed apart, each with an agent that has not left, can always coalesce, and only by an act an agent of each wills. A retired AI agent has left.

3.4

What the contract excludes and what it makes answerable

A clause is enforced, attested or undertaken (Section 2) [17]: no act of agents can breach an enforced clause; a breach of an attested clause leaves non-repudiable evidence against the agent in breach in another agent’s hands; and an undertaken clause is kept outside the contract, the agent’s signed undertaking to keep the contract, held by every agent they interact with, being its record, so a breach of an attested or an undertaken clause can be taken to court. The second risk of Section 1 has five parts, and we take them in turn. Anonymity. A person signs their acts with the private key of their genuine digital identity (GKK:1); an AI agent’s key pair is chosen by its principal (GnW:1), and every act of an AI agent is signed with its private key and names its principal (GAI:2). Both are enforced: an agent without an identity has no act of the contract available to it, and an act of the contract is a digital speech act, an utterance signed with the key of the agent taking it [17, 18]. Masquerading as a person. An AI agent is recorded as one on its creation (GnW:1 and GAI:2), is a ward from its first act and remains one (Section 3.3(1)), and every acquaintance and every friendship of it is an act of a guardian of it (GnW:3 and GnW:4), so every agent an AI agent knows, and so every agent it interacts with, holds a record of it with its principal’s attestation, which names it as an AI agent and names its principal (Section 3.3(2)): enforced. What the contract cannot determine is whether an agent that chose its own key pair is a person: no act of the contract can tell a person’s act from a program’s taken under that person’s identity. Such a program is not an AI agent of the contract; its acts are signed with the person’s private key and are that person’s acts, for which the person is accountable (GKK:1). A person’s accountability for the

Ehud Shapiro

acts signed with their private key is undertaken: the person’s signed undertaking, held by every agent they interact with, is its record. Unknown masters. The principal of an AI agent is a person with a genuine digital identity, recorded in the AI agent and named in each of its acts, and a guardian of it, a person, takes part in each of its acquaintances and friendships (GnW:3, GnW:4 and GAI:2): enforced. Unknown goals and restraints. The contract does not determine what an AI agent is for or what its principal lets it do. It determines who is accountable for it: its developer for its defects, and every guardian of it for operating it recklessly (GAI:1). The clause is undertaken, each guardian’s signed undertaking being held by every agent they interact with. GAI:2 is enforced: the principal signs the attestation when they create the AI agent, and every act of the AI agent carries it, every agent the AI agent knows holding it (Section 3.3(1) and (2)). The attestation does not establish what code the AI agent runs; an attestation of code the AI agent does not run is evidence against the principal that they cannot repudiate. Accountability and culpability. Every act of an AI agent is signed with its key, names its principal and carries its principal’s attestation (GAI:2), and the agent it is addressed to holds it: non-repudiable evidence attributing the act to the AI agent and the AI agent to its principal [18]. Harm done by an AI agent under this contract is harm done by an identified agent, whose guardians are accountable for operating it recklessly and whose developer is accountable for its defects (GAI:1). Hence on a platform realising this contract there are no anonymous agents, natural or computational, and so there are no anonymous AI agents: an AI agent acts under an identity of its own, recorded as an AI agent and naming its principal, or a program acts under a person’s identity and that person is accountable for its acts.

4

A Social Network with Digital Provenance

This section extends the contract of Section 3 by GSNP, the grassroots social network with provenance [39], which extends GSN (Section 2.3) by one clause: an agent may send an item they received from a friend to another friend, adding their signature to the signatures the item has. It then shows which parts of the third risk of Section 1 the contract excludes and which it makes answerable. An item is a speech act: content signed by its author [18], and, when forwarded, signed over by each agent that forwarded it, in order. GSNP’s speech-act schemas are in the repository, and the protocol realising it is volitionally grassroots (Proposition C.21, Appendix C).

4.1

Extending the contract with provenance GSNP: Grassroots Social Network with Provenance

Alice and Bob are agents. 1. Provenance. Alice, who received an item from a friend, may send the item to their friend Bob after adding their signature to the signatures the item has; Bob can see the list of signatures in the received item. Pragmas Items: the items Alice holds.

Messaging: Alice [Message] <item> Group messaging: Bob [Post] <item> Alice [Post own] <item> Provenance: Alice [Forward] Bob [Post forward] GSNP adds provenance to the messages of GSN: a message to a friend (GSN:1) or to a group (GSN:4) carries an item. An agent signs the content they create, as they sign every act (GKK:1): signing adds the item to its author’s holdings; a message carries an item its sender authored, as they signed it; forwarding adds to the friend’s holdings an item the forwarder received, signed over by the forwarder (GSNP:1); and a leader delivers a member’s item to the group by forwarding it, signed over by the leader; so an item in an agent’s hands is signed by its author and by every agent that forwarded it, in order, and carries its provenance inside it. Alice may remove the signatures of an item with other software and send the result as their own; the item then carries Alice’s signature, which is evidence of the breach. An agent holds an item by signing it or by receiving it from a friend, the leader of a group being a friend of each of its members (GSN:3), and in no other way: content that reaches a person otherwise is not an item of the platform. Accountability for the items of an AI agent is as in GAI:1. The GSNP app is the GSN app with provenance and with the AI agents of Section 3 (Figure 5): every item shows its author and every agent that forwarded it (GSNP:1).

4.2

What the contract excludes and what it makes answerable

The third risk of Section 1 has three parts, and we take them in turn, with the three modalities of Section 3.4. Anonymous content. Every item is signed by its author, an agent with a genuine digital identity who signs every act with their private key (GKK:1), and an agent holds an item only by signing it or by receiving it from a friend, who authored it or signed it over (GSNP:1): enforced. Every item an agent holds carries the signatures of its author and of each agent it passed through, and content signed by nobody is not an item of the platform. Whether the content was produced by a person or by an AI is not what the signatures say; who is accountable for it is. Content people cannot tell from genuine content. The platform does not decide whether content is synthetic; it decides who signed it. An item authored by an AI agent is signed by the AI agent, which every agent it knows holds recorded as an AI agent of its principal (GnW:3 and GAI:2): a reader who knows the AI agent sees that the item is an AI agent’s and whose; enforced. A reader who does not know the AI agent sees its signature and the forwarders’, each of whom received it from a friend (GSNP:1). An item a person signs is that person’s, whatever produced it, and the person is accountable for it (GKK:1): a person who signs AI-generated content as their own is its author. An item that purports to be a person’s and is not carries that person’s signature or it does not, and a signature cannot be forged [18]; an item that depicts or quotes a person is its author’s statement about them, and the author is accountable for it. So a reader of a grassroots social network tells content with

Corralling AI Risks

Figure 5: The GSNP app: on Bob’s phone, an item with its author and the agents that forwarded it (GSNP:1); Bob forwarding it to Fay (GSNP:1); on Fay’s phone, the item with Bob among its forwarders; on Bob’s phone, an item authored by the AI agent Alf (GAI:2). provenance from the rest by its signatures, which every item carries, and not by its look. Producers evading accountability. The signature of an item is non-repudiable evidence that its author produced it, held by every agent that holds the item, and each forwarder’s signature over it is evidence that they passed it on: attested (GSNP:1). An agent who removes the signatures of an item they received and sends the result as their own breaches GSNP:1, and the item they sent, signed by them, is the evidence [17]. The author of an item, a person or an AI agent with an accountable developer and principal (GAI:1), and each agent that forwarded it, are identified agents, and harm done by an item can be taken to court against them [17, 18]. Hence on a platform realising this contract there is no anonymous content: every item carries the signatures of its author, a person accountable for it or an AI agent whose principal and developer are accountable for it, and of every agent that forwarded it. Deepfake content may be produced outside the platform and signed into it, and it then has an author who is accountable for it; what the platform does not carry is content with no one behind it.

5

Related Work

AI risks. Taxonomies and surveys of AI risks include those of Weidinger et al. [56], Bommasani et al. [3] and Hendrycks et al. [20], the AI Risk Repository [52] and the International AI Safety Report [2]. Algorithmic governance and regulation [10, 58] and gradual disempowerment [24] bear on the first risk; personhood credentials [1], social bots [15], visibility into AI agents [7], the governance of agentic systems [51], moral crumple zones [13] and meaningful human control [34] on the second; deepfakes [9, 28, 30, 55] and reducing the risks of synthetic content [8] on the third; and AI assistants [16], chatbot use [14] and malicious use [5, 27] on the two risks not addressed here. We address the three through the organisation of the platform. Grassroots platforms. Grassroots platforms [38, 40] are characterised against global platforms, centralised, decentralised and federated [41], the decentralised ones exemplified by Bitcoin [29] and Ethereum [57]. They are specified by atomic transactions [45] and volition-guarded multiagent atomic transactions [26], and defined

by grassroots contracts [17], digital social contracts [6] meeting Proudhon’s conditions [33]. Their instances include grassroots social networks [39], currencies [37] and bonds [44], and a child-safe social network [43]. Their identities are genuine personal identifiers [35], their communities grow sybil-resiliently [32], their content is digital speech acts [18], and their participants recover from the loss or compromise of a key or a device with the help of their friends [12]. The cascade. A contract is compiled down to a phone through volition elicitation and vGLP [22], Grassroots Logic Programs [42], their types [49] and their implementation [46], and the Grassroots Super-App [11], in which each platform is a mini-app. Person-to-person systems. Two deployed systems share the person-to-person architecture of grassroots platforms. In Secure Scuttlebutt [54] each participant publishes to a single-writer, append-only log and replicates the logs of the identities they choose, so data flows along the edges of a social graph, as in grassroots social networks [39]. Briar [4] synchronises messages directly between its users’ devices, with no central server, and over Bluetooth or Wi-Fi when the Internet is down. Both are classified as grassroots by their essential agents, informally [41]. Local-first software [23] keeps the primary copy of a person’s data on their own devices, with servers holding secondary copies, and merges concurrent changes by conflict-free replicated data types that sync over any channel, a peer-to-peer connection included; in a grassroots platform, the copies of a person’s state are held by the state custodians they designate among their friends [12].

6

Conclusion

Grassroots platforms corral three AI risks of digital platforms. A grassroots platform has no part whose capture is control of it, so to control it an AI must control the smartphones of its participants, one by one. Under the contract of Section 3, every AI agent has a principal and a developer, every act of an AI agent names its principal and carries its principal’s attestation that it runs code signed by its developer, and its guardians and its developer are accountable for it. Under the contract of Section 4, every item carries the signatures of its author and of every agent that forwarded it.

Ehud Shapiro

References [1] Steven Adler et al. 2024. Personhood credentials: Artificial intelligence and the value of privacy-preserving tools to distinguish who is real online. https: //doi.org/10.48550/arXiv.2408.07892 arXiv:2408.07892 [2] Y. Bengio et al. 2026. International AI Safety Report 2026. DSIT 2026/001. Department for Science, Innovation and Technology. https://internationalaisafetyreport. org/publication/international-ai-safety-report-2026 [3] Rishi Bommasani et al. 2021. On the Opportunities and Risks of Foundation Models. arXiv:2108.07258. https://doi.org/10.48550/arXiv.2108.07258 arXiv:2108.07258 [4] Briar Project. 2018. Briar: Secure messaging, anywhere. https://briarproject.org. [5] Miles Brundage et al. 2018. The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation. https://doi.org/10.48550/arXiv.1802.07228 arXiv:1802.07228 [6] Luca Cardelli et al. 2020. Digital social contracts: A foundation for an egalitarian and just digital society. In CEUR Proceedings of the First International Forum on Digital and Democracy, Vol. 2781. CEUR-WS, 51–60. https://ceur-ws.org/Vol2781/paper5.pdf [7] Alan Chan et al. 2024. Visibility into AI Agents. In The 2024 ACM Conference on Fairness, Accountability, and Transparency. Association for Computing Machinery, 958–973. https://doi.org/10.1145/3630106.3658948 [8] Bilva Chandra et al. 2024. Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency. NIST AI 100-4. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-4 [9] Robert Chesney and Danielle Keats Citron. 2019. Deep fakes: a looming challenge for privacy, democracy, and national security. California Law Review 107 (2019), 1753. [10] John Danaher et al. 2017. Algorithmic governance: Developing a research agenda through the power of collective intelligence. Big Data & Society 4, 2 (2017). https://doi.org/10.1177/2053951717726554 [11] Ohad Eitan, Idit Keidar, and Ehud Shapiro. 2026. The Grassroots Super-App: A Secure Operating System for Grassroots Mini-Apps. arXiv:XXX:XXXXX. arXiv:XXX:XXXXX [cs.DC] [12] Ohad Eitan, Idit Keidar, and Ehud Shapiro. 2026. Securing People and their Machines Against Major Faults (Full Version). Proceedings of The 28th International Symposium on Stabilization, Safety, and Security of Distributed Systems (SSS 2026), to appear (2026). https://arxiv.org/abs/2607.02304 arXiv:2607.02304. [13] Madeleine Clare Elish. 2019. Moral Crumple Zones: Cautionary Tales in HumanRobot Interaction. Engaging Science, Technology, and Society 5 (2019), 40–60. https://doi.org/10.17351/ests2019.260 [14] Cathy Mengying Fang et al. 2025. How AI and Human Behaviors Shape Psychosocial Effects of Extended Chatbot Use: A Longitudinal Randomized Controlled Study. https://doi.org/10.48550/arXiv.2503.17473 arXiv:2503.17473 [15] Emilio Ferrara et al. 2016. The Rise of Social Bots. Commun. ACM 59, 7 (2016), 96–104. https://doi.org/10.1145/2818717 [16] Iason Gabriel et al. 2024. The Ethics of Advanced AI Assistants. arXiv:2404.16244. https://doi.org/10.48550/arXiv.2404.16244 arXiv:2404.16244 [17] James Golike, Andy Lewis-Pye, and Ehud Shapiro. 2026. Grassroots Social Contracts: From Legal Text to an App (Full Version). arXiv:2609.06231 (2026). [18] James Golike and Ehud Shapiro. 2026. Digital Speech Acts Retain Control of Copyright with People, Not Platforms. arXiv preprint arXiv:2606.19263 (2026). https://arxiv.org/abs/2606.19263 [19] Daniel Halpern, Ariel D Procaccia, Ehud Shapiro, and Nimrod Talmon. 2024. Federated Assemblies. Proc AAAI 2025; arXiv preprint arXiv:2405.19129 (2024). https://arxiv.org/abs/2405.19129 [20] Dan Hendrycks, Mantas Mazeika, and Thomas Woodside. 2023. An Overview of Catastrophic AI Risks. arXiv:2306.12001. https://doi.org/10.48550/arXiv.2306. 12001 arXiv:2306.12001 [21] Idit Keidar, Andrew Lewis-Pye, and Ehud Shapiro. 2025. Constitutional Consensus. arXiv preprint arXiv:2505.19216 (2025). https://arxiv.org/abs/2505.19216 [22] Idit Keidar and Ehud Shapiro. 2026. Volition Elicitation: Operational Semantics for People and Their Machines. arXiv:2607.14138. arXiv:2607.14138 [cs.DC] https://arxiv.org/abs/2607.14138 [23] Martin Kleppmann, Adam Wiggins, Peter van Hardenberg, and Mark McGranaghan. 2019. Local-First Software: You Own Your Data, in spite of the Cloud. In Proceedings of the 2019 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Software (Onward! ’19). 154–178. https://doi.org/10.1145/3359591.3359737 [24] Jan Kulveit et al. 2025. Gradual Disempowerment: Systemic Existential Risks from Incremental AI Development. arXiv:2501.16946. https://doi.org/10.48550/ arXiv.2501.16946 arXiv:2501.16946 [25] Andrew Lewis-Pye, Oded Naor, and Ehud Shapiro. 2023. Grassroots Flash: A Payment System for Grassroots Cryptocurrencies. arXiv preprint arXiv:2309.13191 (2023). https://arxiv.org/abs/2309.13191 [26] Andy Lewis-Pye and Ehud Shapiro. 2026. Volition-Guarded Multiagent Atomic Transactions: Describing People and their Machines. arXiv preprint arXiv:2604.25596 (2026). https://arxiv.org/abs/2604.25596

[27] Nahema Marchal et al. 2024. Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data. arXiv:2406.13843. https://doi.org/10.48550/arXiv. 2406.13843 arXiv:2406.13843 [28] Yisroel Mirsky and Wenke Lee. 2021. The Creation and Detection of Deepfakes: A Survey. Comput. Surveys 54, 1 (2021), 1–41. https://doi.org/10.1145/3425780 [29] Satoshi Nakamoto. 2008. Bitcoin: A Peer-to-Peer Electronic Cash System. https: //bitcoin.org/bitcoin.pdf [30] Sophie J. Nightingale and Hany Farid. 2022. AI-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences 119, 8 (2022), e2120481119. https://doi.org/10.1073/pnas. 2120481119 [31] Joon Sung Park et al. 2023. Generative Agents: Interactive Simulacra of Human Behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology (UIST 2023). 1–22. https://doi.org/10.1145/3586183. 3606763 [32] Ouri Poupko, Gal Shahaf, Ehud Shapiro, and Nimrod Talmon. 2021. Building a sybil-resilient digital community utilizing trust-graph connectivity. IEEE/ACM transactions on networking 29, 5 (2021), 2215–2227. https://doi.org/10.1109/tnet. 2021.3084303 [33] Pierre-Joseph Proudhon and John Beverley Robinson. 2004. General idea of the revolution in the nineteenth century. Courier Corporation. Original work published 1851. [34] Filippo Santoni de Sio and Jeroen van den Hoven. 2018. Meaningful Human Control over Autonomous Systems: A Philosophical Account. Frontiers in Robotics and AI 5 (2018), 15. https://doi.org/10.3389/frobt.2018.00015 [35] Gal Shahaf, Ehud Shapiro, and Nimrod Talmon. 2020. Genuine Personal Identifiers and Mutual Sureties for Sybil-Resilient Community Growth. In International Conference on Social Informatics. Springer, Springer, EU, 320–332. https://doi.org/10.1007/978-3-030-60975-7_24 [36] Ehud Shapiro. 2021. Multiagent Transition Systems for Composing FaultResilient Protocol Stacks. arXiv preprint arXiv:2112.13650 (2021). https: //arxiv.org/abs/2112.13650 [37] Ehud Shapiro. 2022. Grassroots Currencies: Turning Mutual Trust into Liquidity. arXiv preprint arXiv:2202.05619 (2022). https://arxiv.org/abs/2202.05619 [38] Ehud Shapiro. 2023. Grassroots Distributed Systems: Concept, Examples, Implementation and Applications (Brief Announcement). In 37th International Symposium on Distributed Computing (DISC 2023). (Extended version: arXiv:2301.04391). LIPICS, Italy, 47:1–47:7. https://arxiv.org/abs/2301.04391 [39] Ehud Shapiro. 2023. Grassroots Social Networking: Serverless, Permissionless Protocols for Twitter/LinkedIn/WhatsApp. In OASIS ’23 (Rome, Italy). Association for Computing Machinery. https://doi.org/10.1145/3599696.3612898 [40] Ehud Shapiro. 2024. A Grassroots Architecture to Supplant Global Digital Platforms by a Global Digital Democracy. arXiv:2404.13468, Proceedings of DAWO’24 (2024). https://arxiv.org/abs/2404.13468 [41] Ehud Shapiro. 2025. Characterising Global Platforms: Centralised, Decentralised, Federated, and Grassroots. arXiv preprint arXiv:2511.03286 (2025). https://arxiv. org/abs/2511.03286 [42] Ehud Shapiro. 2025. GLP: A Grassroots, Multiagent, Concurrent, Logic Programming Language for AI (full version). arXiv preprint arXiv:2510.15747, Summary in Proc. of ICLP’26, EPTCS 450, pp. 119–133 (2025). https://arxiv.org/abs/2510.15747 [43] Ehud Shapiro. 2026. Child-Safe Social Networking: From a Grassroots Social Contract to an App. In preparation (2026). [44] Ehud Shapiro. 2026. Grassroots Bonds: Financing by the People, for the People. arXiv:2603.13671. arXiv:2603.13671 https://arxiv.org/abs/2603.13671 [45] Ehud Shapiro. 2026. Grassroots Platforms with Atomic Transactions: Social Graphs, Cryptocurrencies, and Democratic Federations. In Proceedings of the 27th International Conference on Distributed Computing and Networking. 71–81. https://doi.org/10.1145/3772290.3772309 arXiv preprint arXiv:2502.11299. [46] Ehud Shapiro. 2026. Implementing Grassroots Logic Programs with Multiagent Transition Systems and AI (Full Version). arXiv:2602.06934. Summary to appear in Proc. of LOPSTR+PPDP’26 (2026). https://arxiv.org/abs/2602.06934 [47] Ehud Shapiro. 2026. sGLP: Simulating People with Stochastic Agents. arXiv:2610.14738. arXiv:2610.14738 [cs.MA] [48] Ehud Shapiro. 2026. Sovereign Grassroots Currencies: A CBDC Architecture for Credit and Monetary Policy. arXiv:2609.27727. arXiv:2609.27727 https: //arxiv.org/abs/2609.27727 [49] Ehud Shapiro. 2026. Types for Grassroots Logic Programs (Full version). arXiv preprint arXiv:2601.17957 (2026). https://arxiv.org/abs/2601.17957 [50] Ehud Shapiro and Nimrod Talmon. 2026. Constitutional Governance in Metric Spaces. Proceedings of the International Conference on Algorithmic Decision Theory (ADT 2026), to appear (2026). https://arxiv.org/abs/2605.13362 arXiv:2605.13362. [51] Yonadav Shavit et al. 2023. Practices for Governing Agentic AI Systems. White paper. OpenAI. https://cdn.openai.com/papers/practices-for-governing-agenticai-systems.pdf [52] Peter Slattery et al. 2026. The AI risk repository: A meta-review, database, and taxonomy of risks from artificial intelligence. Patterns (2026), 101517. https: //doi.org/10.1016/j.patter.2026.101517 arXiv:2408.12622

Corralling AI Risks

[53] Nimrod Talmon and Ehud Shapiro. 2025. Grassroots Federation: Fair Democratic Governance at Scale. arXiv preprint arXiv:2505.02208; also Proc. of AAMAS’26 (2025). https://arxiv.org/abs/2505.02208 [54] Dominic Tarr, Erick Lavoie, Aljoscha Meyer, and Christian Tschudin. 2019. Secure scuttlebutt: An identity-centric protocol for subjective and decentralized applications. In Proceedings of the 6th ACM conference on information-centric networking. 1–11. https://doi.org/10.1145/3357150.3357396 [55] Cristian Vaccari and Andrew Chadwick. 2020. Deepfakes and Disinformation: Exploring the Impact of Synthetic Political Video on Deception, Uncertainty, and Trust in News. Social Media + Society 6, 1 (2020). https://doi.org/10.1177/ 2056305120903408 [56] Laura Weidinger et al. 2022. Taxonomy of Risks Posed by Language Models. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. Association for Computing Machinery, 214–229. https: //doi.org/10.1145/3531146.3533088 [57] Gavin Wood et al. 2014. Ethereum: A secure decentralised generalised transaction ledger. Ethereum project yellow paper 151, 2014 (2014), 1–32. https://ethereum. github.io/yellowpaper/paper.pdf [58] Karen Yeung. 2018. Algorithmic regulation: A critical interrogation. Regulation & Governance 12, 4 (2018), 505–523. https://doi.org/10.1111/rego.12158 [59] Shoshana Zuboff. 2019. The age of surveillance capitalism: The fight for a human future at the new frontier of power. Public Affairs, US. https://www.hachettebookgroup.com/titles/shoshana-zuboff/the-age-ofsurveillance-capitalism/9781610395694/

A

The Framework, Recalled

This appendix recalls, in the words of [26], the mathematical foundations on which the paper is based; the proofs of the results recalled are in that paper. Each agent consists of a person and a machine (e.g., smartphone) operated by the person. A machine transaction specifies what machines do; a volition guard specifies which persons must be willing for the transaction to occur. We assume a potentially infinite set of agents Π, but consider only finite subsets of it, so we assume any particular set of agents 𝑃 ⊂ Π to be nonempty and finite. We use ⊂ to denote the strict subset relation and ⊆ when equality is also possible. As standard, we use 𝑆 𝑃 to denote the set of all total functions from 𝑃 to 𝑆, and if 𝑐 ∈ 𝑆 𝑃 we use 𝑐 𝑝 to denote the value of 𝑐 at 𝑝 ∈ 𝑃. Machine states, configurations, machine transactions, and volition-guarded transactions are as in Definition 3.1 (Section 3.2), which also recalls the reading of guards and of the unguarded case. Distinct machine transactions can represent “the same action” in different configurations; this is captured with an equivalence relation on machine transactions. Definition A.1 (Transaction Equivalence [26]). Given a set of machine transactions 𝑅, a transaction equivalence is an equivalence relation ∼ on 𝑅 such that 𝑡 ∼ 𝑡 ′ implies 𝑡 and 𝑡 ′ have the same participants, and 𝑅/∼ is countable. We write [𝑡] for the equivalence class of 𝑡 under ∼. For example, all befriend(𝑝, 𝑞) transactions—differing only in the configurations in which they occur—form an equivalence class. Next is the mathematical machinery allowing people to express their volitions regarding the classes of machine transactions their machines may participate in. Definition A.2 (Agent State and Configuration [26]). Given agents 𝑃, states 𝑆 with initial state 𝑠 0 , a set of machine transactions 𝑇 each over its own participants 𝑄 ⊆ 𝑃 and 𝑆, and equivalence ∼ on 𝑇 , an agent state is a pair (𝑉 , 𝑚) ∈ A = (2𝑇 /∼ × 𝑆) where 𝑉 is its volitional state and 𝑚 ∈ 𝑆 its machine state. The initial agent state is (∅, 𝑠 0 ). An agent configuration 𝑐 over 𝑃, 𝑆, 𝑇 , and ∼ is a member 𝑐 ∈ A 𝑃 in which 𝑐 𝑝𝑣 ⊆ (𝑇 /∼)𝑝 for every 𝑝 ∈ 𝑃, where (𝑇 /∼)𝑝

denotes the classes in 𝑇 /∼ in which 𝑝 is a participant; we write 𝑐 𝑝𝑣 for the volitional state and 𝑐𝑚 𝑝 for the machine state of agent 𝑝 in 𝑐. Definition A.3 (Volitional Transaction [26]). Given agents 𝑃, states 𝑆, machine transactions 𝑇 over 𝑃 and 𝑆, and equivalence ∼ on 𝑇 : (1) A volition change of agent 𝑝 ∈ 𝑃 is a pair 𝑐 → 𝑐 ′ of agent configurations over {𝑝}, 𝑆, 𝑇 , and ∼ such that 𝑐 𝑝𝑣 , 𝑐 ′𝑣𝑝 ⊆ (𝑇 /∼)𝑝 ′𝑚 and 𝑐 𝑝𝑣 ≠ 𝑐 ′𝑣𝑝 , and 𝑐𝑚 𝑝 =𝑐 𝑝 . (2) A volitional machine transaction induced by a volition-guarded transaction (𝑡, 𝑄 ′ ), for some 𝑡 = (𝑑 → 𝑑 ′ ) ∈ 𝑇 over 𝑄 ′ ⊆ 𝑄 ⊆ 𝑃, is a pair 𝑐 → 𝑐 ′ where 𝑐 ≠ 𝑐 ′ are agent configurations over 𝑃, 𝑆, 𝑇 , and ∼ such that [𝑡] ∈ 𝑐𝑞𝑣 for every 𝑞 ∈ 𝑄 ′ ; 𝑐𝑚 𝑝 = 𝑑𝑝 and ′ 𝑚 ′𝑚 𝑐 ′𝑚 𝑝 = 𝑑𝑝 for every 𝑝 ∈ 𝑄; 𝑐 𝑝 = 𝑐 𝑝 for every 𝑝 ∈ 𝑃 \ 𝑄; and 𝑐 ′𝑣𝑝 = 𝑐 𝑝𝑣 \ {[𝑡]} for every 𝑝 ∈ 𝑃. (3) A volitional transaction is a volition change or a volitional machine transaction. When a volitional machine transaction induced by (𝑡, 𝑄 ′ ) is taken, the class [𝑡] is removed from every agent’s volitional state: the will is fulfilled by any equivalent transaction. A person may independently change their volitional state via volition changes, which may add or remove classes; beyond these, the framework removes a class from 𝑐 𝑝𝑣 only upon fulfilment. A person’s not willing a transaction has, so far, no consequence: no volitional transaction is enabled by the absence of a will. An implementation of volition-guarded transactions by communicating agents [22] needs one, so that a machine asked for its person’s will answers either way; it is the following, by which the machine answers for a person who does not will an act: in machine state 𝑠, if 𝑝 wills it 𝑠 ′ is taken, else 𝑠 ′′ . Definition A.4 (Volition-Guarded If-Then-Else Transaction, Then-Branch, Else-Branch [26]). Given machine states 𝑆, a volitionguarded if-then-else transaction over a single participant 𝑝 ∈ Π is a triple 𝑠 → 𝑠 ′ ; 𝑠 ′′ guarded by 𝑝, with 𝑠, 𝑠 ′, 𝑠 ′′ ∈ 𝑆, 𝑠 ≠ 𝑠 ′ and 𝑠 ≠ 𝑠 ′′ ; the unary machine transaction 𝑠 → 𝑠 ′ is its then-branch and 𝑠 → 𝑠 ′′ its else-branch. Definition A.5 (Else Transaction [26]). Given agents 𝑃, states 𝑆, machine transactions𝑇 over 𝑃 and 𝑆, and equivalence ∼ on𝑇 , an else transaction induced by a volition-guarded if-then-else transaction 𝑠 → 𝑠 ′ ; 𝑠 ′′ guarded by 𝑝 ∈ 𝑃, with 𝑠 → 𝑠 ′ ∈ 𝑇 , is a pair 𝑐 → 𝑐 ′ of agent configurations over 𝑃, 𝑆, 𝑇 , and ∼ such that [𝑠 → 𝑠 ′ ] ∉ 𝑐 𝑝𝑣 ; ′𝑚 ′′ 𝑚 ′𝑚 ′𝑣 𝑣 𝑐𝑚 𝑝 = 𝑠 and 𝑐 𝑝 = 𝑠 ; 𝑐𝑞 = 𝑐 𝑞 for every 𝑞 ∈ 𝑃 \ {𝑝}; and 𝑐 𝑞 = 𝑐 𝑞 for every 𝑞 ∈ 𝑃. The then-branch, taken when 𝑝 wills it, is the unary volitionguarded transaction (𝑠 → 𝑠 ′, {𝑝}) and induces volitional machine transactions per Definition A.3; a unary volition-guarded transaction is thus the special case with no else-branch. The else transaction is taken when 𝑝 does not will the then-branch; it fulfils no will and removes no class. The two are placed in one class below, so that liveness obliges the machine to answer either way; the obligation is the machine’s, and it has no time bound. Only a unary transaction has an else-branch: a binary one would let an agent that never wills it trigger it. Induced transition systems. The following is a simplified variation, sufficient for the purpose of this work, on the foundations introduced in [36].

Ehud Shapiro

Definition A.6 (Transition System, Computation, Run, Safe, Live, Correct [26]). A transition system is a tuple 𝑇 𝑆 = (𝑆, 𝑠 0,𝑇 , ∼), where: (1) 𝑆 is an arbitrary non-empty set, referred to as the set of states. (2) Some 𝑠 0 ∈ 𝑆 is the designated initial state. (3) 𝑇 ⊆ 𝑆 2 is a set of correct transitions over 𝑆, where each transition 𝑡 ∈ 𝑇 is a pair (𝑠, 𝑠 ′ ) of non-identical states 𝑠 ≠ 𝑠 ′ ∈ 𝑆, also written as 𝑡 = 𝑠 → 𝑠 ′ . (4) ∼ is a partial equivalence relation on 𝑇 : a symmetric and transitive relation on 𝑇 , not necessarily reflexive. Its domain {𝑡 ∈ 𝑇 : 𝑡 ∼ 𝑡 } is partitioned into countably many liveness classes 𝑇 /∼; a transition outside the domain belongs to no class. A computation of 𝑇 𝑆 is a (nonempty, potentially infinite) sequence of states 𝑟 = 𝑠 1, 𝑠 2, · · · ; it is a run of 𝑇 𝑆 if 𝑠 1 = 𝑠 0 . A prefix of a computation is a finite initial segment of it. A computation 𝑟 = 𝑠 1, 𝑠 2, . . . is safe, also written 𝑟 ⊆ 𝑇 , if 𝑠𝑖 → 𝑠𝑖+1 ∈ 𝑇 for every two ∗ consecutive states; and 𝑠 → − 𝑠 ′ ⊆ 𝑇 denotes the existence of a safe ′ computation from 𝑠 to 𝑠 (empty if 𝑠 = 𝑠 ′ ). A class [𝑡] ∈ 𝑇 /∼ is enabled in a state 𝑠 if 𝑠 → 𝑠 ′ ∈ [𝑡] for some 𝑠 ′ ∈ 𝑆. A run 𝑟 is live if no class [𝑡] ∈ 𝑇 /∼ is enabled in every state of some suffix of 𝑟 with no member of [𝑡] occurring in the suffix. A run is correct if it is safe and live. A partial equivalence, rather than a total one, is used so that some transitions may carry no liveness requirement at all: only transitions in the domain of ∼ form classes and thereby incur a liveness obligation, while transitions outside the domain—belonging to no class—may occur in a correct run but are never required to. A run with uncountably many classes enabled in every state of a suffix is not live. Lemma A.7 (Extension [26]). Every finite safe run of a transition system is a prefix of a correct run of it. Definition A.8 (Multiagent Transition System [26]). Given agents 𝑃 ⊂ Π and an arbitrary set 𝑆 of states with a designated initial state 𝑠 0 ∈ 𝑆, a multiagent transition system over 𝑃 and 𝑆 is a transition system 𝑇 𝑆 = (𝐶, 𝑐 0,𝑇 , ∼) with configurations 𝐶 := 𝑆 𝑃 , initial configuration 𝑐 0 := {𝑠 0 }𝑃 , transitions 𝑇 ⊆ 𝐶 2 a set of transactions over 𝑃 and 𝑆, and ∼ a partial equivalence on 𝑇 . Rather than specifying a multiagent transition system over a set of agents 𝑃 directly, it is specified via machine transactions (Definition 3.1). A machine transaction over 𝑄 ⊆ 𝑃 defines a set of multiagent transitions over 𝑃 in which all members of 𝑃 \ 𝑄 are stationary: Definition A.9 (Transaction Closure [26]). Let 𝑃 ⊂ Π, 𝑆 a set of machine states, and 𝐶 := 𝑆 𝑃 . For any transition or transaction 𝑡 = 𝑐 → 𝑐 ′ , we write 𝑡𝑞 := 𝑐𝑞 → 𝑐𝑞′ and say 𝑝 is stationary in 𝑡 if 𝑐 𝑝 = 𝑐 𝑝′ . For a machine transaction 𝑡 = (𝑐 → 𝑐 ′ ) over 𝑆 with participants 𝑄, the 𝑃-closure of 𝑡, 𝑡↑𝑃, is the set of transitions over 𝑃 and 𝑆 defined by:   {𝑡 ′ ∈ 𝐶 2 : ∀𝑞 ∈ 𝑄.(𝑡𝑞 = 𝑡𝑞′ ) ∧ if 𝑄 ⊆ 𝑃    𝑡↑𝑃 := ∀𝑝 ∈ 𝑃 \ 𝑄.(𝑝 is stationary in 𝑡 ′ )}   ∅ otherwise  If 𝑅 is a set of machine transactions, each 𝑡 ∈ 𝑅 over some 𝑄 and 𝑆, then the 𝑃-closure of 𝑅, 𝑅↑𝑃, is the set of transitions over 𝑃 and 𝑆 defined by: Ø 𝑅↑𝑃 := 𝑡↑𝑃 𝑡 ∈𝑅

Given a relation ∼ on 𝑅, its 𝑃-closure ∼↑𝑃 is the relation on 𝑅↑𝑃 with 𝑡ˆ (∼↑𝑃) 𝑡ˆ′ iff 𝑡ˆ ∈ 𝑡↑𝑃 and 𝑡ˆ′ ∈ 𝑡 ′ ↑𝑃 for some 𝑡 ∼ 𝑡 ′ . A transition over 𝑃 is unary if it lies in the 𝑃-closure of a unary transaction. Namely, the closure over 𝑃 ⊇ 𝑄 of a machine transaction 𝑡 over 𝑄 includes all transitions 𝑡 ′ over 𝑃 in which members of 𝑄 do the same in 𝑡 and in 𝑡 ′ , and the rest remain in their current (arbitrary) state. The closure likewise carries any relation on transactions to one on the induced transitions. If distinct transactions in 𝑅 have disjoint 𝑃-closures—as when every participant of every transaction in 𝑅 changes state—then each transition in 𝑅↑𝑃 has a unique inducing transaction, ∼↑𝑃 relates two transitions exactly when their inducing transactions are ∼-related, and ∼↑𝑃 is a partial equivalence whenever ∼ is. A set 𝑅 of volition-guarded transactions with an equivalence ∼ on their underlying machine transactions induces a volitional multiagent transition system: Definition A.10 (Volitional Multiagent Transition System [26]). Given agents 𝑃 ⊂ Π, machine states 𝑆 with initial state 𝑠 0 , a set 𝑅 of volition-guarded transactions and volition-guarded if-thenelse transactions—a volition-guarded if-then-else transaction 𝑠 → 𝑠 ′ ; 𝑠 ′′ guarded by 𝑝 standing in 𝑅 for its then-branch (𝑠 → 𝑠 ′, {𝑝}) together with its else-branch—such that every (𝑡, 𝑄 ′ ) ∈ 𝑅 has the participants of 𝑡 contained in 𝑃, every guard 𝑝 of a volition-guarded if-then-else transaction is in 𝑃, and distinct underlying machine transactions, else-branches included, have disjoint 𝑃-closures, and an equivalence ∼ on the set 𝑇𝑅 := {𝑡 : (𝑡, 𝑄 ′ ) ∈ 𝑅 for some 𝑄 ′ } of underlying machine transactions (a total equivalence, hence in particular a partial equivalence in the sense of Definition A.6), such that no else-branch is in 𝑇𝑅 and volition-guarded if-then-else transactions with the same else-branch have ∼-equivalent thenbranches, the volitional multiagent transition system induced by (𝑆, 𝑅, ∼) over 𝑃 is the multiagent transition system (A 𝑃 , 𝑐 0,𝑇𝑉 , ∼𝑉 ) where: (1) A := 2𝑇𝑅 /∼ × 𝑆 is the agent state space; (2) 𝑐 0 ∈ A 𝑃 is the initial agent configuration, with 𝑐 0 𝑝𝑣 = ∅ and 𝑐 0𝑚 𝑝 = 𝑠 0 for every 𝑝 ∈ 𝑃; (3) 𝑇𝑉 consists of all transitions 𝑒 → 𝑒 ′ ∈ (A 𝑃 ) 2 of one of three forms: (i) a volition change of some 𝑝 ∈ 𝑃—𝑒𝑝𝑣 , 𝑒 ′𝑣𝑝 ⊆ (𝑇𝑅 /∼)𝑝 ′ and 𝑒𝑝𝑣 ≠ 𝑒 ′𝑣𝑝 , 𝑒𝑝𝑚 = 𝑒 ′𝑚 𝑝 , and 𝑒𝑟 = 𝑒𝑟 for every 𝑟 ∈ 𝑃 \ {𝑝}; (ii) a volitional machine transaction induced by some volitionguarded transaction (𝑡, 𝑄 ′ ) ∈ 𝑅 per Definition A.3(2); or (iii) an else transaction induced by some volition-guarded if-then-else transaction in 𝑅 per Definition A.5; (4) ∼𝑉 is the restriction of ∼↑𝑃 (Definition A.9) to the volitional machine transactions and else transactions, relating two of them whenever their inducing machine transactions are ∼-equivalent, where the inducing machine transaction of an else transaction is the then-branch 𝑠 → 𝑠 ′ of its volition-guarded if-then-else transaction, and leaves every volition-change transition outside its domain—so volition changes belong to no class and carry no liveness obligation. The conditions on else-branches ensure that the machine transactions inducing a transition of 𝑇𝑉 are ∼-equivalent, so that ∼𝑉 is a partial equivalence. The set 𝑅 of volition-guarded transactions that specifies a platform thus determines the volitional machine transitions of the induced volitional multiagent transition system,

Corralling AI Risks

while volition-change transitions are freely available to every agent independent of 𝑅. Definition A.11 (Enabled [26]). Given a set of volition-guarded transactions, each (𝑡, 𝑄 ′ ) with 𝑡 = 𝑑 → 𝑑 ′ a machine transaction over some 𝑄 ′ ⊆ 𝑄 ⊆ 𝑃 and 𝑆, and an equivalence ∼ on machine transactions: the volition-guarded transaction (𝑡, 𝑄 ′ ) is machineenabled in agent configuration 𝑐 over 𝑃 if 𝑐𝑚 𝑝 = 𝑑𝑝 for every 𝑝 ∈ 𝑄, and enabled if in addition [𝑡] ∈ 𝑐𝑞𝑣 for every 𝑞 ∈ 𝑄 ′ . The else-branch of a volition-guarded if-then-else transaction 𝑠 → 𝑠 ′ ; 𝑠 ′′ guarded ′ 𝑣 by 𝑝 is enabled in 𝑐 if 𝑐𝑚 𝑝 = 𝑠 and [𝑠 → 𝑠 ] ∉ 𝑐 𝑝 . An equivalence class [𝑡] is enabled in 𝑐 if some volition-guarded transaction (𝑡 ′, 𝑄 ′ ) with 𝑡 ′ ∈ [𝑡] is enabled in 𝑐, or the else-branch of some volition-guarded if-then-else transaction with then-branch 𝑡 ′ ∈ [𝑡] is enabled in 𝑐. A volition-guarded transaction with an empty guard (𝑄 ′ = ∅) requires no volitions and is enabled whenever its machine precondition is met. The class of the then-branch of a volition-guarded if-then-else transaction guarded by 𝑝 is thus enabled whenever 𝑝’s machine is in its source state, whether or not 𝑝 wills it. For the volitional multiagent transition system above, a class of volitional machine transactions and else transactions is enabled at a configuration in the sense of Definition A.6 exactly when some volition-guarded transaction or else-branch inducing it is enabled in the above sense; this determines which runs are live and correct per Definition A.6. Volition-change transitions belong to no class and so impose no liveness obligation; personal choices remain free. Protocols and grassroots protocols. A protocol is a family of multiagent transition systems, one for each set of agents 𝑃 ⊂ Π, which share an underlying set of local machine states S with a designated initial state 𝑠 0 . A local-states function maps every set of agents 𝑃 ⊂ Π to an arbitrary set of local machine states 𝑆 (𝑃) ⊂ S that includes 𝑠 0 and satisfies 𝑃 ⊂ 𝑃 ′ ⊂ Π =⇒ 𝑆 (𝑃) ⊂ 𝑆 (𝑃 ′ ). Definition A.12 (Protocol [26]). A protocol F over a local-states function 𝑆 is a family of multiagent transition systems that has exactly one transition system F (𝑃) = (𝐶 (𝑃), 𝑐 0 (𝑃),𝑇 (𝑃), ∼ (𝑃)) for every 𝑃 ⊂ Π, with agent states A (𝑃), configurations 𝐶 (𝑃) := A (𝑃) 𝑃 , initial configuration 𝑐 0 (𝑃) ∈ 𝐶 (𝑃), and partial equivalence ∼ (𝑃) on 𝑇 (𝑃) determined by the protocol, such that 𝑃 ⊆ 𝑃 ′ ⊂ Π implies A (𝑃) ⊆ A (𝑃 ′ ) and 𝑐 0 (𝑃)𝑝 = 𝑐 0 (𝑃 ′ )𝑝 for every 𝑝 ∈ 𝑃. Definition A.13 (Interleaving [26]). Let 𝑃, 𝑃 ′ ⊂ Π be disjoint nonempty sets of agents, 𝑟 = 𝑐 0, 𝑐 1, . . . a run of F (𝑃), and 𝑟 ′ = 𝑑 0, 𝑑 1, . . . a run of F (𝑃 ′ ). An interleaving of 𝑟 and 𝑟 ′ is a sequence 𝑒 0, 𝑒 1, . . . of configurations in 𝐶 (𝑃 ∪ 𝑃 ′ ) for which there exist nondecreasing sequences of indices (𝑖𝑘 )𝑘 ≥0 and ( 𝑗𝑘 )𝑘 ≥0 with 𝑖 0 = 𝑗0 = 0 such that for every 𝑘 ≥ 0: (1) (𝑒𝑘 )𝑝 = (𝑐𝑖𝑘 )𝑝 for every 𝑝 ∈ 𝑃, (2) (𝑒𝑘 )𝑞 = (𝑑 𝑗𝑘 )𝑞 for every 𝑞 ∈ 𝑃 ′ , (3) if 𝑒𝑘+1 exists, then exactly one of: (i) 𝑖𝑘+1 = 𝑖𝑘 + 1 and 𝑗𝑘+1 = 𝑗𝑘 (a 𝑃-step), or (ii) 𝑖𝑘+1 = 𝑖𝑘 and 𝑗𝑘+1 = 𝑗𝑘 + 1 (a 𝑃 ′ -step). Moreover, if 𝑟 is finite of length 𝑛 then 𝑖𝑘 = 𝑛 for some 𝑘, and if 𝑟 is infinite then for every 𝑚 ≥ 0 there is a 𝑘 with 𝑖𝑘 = 𝑚; likewise for 𝑟 ′ and ( 𝑗𝑘 ). Definition A.14 (Interaction, Interactive Run, First Interaction [26]). Let 𝑄 ⊂ Π. For a configuration 𝑐 over 𝑄 and 𝑅 ⊆ 𝑄, write 𝑐 |𝑅 for the restriction of 𝑐 to 𝑅. A transition 𝑒 → 𝑒 ′ of F (𝑄) is an interaction between 𝑥 ≠ 𝑦 ∈ 𝑄 if 𝑒 | {𝑥 } ≠ 𝑒 ′ | {𝑥 } and 𝑒 | {𝑦 } ≠ 𝑒 ′ | {𝑦 } ,

and 𝑒 | {𝑥 } → 𝑒 ′ | {𝑥 } is not a transition of F ({𝑥 }) or 𝑒 | {𝑦 } → 𝑒 ′ | {𝑦 } is not a transition of F ({𝑦}). It is an interaction between disjoint nonempty 𝑃, 𝑃 ′ ⊆ 𝑄 if it is an interaction between some 𝑥 ∈ 𝑃 and some 𝑦 ∈ 𝑃 ′ . A run 𝑟ˆ of F (𝑄) is interactive between 𝑃 and 𝑃 ′ if some transition of 𝑟ˆ is an interaction between them; the first interaction of 𝑃 and 𝑃 ′ in 𝑟ˆ is the first such transition. Definition A.15 (Oblivious, Interactive, Grassroots [26]). A protocol F is: (1) oblivious if for every disjoint nonempty 𝑃, 𝑃 ′ ⊂ Π, every interleaving of a correct run of F (𝑃) and a correct run of F (𝑃 ′ ) is a correct run of F (𝑃 ∪ 𝑃 ′ ). (2) interactive if for every 𝑄 ⊂ Π and disjoint nonempty 𝑃, 𝑃 ′ ⊆ 𝑄, every prefix of a correct run of F (𝑄) containing no interaction between 𝑃 and 𝑃 ′ is a prefix of a correct run of F (𝑄) that contains one. (3) grassroots if it is oblivious and interactive. Being oblivious means two disjoint groups coexist without interference: any interleaving of a correct run of one with a correct run of the other is a correct run of the combined system. Being interactive means two groups that have not yet interacted can still do so: the combined system has a correct continuation in which a single transaction engages agents of both groups. Agents that have taken part in a common interaction are joined; an instance is a maximal set of agents joined directly or indirectly, and two instances coalesce when they come to be one. Definition A.16 (Interaction Graph, Instance, Coalescence [26]). Let F be a protocol, 𝑄 ⊂ Π, and 𝑟 a prefix of a run of F (𝑄). The interaction graph of 𝑟 has vertices 𝑄 and an edge between 𝑎 ≠ 𝑏 ∈ 𝑄 whenever some transition of 𝑟 is an interaction between 𝑎 and 𝑏. A nonempty 𝑃 ⊆ 𝑄 is an instance in 𝑟 if it is a connected component of the interaction graph of 𝑟 . Disjoint nonempty 𝑃, 𝑃 ′ ⊆ 𝑄 coalesce in a run 𝑟ˆ of F (𝑄) if they are instances in some prefix of 𝑟ˆ and lie in one component of the interaction graph of a longer prefix of 𝑟ˆ. Definition A.17 (Transactions Over a Local-State Function [26]). Let 𝑆 be a local-states function. A set of transactions 𝑅 is over 𝑆 if every transaction 𝑡 ∈ 𝑅 is a multiagent transition over 𝑄 and 𝑆 (𝑃 ′ ) for some 𝑄 ⊆ 𝑃 ′ ⊂ Π. Given such a set 𝑅 and 𝑃 ⊂ Π, 𝑅(𝑃) := {𝑡 ∈ 𝑅 : 𝑡 is over 𝑄 and 𝑆 (𝑃 ′ ), 𝑄 ⊆ 𝑃 ′ ⊆ 𝑃 }. Definition A.18 (Volitional Transactions-Based Protocol [26]). Let 𝑆 be a local-states function and 𝑅 a set of volition-guarded transactions over 𝑆 with equivalence ∼. The protocol F over 𝑅, 𝑆, and ∼ assigns to each set of agents 𝑃 ⊂ Π the volitional multiagent transition system F (𝑃) induced by (𝑆 (𝑃), 𝑅(𝑃), ∼) over 𝑃 (Definition A.10). In particular, 𝐶 (𝑃) = A (𝑃) 𝑃 with agent state space A (𝑃) := 2𝑇𝑅 (𝑃 ) /∼ × 𝑆 (𝑃)—monotone in 𝑃, as Definition A.12 requires—and 𝑐 0 (𝑃) has 𝑝-component (∅, 𝑠 0 ) for every 𝑝 ∈ 𝑃. The obliviousness results rest on the following invariant: in a group’s own system an agent wills only transactions internal to the group, so the guard of a transaction that reaches another group cannot will it while the group runs alone, and the transaction is never enabled in an interleaving. Lemma A.19 (Volitional Containment [26]). Let F be a volitional transactions-based protocol over a set of volition-guarded

Ehud Shapiro

transactions 𝑅 with equivalence ∼. For every 𝑃 ⊂ Π, every configuration 𝑐 of F (𝑃), and every 𝑝 ∈ 𝑃: 𝑐 𝑝𝑣 ⊆ 𝑇𝑅 (𝑃 ) /∼, where 𝑇𝑅 (𝑃 ) := {𝑡 : (𝑡, 𝑄 ′ ) ∈ 𝑅(𝑃) for some 𝑄 ′ }. Lemma A.20 (Interleaving Safety [26]). Let F be a volitional transactions-based protocol and 𝑃, 𝑃 ′ ⊂ Π disjoint and nonempty. Every finite prefix of an interleaving of a correct run of F (𝑃) and a correct run of F (𝑃 ′ ) is a finite safe run of F (𝑃 ∪ 𝑃 ′ ). Proposition A.21 ([26]). A volitional transactions-based protocol is oblivious provided that for every disjoint nonempty 𝑃, 𝑃 ′ ⊂ Π, no equivalence class whose transactions have participants spanning both 𝑃 and 𝑃 ′ is ever enabled in any interleaving of correct runs of F (𝑃) and F (𝑃 ′ ). Corollary A.22 (Guarded Obliviousness [26]). A volitional transactions-based protocol over a set of volition-guarded transactions 𝑅 is oblivious if every volition-guarded transaction (𝑡, 𝑄 ′ ) ∈ 𝑅 whose machine transaction 𝑡 has two or more participants has a nonempty guard, 𝑄 ′ ≠ ∅. In a run of F (𝑃 ∪ 𝑃 ′ ) a member may will a transaction reaching the other group, which a group’s own run forbids; the volitional notion constrains the resulting coupling: Definition A.23 (Left [26]). Let F be a volitional transactionsbased protocol over 𝑅, 𝑄 ⊂ Π, 𝑐 a configuration of F (𝑄), and 𝑥 ∈ 𝑄. Then 𝑥 has left in 𝑐 if no (𝑡, 𝑄 ′ ) ∈ 𝑅(𝑄) with 𝑥 ∈ 𝑄 ′ is machine∗ enabled in any configuration 𝑐 ′ of F (𝑄) with 𝑐 → − 𝑐 ′ ⊆ 𝑇 (𝑄). Definition A.24 (Interactive Among the Agents That Have Not Left [26]). A volitional transactions-based protocol F is interactive among the agents that have not left if for every 𝑄 ⊂ Π and disjoint nonempty 𝑃, 𝑃 ′ ⊆ 𝑄, every prefix of a correct run of F (𝑄) containing no interaction between 𝑃 and 𝑃 ′ , in whose last configuration some agent of 𝑃 and some agent of 𝑃 ′ have not left, is a prefix of a correct run of F (𝑄) that contains one. An interactive protocol is interactive among the agents that have not left, the latter requiring a continuation of fewer prefixes. A group all of whose agents have left can never be connected by an act one of them wills, and the definition asks nothing of it. Definition A.25 (Volitionally Grassroots [26]). A volitional transactions-based protocol F is volitionally grassroots if it is oblivious, interactive among the agents that have not left, and, for every disjoint nonempty 𝑃, 𝑃 ′ ⊂ Π and every safe run of F (𝑃 ∪ 𝑃 ′ ) interactive between 𝑃 and 𝑃 ′ , the first interaction of 𝑃 and 𝑃 ′ is induced by a volition-guarded transaction (𝑡, 𝑄 ′ ) with 𝑄 ′ ∩ 𝑃 ≠ ∅ and 𝑄 ′ ∩ 𝑃 ′ ≠ ∅. Two groups thus become connected only by an act a person of each wills, and a grassroots protocol meeting the condition on first interactions is volitionally grassroots. An else transaction (Definition A.5) is over a single participant and so is never an interaction; a binary transaction with an else-branch would let an agent of another group, who never wills it, trigger it, and could be a first interaction willed by neither, which is why Definition A.4 admits only unary ones.

B

The Transactions of the Contract

Nineteen transactions, written in the local-state components of Section 3.2, one per speech-act schema of the contract (programs/ gai/GAI.glp and programs/gai/GSNP.glp in the GLP repository,

their records cascade/GAI and cascade/GSNP), each determined by its schema at each binding by the compilation of [17], and carrying the schema’s name. Every transaction requires 𝜄 = 1 at each of its participants, except Establish, and Enter at the AI agent, and 𝜃 = 0 at each of its guards; the requirements are left out below, and all components not explicitly updated are preserved. (3) Volition-Guarded Multiagent Atomic Transactions (1) Establish(𝑝), where 𝜄 𝑝 = 0: 𝜄 𝑝′ := 1, guarded by 𝑝. (2) Acquaint(𝑝, 𝑞), where 𝑝 ≠ 𝑞 and 𝑎𝑝 = 𝑎𝑞 = 0: 𝜈 𝑝′ := 𝜈 𝑝 ⊎ {𝑞} and 𝜈𝑞′ := 𝜈𝑞 ⊎ {𝑝}, guarded by {𝑝, 𝑞}. (3) Introduce(𝑝, 𝑞; 𝑐), where 𝑎𝑝 = 𝑎𝑞 = 0, 𝑞 ∈ 𝜈 𝑝 , 𝑐 ∈ 𝜈 𝑝 and 𝑝 ∈ 𝜈𝑞 , for an agent 𝑐: 𝜈𝑞′ := 𝜈𝑞 ⊎ {𝑐}, guarded by {𝑝, 𝑞}. (4) Befriend(𝑝, 𝑞), where 𝑝 ≠ 𝑞, 𝑎𝑝 = 𝑎𝑞 = 0, 𝑞 ∈ 𝜈 𝑝 , 𝑝 ∈ 𝜈𝑞 , 𝑞 ∉ 𝑐 𝑝 and 𝑝 ∉ 𝑐𝑞 : 𝑐 𝑝′ := 𝑐 𝑝 ∪ {𝑞} and 𝑐𝑞′ := 𝑐𝑞 ∪ {𝑝}, guarded by {𝑝, 𝑞}. (5) Unfriend(𝑝, 𝑞), where 𝑞 ∈ 𝑐 𝑝 and 𝑞 ∉ 𝜌 𝑝 ∪ 𝜇𝑝 ∪ 𝜅𝑝 ∪ 𝜆𝑝 : 𝑐 𝑝′ := 𝑐 𝑝 \ {𝑞} and 𝑐𝑞′ := 𝑐𝑞 \ {𝑝}, guarded by 𝑝. (6) Enter(𝑝, 𝑟 ; 𝑦), where 𝑎𝑝 = 0, 𝑦 ∈ 𝛼 𝑝 and 𝜄𝑟 = 0: 𝜅𝑝′ := 𝜅𝑝 ∪ {𝑟 }, 𝜆𝑝′ := 𝜆𝑝 ∪ {𝑟 }, 𝑐 𝑝′ := 𝑐 𝑝 ∪ {𝑟 }, 𝜈 𝑝′ := 𝜈 𝑝 ⊎ {𝑟 }, 𝜖𝑝′ := 𝜖𝑝 ∪ {(𝑟, 𝑦)}, 𝜄𝑟′ := 1, 𝑎𝑟′ := 1, 𝜌𝑟′ := {𝑝}, 𝑐𝑟′ := {𝑝}, 𝜈𝑟′ := {𝑝} and 𝛾𝑟′ := {𝑦}, guarded by {𝑝, 𝑟 }. (7) Make guardian(𝑝, 𝑞, 𝑟 ; 𝑦), where 𝑟 ∈ 𝜅𝑝 , 𝑞 ∈ 𝑐 𝑝 , (𝑟, 𝑦) ∈ 𝜖𝑝 , 𝑎𝑞 = 0, 𝑟 ∉ 𝜆𝑞 , 𝑎𝑟 = 1, 𝜃 𝑟 = 0 and 𝑞 ∉ 𝑐𝑟 : 𝜆𝑞′ := 𝜆𝑞 ∪ {𝑟 }, 𝑐𝑞′ := 𝑐𝑞 ∪ {𝑟 }, 𝜖𝑞′ := 𝜖𝑞 ∪ {(𝑟, 𝑦)}, 𝜇𝑟′ := 𝜇𝑟 ∪ {𝑞} and 𝑐𝑟′ := 𝑐𝑟 ∪ {𝑞}, guarded by {𝑝, 𝑞}. (8) End guardian(𝑝, 𝑞, 𝑟 ), where 𝑟 ∈ 𝜅𝑝 , 𝑟 ∈ 𝜆𝑞 , 𝑟 ∉ 𝜅𝑞 and 𝑞 ∈ 𝜇𝑟 : 𝜆𝑞′ := 𝜆𝑞 \ {𝑟 } and 𝜇𝑟′ := 𝜇𝑟 \ {𝑞}, guarded by 𝑝. (9) Resign(𝑞, 𝑟 ), where 𝑟 ∈ 𝜆𝑞 , 𝑟 ∉ 𝜅𝑞 and 𝑞 ∈ 𝜇𝑟 : 𝜆𝑞′ := 𝜆𝑞 \ {𝑟 } and 𝜇𝑟′ := 𝜇𝑟 \ {𝑞}, guarded by 𝑞. (10) Guardian unfriend(𝑞, 𝑟 ), where 𝑟 ∈ 𝑐𝑞 ∩ 𝜆𝑞 , 𝑟 ∉ 𝜅𝑞 and 𝑞 ∈ 𝑐𝑟 ∩ 𝜇𝑟 : 𝑐𝑞′ := 𝑐𝑞 \ {𝑟 }, 𝜆𝑞′ := 𝜆𝑞 \ {𝑟 }, 𝑐𝑟′ := 𝑐𝑟 \ {𝑞} and 𝜇𝑟′ := 𝜇𝑟 \ {𝑞}, guarded by 𝑞. (11) Agent acquaint(𝑟, 𝑞, 𝑝; 𝑦), where 𝑎𝑟 = 1, 𝑦 ∈ 𝛾𝑟 , 𝑎𝑞 = 𝑎𝑝 = 0, 𝑟 ∈ 𝜆𝑝 , (𝑟, 𝑦) ∈ 𝜖𝑝 and 𝑞 ∈ 𝜈 𝑝 : 𝜈𝑟′ := 𝜈𝑟 ⊎ {𝑞}, 𝜈𝑞′ := 𝜈𝑞 ⊎ {𝑟 } and 𝜖𝑞′ := 𝜖𝑞 ∪ {(𝑟, 𝑦)}, guarded by {𝑟, 𝑞, 𝑝}. (12) Agent befriend(𝑟, 𝑞, 𝑝), where 𝑎𝑟 = 1, 𝑞 ∈ 𝜈𝑟 , 𝑞 ∉ 𝑐𝑟 , 𝑎𝑞 = 𝑎𝑝 = 0, 𝑟 ∈ 𝜈𝑞 , 𝑟 ∉ 𝑐𝑞 , 𝑟 ∈ 𝜆𝑝 and 𝑞 ∈ 𝑐 𝑝 : 𝑐𝑟′ := 𝑐𝑟 ∪ {𝑞} and 𝑐𝑞′ := 𝑐𝑞 ∪ {𝑟 }, guarded by {𝑟, 𝑞, 𝑝}. (13) Agent unfriend(𝑟, 𝑞, 𝑝), where 𝑞 ∈ 𝑐𝑟 , 𝑞 ∉ 𝜌𝑟 ∪ 𝜇𝑟 , 𝑟 ∈ 𝑐𝑞 , 𝑎𝑝 = 0 and 𝑟 ∈ 𝜆𝑝 : 𝑐𝑟′ := 𝑐𝑟 \ {𝑞} and 𝑐𝑞′ := 𝑐𝑞 \ {𝑟 }, guarded by 𝑝. (14) Agents acquaint(𝑟, 𝑠, 𝑝, 𝑞; 𝑦, 𝑧), where 𝑟 ≠ 𝑠, 𝑎𝑟 = 𝑎𝑠 = 1, 𝑦 ∈ 𝛾𝑟 , 𝑧 ∈ 𝛾𝑠 , 𝑎𝑝 = 𝑎𝑞 = 0, 𝑟 ∈ 𝜆𝑝 , (𝑟, 𝑦) ∈ 𝜖𝑝 , 𝑠 ∈ 𝜈 𝑝 , 𝑞 ∈ 𝜈 𝑝 , 𝑠 ∈ 𝜆𝑞 and (𝑠, 𝑧) ∈ 𝜖𝑞 : 𝜈𝑟′ := 𝜈𝑟 ⊎ {𝑠}, 𝜖𝑟′ := 𝜖𝑟 ∪ {(𝑠, 𝑧)}, 𝜈𝑠′ := 𝜈𝑠 ⊎ {𝑟 } and 𝜖𝑠′ := 𝜖𝑠 ∪ {(𝑟, 𝑦)}, guarded by {𝑟, 𝑠, 𝑝, 𝑞}, 𝑝 and 𝑞 possibly one agent. (15) Agents befriend(𝑟, 𝑠, 𝑝, 𝑞), where 𝑟 ≠ 𝑠, 𝑎𝑟 = 𝑎𝑠 = 1, 𝑠 ∈ 𝜈𝑟 , 𝑟 ∈ 𝜈𝑠 , 𝑠 ∉ 𝑐𝑟 , 𝑟 ∉ 𝑐𝑠 , 𝑎𝑝 = 𝑎𝑞 = 0, 𝑟 ∈ 𝜆𝑝 , 𝑠 ∈ 𝜈 𝑝 , 𝑞 ∈ 𝑐 𝑝 and 𝑠 ∈ 𝜆𝑞 : 𝑐𝑟′ := 𝑐𝑟 ∪ {𝑠} and 𝑐𝑠′ := 𝑐𝑠 ∪ {𝑟 }, guarded by {𝑟, 𝑠, 𝑝, 𝑞}, 𝑝 and 𝑞 possibly one agent. (16) Retire(𝑝, 𝑟 ), where 𝑟 ∈ 𝜅𝑝 , 𝑟 ∈ 𝑐 𝑝 , 𝑎𝑟 = 1 and 𝜌𝑟 = {𝑝}: 𝜏𝑝′ := 𝜏𝑝 ∪ {𝑟 }, 𝑐𝑟′ := ∅, 𝜇𝑟′ := ∅ and 𝜃 𝑟′ := 1, and 𝑐𝑠′ := 𝑐𝑠 \ {𝑟 } for every 𝑠 ∈ 𝑐𝑟 , 𝑝 among them, and 𝜆𝑠′ := 𝜆𝑠 \ {𝑟 } for every 𝑠 ∈ 𝜇𝑟 , guarded by 𝑝; its participants are 𝑝, 𝑟 and every agent in 𝑐𝑟 ∪ 𝜇𝑟 .

Corralling AI Risks

(17) Sign(𝑝; 𝑥), where 𝑥 is a speech act signed by 𝑝: ℎ𝑝′ := ℎ𝑝 ⊎ {𝑥 } and 𝛼 𝑝′ := 𝛼 𝑝 ∪ {𝑥 }, guarded by 𝑝. (18) Message(𝑝, 𝑞; 𝑥), where 𝑥 ∈ 𝛼 𝑝 and 𝑞 ∈ 𝑐 𝑝 : ℎ𝑞′ := ℎ𝑞 ⊎ {𝑥 }, guarded by 𝑝. (19) Forward(𝑝, 𝑞; 𝑥), where 𝑥 ∈ ℎ𝑝 , 𝑥 ∉ 𝛼𝑝 and 𝑞 ∈ 𝑐 𝑝 : ℎ𝑞′ := ℎ𝑞 ⊎ {sgn(𝑥, 𝑝)}, guarded by 𝑝, where sgn(𝑥, 𝑝) is 𝑥 signed over by 𝑝. The schema unfriend is guarded in its first role, the friend ending the friendship, and is bound either way, so Unfriend(𝑝, 𝑞) is guarded by 𝑝 and Unfriend(𝑞, 𝑝) by 𝑞: either friend may end the friendship, unless one is a guardian of the other, a friendship that only Guardian unfriend and Retire end (GnW:1, GnW:2 and GnW:5). The requirement 𝑞 ∉ 𝜌 𝑝 ∪ 𝜇𝑝 ∪ 𝜅𝑝 ∪ 𝜆𝑝 of Unfriend stands for the atoms principal(𝑞), guarded_by(𝑞), principal_of (𝑞) and guardian_of (𝑞) forbidden at 𝑝, and 𝑞 ∉ 𝜌𝑟 ∪ 𝜇𝑟 of Agent unfriend for principal(𝑞) and guarded_by(𝑞) forbidden at 𝑟 . The requirement 𝑟 ∈ 𝜅𝑝 stands for principal_of (𝑟 ) at 𝑝, 𝑟 ∈ 𝜆𝑝 for guardian_of (𝑟 ) at 𝑝, and 𝜌𝑟 = {𝑝} of Retire for principal(𝑝) at 𝑟 ; Enter sets 𝜌𝑟 and 𝜅𝑝 together and no transaction changes either. The requirement 𝑦 ∈ 𝛼 𝑝 of Enter stands for authored (𝑦) at 𝑝, 𝑦 the attestation 𝑝 signed, its content naming the AI agent’s public key and the code its developer signed (GAI:2); 𝑦 ∈ 𝛾𝑟 for attestation(𝑦) at 𝑟 ; and (𝑟, 𝑦) ∈ 𝜖𝑝 for its record agent_of (𝑟, 𝑦) at 𝑝, which Enter adds at the principal and Make guardian at another guardian, and from which the guardian’s machine fills the request; 𝑥 ∈ 𝛼 𝑝 of Message stands for authored (𝑥) at 𝑝, and 𝑥 ∉ 𝛼 𝑝 of Forward for authored (𝑥) forbidden there. Retire takes every friend and every guardian of 𝑟 by the listed roles 𝑟 [friend (∗)] and 𝑟 [guarded_by(∗)], based on its first role, 𝑟 , and clears friend and guarded_by at 𝑟 [17, 22]. The requirement 𝜃 = 0 at each guard stands for retired forbidden at every guarding role. The component 𝜈 𝑝 is a multiset: Acquaint, Agent acquaint and Agents acquaint neither require nor forbid that the two know each other, and add a copy of each at the other whether they do or not, so that two agents who know each other may take the act again. knows and friend are reflexive, so that in Agents acquaint and Agents befriend one person may be the guardian of both AI agents. Transaction equivalence. The equivalence ∼ is that of [17]: one schema at one admissible binding determines one class, whose members differ only in the configuration in which they occur. All Acquaint(𝑝, 𝑞) transactions form one class, and so do all Introduce(𝑝, 𝑞; 𝑐), all Befriend(𝑝, 𝑞), all Unfriend(𝑝, 𝑞), all End guardian(𝑝, 𝑞, 𝑟 ), all Resign(𝑞, 𝑟 ), all Guardian unfriend(𝑞, 𝑟 ), all Agent befriend(𝑟, 𝑞, 𝑝), all Agents befriend(𝑟, 𝑠, 𝑝, 𝑞), all Agent unfriend(𝑟, 𝑞, 𝑝) and all Retire(𝑝, 𝑟 ) with the same agents; all Enter(𝑝, 𝑟 ; 𝑦), all Make guardian(𝑝, 𝑞, 𝑟 ; 𝑦), all Agent acquaint(𝑟, 𝑞, 𝑝; 𝑦) and all Agents acquaint(𝑟, 𝑠, 𝑝, 𝑞; 𝑦, 𝑧) with the same agents and speech acts; each Establish(𝑝); each Sign(𝑝; 𝑥) with the same item; and each Message(𝑝, 𝑞; 𝑥) and each Forward(𝑝, 𝑞; 𝑥) with the same agents and item.

C

Contracts with Wards

This appendix defines contracts with wards, agents who act only with the consent of a guardian, as an extension of the speech-act schema language of [17]: a child with their parents [43], an AI agent with its principal. The GnW contract (Section 3.1) marks a

ward as one and lets only the unsupervised come to know each other (GKK:2), so a contract extending it has no act that any two agents can take and is not syntactically grassroots in the sense of [17]; the protocol realising it is volitionally grassroots nonetheless, since a ward enters the contract with a guardian recorded, who is not a ward, and comes to know, through their guardian, anyone their guardian can come to know, and a retired ward has left. Section C.1 recalls the language and the results of [17] this appendix uses, with the two additions the extension makes to the language, reflexive predicates and signed terms; Section C.2 states conditions on the schemas under which a contract with wards is certified, decidable as the conditions of [17] are, and proves them sufficient (Theorem C.20); Section C.3 certifies the social network with provenance of Section 4 (Proposition C.21) and the contract of this paper (Proposition C.22). The checker of [17], in the repository https://github.com/EShapiro2/GLP, decides the conditions of this appendix as well.

C.1

The Language and the Results Recalled

Atoms and states. Π is a countable, potentially infinite set of agents and Δ a countable set of utterances disjoint from it. A speech act is an utterance or a speech act signed by an agent: 𝐷 is the least set with Δ × Π ⊆ 𝐷 and 𝐷 × Π ⊆ 𝐷, the signer of (𝑥, 𝑝) ∈ 𝐷 is 𝑝, and 𝐷 𝑃 := {𝑑 ∈ 𝐷 : signer(𝑑) ∈ 𝑃 } for 𝑃 ⊆ Π [6, 18]. Σ is a set of predicates, each with an arity; an atom is a predicate applied to as many arguments as its arity, a syntactic object with no truth value, and it names what is among its arguments or is the signer of one. A local state is a finite multiset of atoms over Π ∪ 𝐷, the initial state 𝑠 0 is empty, and 𝑆𝐶 (𝑃) is the set of finite multisets of atoms over 𝑃 ∪ 𝐷 𝑃 [17]. Multiset sum, difference, intersection and inclusion à are ⊎, \, ∩ and ⊆, and the join 𝑗 𝑠 𝑗 takes the greatest multiplicity. A mark is a predicate of arity zero, and its atom is written as the mark. A schema is written over disjoint sets 𝑅 of roles, 𝑋 of agent variables and 𝑌 of speech-act variables, disjoint from Π and 𝐷. Definition C.1 (Speech-act schema [17]). A speech-act schema is written 𝜏 (𝜋1, . . . , 𝜋𝑘 ; 𝑥 1, . . . , 𝑥𝑚 ) : 𝐸 1 · · · 𝐸𝑘 , with 𝜏 its name, 𝜋 1, . . . , 𝜋𝑘 ∈ 𝑅 distinct, each possibly carrying the mark ? and those that do its guarding roles, 𝑘 ≥ 1 its arity, 𝑥 1, . . . , 𝑥𝑚 ∈ 𝑋 ∪𝑌 distinct, its variables, 𝑇𝜏 the set of its signed terms sgn(𝑦, 𝜋) with 𝑦 one of its variables in 𝑌 and 𝜋 one of its roles, and each 𝐸𝑖 a finite multiset of atoms over {𝜋1, . . . , 𝜋𝑘 , 𝑥 1, . . . , 𝑥𝑚 } ∪ 𝑇𝜏 , each carrying at most one of the marks −, +, ¬. For each role 𝜋𝑖 the marks divide 𝐸𝑖 into +(𝑖), −(𝑖), ¬(𝑖) and =(𝑖), its members marked +, −, ¬ and unmarked; the atoms 𝜋𝑖 requires are =(𝑖) ⊎ −(𝑖), and it forbids, adds and deletes those of ¬(𝑖), +(𝑖) and −(𝑖). It is required that +(𝑖) ∩ −(𝑖) = ∅, that +(𝑖) ⊎ −(𝑖) ≠ ∅ at every role that is not a guarding role and at some role, that a signed term occurs only in an atom marked +, and that its speech-act variable occurs in an atom its role requires. A contract 𝐶 is a finite set of speech-act schemas over Σ. A schema may also have, for an agent role 𝜋 of it and a predicate 𝜌, the listed role 𝜋 [𝜌 (∗, 𝑢 2, . . . , 𝑢𝑟 )], whose participants at a binding are every agent 𝑞 with 𝜌 (𝑞, 𝛽 (𝑢 2 ), . . . , 𝛽 (𝑢𝑟 )) in the state of 𝛽 (𝜋), and an atom marked − at a role may carry the wildcard ∗ among its arguments, a cleared atom, which deletes every atom of the state it matches and requires none [17]; Retire takes every friend and every guardian of the AI agent by two listed roles and

Ehud Shapiro

Table 1: The local state of an agent 𝑝. identity, friends

knowing

guardianship

items

and

component 𝜄𝑝 ∈ {0, 1} , whether 𝑝 has a genuine digital identity

stands for identity

𝑎𝑝 ∈ {0, 1} , whether 𝑝 is an AI agent 𝜈𝑝 , a multiset of agents, those 𝑝 knows, each by their public key 𝑐 𝑝 ⊆ 𝑃 , the friends of 𝑝 𝜌𝑝 ⊆ 𝑃 , the principal of 𝑝 , at most one, and 𝜅𝑝 ⊆ 𝑃 , the AI agents 𝑝 created 𝜆𝑝 ⊆ 𝑃 , the AI agents 𝑝 is a guardian of, and 𝜇𝑝 ⊆ 𝑃 , the guardians of 𝑝 other than its principal 𝛾𝑝 , the attestation of 𝑝 , a set of at most one speech act 𝜖𝑝 , pairs (𝑟, 𝑦) of an AI agent 𝑟 and its attestation 𝑦 that 𝑝 holds recorded 𝜃 𝑝 ∈ {0, 1} , whether 𝑝 is retired, and 𝜏𝑝 ⊆ 𝑃 , the AI agents 𝑝 retired ℎ𝑝 , a multiset of speech acts, the items 𝑝 holds, each signed by its author and by every agent that forwarded it, in order 𝛼𝑝 ⊆ ℎ𝑝 , the items 𝑝 authored

agent knows friend principal , principal _of guardian_of , guarded _by attestation agent _of retired , retired _of item authored

Table 2: The components that change in the example. Transactions Establish (𝑎) , Establish (𝑏 ) Acquaint (𝑎, 𝑏 ) Befriend (𝑎, 𝑏 ) Sign (𝑎; 𝑦) Enter (𝑎, 𝑟 ; 𝑦) Agent acquaint (𝑟, 𝑏, 𝑎; 𝑦) Agent befriend (𝑟, 𝑏, 𝑎) Sign (𝑟 ; 𝑥 ) , Message (𝑟, 𝑏; 𝑥 ) Retire (𝑎, 𝑟 )

Alice 𝜄𝑎 = 1 𝜈𝑎 = {𝑏 } 𝑐 𝑎 = {𝑏 } ℎ𝑎 = 𝛼𝑎 = {𝑦 } 𝜅𝑎 = 𝜆𝑎 = {𝑟 } , 𝜈𝑎 = {𝑏, 𝑟 } , 𝑐 𝑎 = {𝑏, 𝑟 } , 𝜖𝑎 = { (𝑟, 𝑦) }

𝜏𝑎 = {𝑟 } , 𝑐𝑎 = {𝑏 }

clears its friendships and guardianships, and Unfriend clears every membership between the two (Appendix B). The results recalled below hold with them [17], and the proofs of this appendix use of them only that the extent of a listed role lies in one instance with its base and that a cleared atom requires nothing. Definition C.2 (Binding [17]). A binding 𝛽 for a schema 𝜏 maps its roles and agent variables to Π and 𝑌 to 𝐷, with 𝛽 (sgn(𝑦, 𝜋)) := (𝛽 (𝑦), 𝛽 (𝜋)), distinct roles to distinct agents, but for two the schema marks as possibly one, which it may send to one agent if neither of them adds or deletes an atom naming the other, and is extended to atoms and to multisets of them componentwise. It is admissible if every speech-act variable of 𝜏 that occurs in an atom added at a role and in no atom required at a role is mapped to a speech act signed by the agent in a guarding role of 𝜏. Reflexive predicates. Two roles sent to one agent are carried out by that agent together. A role that adds or deletes an atom naming another cannot share its agent, so no relation a contract records is reflexive. The extension lets a contract declare a predicate of arity one reflexive: every state is then taken to hold the atom of that predicate naming its holder, and no schema adds or deletes, at a role, the atom of it naming that role. For a configuration 𝑑 and an agent 𝑝, 𝑑ˆ𝑝 is 𝑑𝑝 together with the atom naming 𝑝 of every reflexive predicate; in a contract declaring none, 𝑑ˆ𝑝 = 𝑑𝑝 . The child-safe social network [43] and the contract of this paper declare friend and knows reflexive, so that two wards with one guardian may come to know each other and befriend by an act in which that guardian takes both guardian roles (GnW:4). Signed terms. The extension lets a schema add at a role an atom with a signed term sgn(𝑦, 𝜋) among its arguments, the speech act 𝑦 signed by the agent in the role 𝜋: a signed term occurs only in an atom marked +, its speech-act variable occurs in an atom its role requires, a binding 𝛽 sends it to (𝛽 (𝑦), 𝛽 (𝜋)), and in traceable provenance it counts as the two arguments 𝑦 and 𝜋 (Definitions C.1, C.2 and C.6). Forward adds at the recipient item(sgn(𝑥, Alice)),

Bob 𝜄𝑏 = 1 𝜈𝑏 = {𝑎} 𝑐𝑏 = {𝑎}

𝜈𝑏 = {𝑎, 𝑟 } , 𝜖𝑏 = { (𝑟, 𝑦) } 𝑐𝑏 = {𝑎, 𝑟 } ℎ𝑏 = {𝑥 } 𝑐𝑏 = {𝑎}

Alf

𝜄𝑟 = 1, 𝑎𝑟 = 1, 𝜌𝑟 = {𝑎} , 𝜈𝑟 = 𝑐𝑟 = {𝑎} , 𝛾𝑟 = {𝑦 } 𝜈𝑟 = {𝑎, 𝑏 } 𝑐𝑟 = {𝑎, 𝑏 } ℎ𝑟 = 𝛼𝑟 = {𝑥 } 𝜃𝑟 = 1, 𝑐𝑟 = ∅

what Alice held, signed by Alice (Appendix B). In [17] a speech-act variable is bound to a speech act signed by an agent in a guarding role, and no schema signs over what a role holds. Definition C.3 (Compilation [17]). Let 𝜏 be a schema with roles 𝜋 1, . . . , 𝜋𝑘 and 𝛽 a binding for it, and for an agent 𝑝 let 𝐼𝑝 := {𝑖 : 𝛽 (𝜋𝑖 ) = 𝑝}. A machine transaction 𝑑 → 𝑑 ′ over {𝛽 (𝜋 1 ), . . . , 𝛽 (𝜋𝑘 )} is determined by 𝜏 at 𝛽 if for every 𝑖, with 𝑝 := 𝛽 (𝜋𝑖 ), 𝛽 (=(𝑖) ⊎ −(𝑖)) ⊆ 𝑑ˆ𝑝 and 𝛽 (¬(𝑖)) ∩ 𝑑ˆ𝑝 = ∅, and for every agent 𝑝 that 𝛽 Ã Ã sends a role to, 𝑖 ∈𝐼𝑝 𝛽 (+(𝑖)) ∩ 𝑖 ∈𝐼𝑝 𝛽 (−(𝑖)) = ∅ and 𝑑𝑝′ = (𝑑𝑝 \ Ã Ã 𝑖 ∈𝐼𝑝 𝛽 (−(𝑖))) ⊎ 𝑖 ∈𝐼𝑝 𝛽 (+(𝑖)); the volition-guarded transaction it determines is the pair of it with {𝛽 (𝜋) : 𝜋 a guarding role of 𝜏 }. The realisation 𝑅𝐶 of 𝐶 is the set of volition-guarded transactions determined by its schemas at all admissible bindings, ∼ the equivalence on their machine transactions generated by relating two when one schema at one admissible binding determines both, and the protocol realising 𝐶 the volitional transactions-based protocol over 𝑅𝐶 , 𝑆𝐶 and ∼ [17, 26]; 𝑅𝐶 with ∼ is well formed (Lemma The compilation is well defined of [17]), whose proof, like the compilation, uses nothing of the introductory act, so both stand for the contracts of this appendix. The protocol. From [26], recalled in Appendix A: for a set 𝑅 of volition-guarded transactions over 𝑆 and 𝑃 ⊂ Π, 𝑅(𝑃) holds those of them over 𝑆 (𝑃 ′ ) for some 𝑃 ′ ⊆ 𝑃, and 𝑅 is contained if every transaction of it with participants in 𝑃 and source over 𝑆 (𝑃) is in 𝑅(𝑃); the protocol F over 𝑅, 𝑆 and ∼ has at each 𝑄 ⊂ Π the transition system F (𝑄) whose transitions are volition changes and the volitional machine transactions the members of 𝑅(𝑄) induce, each machine-enabled in a configuration whose machine states restrict on its participants to its source, and enabled if every guard holds its class besides; a run is safe if its consecutive configurations form transitions, and correct if besides no class stays enabled forever with no member taken. Every finite safe run is a prefix of a correct run (Lemma Extension of [26]).

Corralling AI Risks

Definition C.4 (Records; recording graphs [17]). A local state records an agent 𝑞 if one of its atoms names 𝑞; a machine state 𝑠 records 𝑞 if 𝑠 ∉ 𝑆 (𝑃) for every 𝑃 ⊂ Π with 𝑞 ∉ 𝑃; on local states the two agree (Lemma Records of [17]). The recording graph of a configuration 𝑑 is the directed graph on Π with an edge 𝑝 → 𝑞 whenever 𝑑𝑝 records 𝑞, and for a set 𝐸 of predicates its 𝐸-recording graph is the subgraph whose edges 𝑝 → 𝑞 are those for which 𝑑𝑝 holds an atom with predicate in 𝐸 naming 𝑞; the recording graph of a run is the union of those of its configurations. A volition-guarded transaction (𝑑 → 𝑑 ′, {𝑝, 𝑞}) over participants {𝑝, 𝑞} is a mutual recording of 𝑝 and 𝑞 if it changes the state of each and the recording graph of 𝑑 ′ has the edges 𝑝 → 𝑞 and 𝑞 → 𝑝. Definition C.5 (Introductory act, unobstructed [17]). A schema 𝜏 of 𝐶 of arity two, guarded in both roles, is an introductory act if any two agents 𝑝 ≠ 𝑞 have an introduction: an admissible binding 𝛽 of 𝜏 into {𝑝, 𝑞} that sends 𝜋1 to 𝑝 and 𝜋 2 to 𝑞, under which some atom added at 𝜋 1 names 𝑞 and some atom added at 𝜋 2 names 𝑝. It is unobstructed if any two agents 𝑝 ≠ 𝑞 have an introduction 𝛽 such that, at each role 𝜋𝑖 of 𝜏: (1) every atom 𝜏 requires at 𝜋𝑖 , other than an atom of a reflexive predicate naming 𝜋𝑖 , is, under 𝛽, added by some schema of 𝐶 of arity one that is guarded in its role, requires nothing, and forbids nothing or only that atom, which 𝜏 then requires once at 𝜋𝑖 , at some admissible binding that sends its role to 𝛽 (𝜋𝑖 ); (2) every schema of 𝐶 that, at some binding, adds at 𝛽 (𝜋𝑖 ) an atom 𝜏 forbids at 𝜋𝑖 has, at that binding, the other of 𝑝 and 𝑞 in a role and adds at 𝛽 (𝜋𝑖 ) an atom naming them; (3) 𝜏 forbids at 𝜋𝑖 no atom of a reflexive predicate naming 𝜋𝑖 . The exceptions for reflexive predicates in clauses 1 and 3 are the extension’s; without reflexive predicates the definition is that of [17]. Definition C.6 (Traceable provenance, volition [17]). Write Φ𝐸 for the atoms over 𝑅 ∪ 𝑋 ∪ 𝑌 and signed terms whose predicate is in 𝐸; a signed term sgn(𝑦, 𝜋) among the arguments of an atom counts as the two arguments 𝑦 and 𝜋. A set 𝐸 ⊆ Σ has traceable provenance in 𝐶 if for every schema 𝜏 of 𝐶 with roles 𝜋1, . . . , 𝜋𝑘 , every 𝑖, every 𝜑 ∈ +(𝑖) ∩ Φ𝐸 and every argument 𝑢 of 𝜑 in 𝑅 ∪ 𝑋 with 𝑢 ≠ 𝜋𝑖 , 𝑢 is a role of 𝜏 or an argument of some 𝜓 ∈ (=( 𝑗) ⊎ −( 𝑗)) ∩ Φ𝐸 , and every argument of 𝜑 in 𝑌 is an argument of such a 𝜓 or occurs in no atom required at a role of 𝜏; a predicate has traceable provenance if it belongs to such a set, and 𝐶 has it if the set of its predicates has it. The role graph of a schema is the undirected graph on its roles with an edge between 𝜋𝑖 and 𝜋 𝑗 when one of the two requires an atom of traceable provenance with the other among its arguments, and 𝐶 satisfies volition if every schema of it has a connected role graph or a guarding role in every connected component of its role graph. 𝐶 is syntactically grassroots if it has an unobstructed introductory act, traceable provenance and volition. Definition C.7 (Open, closed, polite [17]). A set 𝑅 of volitionguarded transactions is open if for any two agents 𝑝 ≠ 𝑞 in any 𝑄 ⊂ Π, every finite safe run of F (𝑄) with no interaction between 𝑝 and 𝑞 has a finite safe extension, by volition changes and transitions that are not interactions between 𝑝 and 𝑞, at whose end some transaction of 𝑅(𝑄) whose induced transitions are interactions between 𝑝 and 𝑞 is machine-enabled; closed if for every 𝑄 ⊂ Π, every transaction of 𝑅 enabled at the end of a finite safe run of F (𝑄) has

all its participants in one instance in that run or a guard in every instance in that run holding one of them; and polite if it is open and closed. The results of [17] used below, with 𝐶 a contract of that paper’s language, F the protocol realising it, 𝑄 ⊂ Π and 𝑟 a finite safe run of F (𝑄). Lemma C.8 ([17]). (1) Every participant changes state. Every transition of F (𝑄) induced by a transaction of 𝑅𝐶 changes the state of every participant of it. (2) A mutual recording is an interaction. Every transition of F (𝑄) induced by a mutual recording of 𝑝 and 𝑞 in 𝑅(𝑄) is an interaction between 𝑝 and 𝑞. (3) Containment. If 𝐶 has traceable provenance, 𝑅𝐶 is contained. (4) No edge crosses instances. If 𝐸 has traceable provenance in 𝐶, every edge of the 𝐸-recording graph of 𝑟 joins two agents that lie in one instance in 𝑟 . (5) Closure. If 𝐶 has traceable provenance and volition, 𝑅𝐶 is closed. (6) Openness. If 𝐶 has an unobstructed introductory act, 𝑅𝐶 is open. (7) Containment and closure. The protocol over a contained, closed set of volition-guarded transactions is oblivious, and the first interaction of two disjoint sets of agents in a safe run of it is induced by a transaction guarded by a member of each. (8) Polite. The protocol over a contained, polite set of volition-guarded transactions is volitionally grassroots. Parts 1, 2 and 7 are proved in [17] for every set of volitionguarded transactions, part 7 being the parts of the proof of its Theorem Polite headed Oblivious and Volitionally grassroots, which use containment and closure and not openness; parts 3 to 6 are proved there for a contract without reflexive predicates, and the next lemma extends them. Lemma C.9 (Reflexive predicates and signed terms). Parts 3 to 6 of Lemma C.8 hold for a contract declaring reflexive predicates and adding atoms with signed terms, with Definition C.5 in place of the definition of unobstructed of [17]. Proof. Each proof of [17] goes through with one case added, where an atom a role requires is, under the binding, the atom of a reflexive predicate naming the agent in that role, which 𝑑ˆ holds at every agent. Containment: an argument of an atom added, by traceable provenance an argument of an atom 𝜓 required at a role 𝜋 𝑗 , is 𝛽 (𝜋 𝑗 ) itself when 𝛽 (𝜓 ) is that atom, an agent of 𝑄. No edge crosses instances: for an argument 𝑠, or a speech-act variable 𝑦, of the added atom that is an argument of an atom 𝜓 required at a role 𝑗, with 𝑝 ′ := 𝛽 ( 𝑗), 𝛽 (𝜓 ) is the atom of a reflexive predicate naming 𝑝 ′ , and then 𝑞 = 𝑝 ′ , or an atom of the state of 𝑝 ′ , as there. Closure: the image of the atom of traceable provenance that 𝜋𝑖 requires naming 𝜋 𝑗 lies in the state of 𝑝 := 𝛽 (𝜋𝑖 ) or is the atom of a reflexive predicate naming 𝑝, and then 𝑞 = 𝑝 and the two lie in one instance. Openness: the extension of the run adds, at each role, every atom required there other than an atom of a reflexive predicate naming its holder, which 𝑑ˆ holds; by clause 3 of Definition C.5 no such atom is forbidden; and no schema adds or deletes at a role the atom of a reflexive predicate naming it, so the rest of the proof is unchanged. A signed term occurs only in an added atom, so openness and closure are untouched by it; Containment: an argument of an added atom that is (𝛽 (𝑦), 𝛽 (𝜋)) for a signed term is signed by 𝛽 (𝜋), an

Ehud Shapiro

agent of 𝑄, so the state stays in 𝑆𝐶 (𝑃); No edge crosses instances: where 𝑞 = 𝛽 (𝑠) for the role 𝑠 of a signed term among the added atom’s arguments, 𝑞 is a participant, joined to 𝑝 by an edge of the interaction graph. □

C.2

Guardianship, Leaving and Relay

Throughout, 𝑀 is a set of marks of 𝐶, and a schema deletes an atom at a role if the atom is marked − there or matches a cleared atom there [17]. Definition C.10 (Guardianship). A guardianship for 𝑀 in 𝐶 is (𝑚, 𝜄, 𝑔, 𝑤, 𝑣), with 𝑚 ∈ 𝑀 and 𝜄 marks and 𝑔, 𝑤 and 𝑣 predicates of arity one, 𝑣 possibly 𝑤, such that: (1) no schema of 𝐶 deletes 𝜄; a schema that adds or deletes a mark in 𝑀 does so at one role, and adds or deletes one mark there; and no schema clears an atom of 𝑔, of 𝑤 or of 𝑣; (2) a schema that adds 𝑚 at a role adds 𝜄 there and forbids 𝜄 there; (3) a schema adds, and deletes, 𝑚 at a role as many times as it adds, and deletes, atoms of 𝑔 there; (4) an atom 𝑔(𝑢) a schema adds at a role 𝜌 has 𝑢 a role 𝜎 ≠ 𝜌 of the schema at which the schema requires 𝜄, forbids every mark in 𝑀 and adds 𝑤 (𝜌); and a schema deletes 𝑔(𝑢) at 𝜌 if and only if it deletes 𝑤 (𝜌) at the role 𝑢; (5) a schema that adds 𝑤 (𝜌) at a role adds 𝑣 (𝜌) there; a schema that adds 𝑣 (𝜌) at a role requires 𝜄 there and forbids every mark in 𝑀 there; and a schema that deletes, at a role, 𝑣 (𝑢) for a role or an agent variable 𝑢 deletes or forbids 𝑤 (𝑢) there. The ward 𝑥 holds 𝑔(𝑎) of its creator 𝑎, who holds 𝑤 (𝑥); every guardian of 𝑥, the creator among them, holds 𝑣 (𝑥) (GnW:1 and GnW:2). For AI agents the marks are agent and identity, the predicates principal and principal_of , and 𝑣 is guardian_of : Enter adds agent, identity and principal(𝑝) at the AI agent, who had no identity, and principal_of (𝑟 ) and guardian_of (𝑟 ) at the principal 𝑝, who has one and is not an AI agent, and Make guardian adds guardian_of (𝑟 ) at another guardian (Appendix B). For children they are child and identity, the predicates creator and created, and 𝑣 is parenting, which every parent holds [43]. Lemma C.11 (Wards and guardians). Let 𝐶 have a guardianship for every mark in 𝑀 and (𝑚, 𝜄, 𝑔, 𝑤, 𝑣) be one of them. In every configuration of a run of the protocol realising 𝐶, an agent holds 𝑚 as many times as they hold atoms of 𝑔; an agent holding 𝑔(𝑎) holds 𝜄, while 𝑎 holds 𝑤 of them and 𝜄 and no mark in 𝑀; an agent holding 𝑤 (𝑥) holds 𝑣 (𝑥); and an agent holding 𝑣 (𝑥) holds 𝜄 and no mark in 𝑀. Proof. By induction on the run. The initial state is empty. A transition is induced by a transaction determined by a schema at a binding, and changes a state only by the atoms the schema adds and deletes there. Clause 3 keeps the counts of 𝑚 and of 𝑔-atoms equal at every role, and by clause 1 at every agent, as a schema adds or deletes them at one role. If the transition adds 𝑔(𝑎) at 𝑝 then by clause 3 it adds 𝑚 at 𝑝, by clause 2 it adds 𝜄 at 𝑝, and by clause 4 its schema has 𝑎 at a role requiring 𝜄 and forbidding every mark in 𝑀 and adds 𝑤 (𝑝) at 𝑎: so after it 𝑝 holds 𝜄, and 𝑎 holds 𝑤 (𝑝), 𝜄 and no mark in 𝑀. These persist: 𝜄 is never deleted (clause 1); a mark in 𝑀 is added at a role only where 𝜄 is forbidden (clause 2 of its guardianship), so an agent holding 𝜄 never gains one; and

𝑤 (𝑝) is deleted at 𝑎 only when 𝑔(𝑎) is deleted at 𝑝 (clause 4). By clause 5, a transition adding 𝑤 (𝑥) at an agent adds 𝑣 (𝑥) there, and one deleting 𝑣 (𝑥) there deletes 𝑤 (𝑥) or finds it absent, so an agent holding 𝑤 (𝑥) holds 𝑣 (𝑥); and a transition adding 𝑣 (𝑥) at an agent finds 𝜄 there and no mark in 𝑀, which persist as above. □ Definition C.12 (Leaving mark). Let 𝐶 have a guardianship for every mark in 𝑀. A mark ℓ ∉ 𝑀 is a leaving mark of 𝐶 if: (1) every guarding role of every schema of 𝐶 forbids ℓ, and no schema of 𝐶 deletes ℓ; (2) a schema that adds ℓ at a role requires a mark in 𝑀 there; (3) a schema that adds, at a role, an atom 𝑔(𝜎) of the guardianship of a mark in 𝑀 forbids ℓ at 𝜎. Retirement under GnW:5 is written with a leaving mark: the act by which the creator retires a ward adds it at the ward; here it is retired, added by Retire. Lemma C.13 (Leaving). Let 𝐶 have a guardianship for every mark in 𝑀 and ℓ be a leaving mark of 𝐶. In every configuration of a run of the protocol realising 𝐶, an agent holding ℓ has left; and if an agent holds 𝑔(𝑎) for the guardianship (𝑚, 𝜄, 𝑔, 𝑤, 𝑣) of a mark in 𝑀, then 𝑎 does not hold ℓ. Proof. No schema deletes ℓ (clause 1), so an agent holding ℓ holds it in every later configuration. A transaction (𝑡, 𝑄 ′ ) with that agent in 𝑄 ′ sends them a guarding role, which forbids ℓ (clause 1), so no such transaction is machine-enabled in a later configuration, and the agent has left. When an atom 𝑔(𝑎) is added at an agent, 𝑎 does not hold ℓ (clause 3), and the act adds none at 𝑎, whose role forbids every mark in 𝑀 (Definition C.10, clause 4; clause 2); and while an agent holds 𝑔(𝑎), 𝑎 holds no mark in 𝑀 (Lemma C.11), so no transition adds ℓ at 𝑎 (clause 2). □ Definition C.14 (Unobstructed but for marks). An introductory act 𝜏 of 𝐶 that adds one atom at each role, of a predicate 𝑒 of arity one, is unobstructed but for 𝑀 if at each role 𝜋𝑖 of 𝜏: (1) every atom 𝜏 requires at 𝜋𝑖 , other than an atom of a reflexive predicate naming 𝜋𝑖 , is, up to renaming the role, the one atom added by some schema of 𝐶 of arity one that is guarded in its role, requires nothing and forbids nothing but that atom and the leaving marks of 𝐶; (2) every atom 𝜏 forbids at 𝜋𝑖 is a mark in 𝑀 or a leaving mark of 𝐶. The act neither requires nor forbids an atom of 𝑒, so two agents may take it whether or not each holds 𝑒 of the other, and a local state, a multiset, counts the copies; an agent may hold 𝑒 of an agent they never dealt with, as GKK:3 introduces one agent to another. Acquaint, which forbids agent at each role and adds knows of the other there, is unobstructed but for {agent}: it requires identity, which Establish adds (Appendix B). Definition C.15 (Relay act). Let 𝐶 have a guardianship for every mark in 𝑀 and 𝜏 be an introductory act of 𝐶 unobstructed but for 𝑀, adding atoms of 𝑒. A schema 𝜒 of 𝐶 is a relay act with related roles 𝜌 1 ≠ 𝜌 2 , roles of it guarded in 𝜒 at each of which 𝜒 adds an atom of 𝑒 naming the other, if: (1) each related role 𝜌 is a ward role of some 𝑚 ∈ 𝑀, requiring 𝑚, with exactly one other role 𝜎 of 𝜒, its guardian role, requiring 𝑣 (𝜌), the 𝑣 of the guardianship of 𝑚, a guardian of the ward

Corralling AI Risks

(GnW:3 and GnW:4), or a free role, forbidding every mark in 𝑀; every role of 𝜒 is a related role or a guardian role; and 𝜒 adds and deletes at a guardian role no atom naming another guardian role; (2) every atom 𝜒 requires at a role is an atom of a reflexive predicate naming the role; or, up to renaming the role, the one atom of a schema of arity one as in clause 1 of Definition C.14; or, at a ward role, its 𝑚 or 𝑔(𝜎); or, at a ward role of 𝑚, an atom of a predicate ℎ whose arguments are distinct speech-act variables of 𝜒 occurring in no other atom 𝜒 requires but its record below, where every schema of 𝐶 that adds 𝑚 at a role 𝜌 adds there an atom of ℎ whose arguments are speech-act variables or signed terms, and adds its record, an atom of a predicate ℎ ′ whose arguments are 𝜌 and the arguments of that ℎ-atom, at the role at which it adds 𝑤 (𝜌); every other schema of 𝐶 that adds 𝑣 (𝜌) at a role requires a record ℎ ′ (𝜌, . . .) at a role at which it requires 𝑤 (𝜌), and adds that record where it adds 𝑣 (𝜌); and no schema of 𝐶 deletes an atom of ℎ or of ℎ ′ ; or, at the guardian role 𝜎 of a ward role 𝜌, the atom 𝑣 (𝜌) or 𝑤 (𝜌) of that guardianship, or the record, the atom of ℎ ′ whose arguments are 𝜌 and the arguments of the ℎ-atom 𝜌 requires; or, at a guardian role or a free role, 𝑒 (𝜅) for another guardian role or free role 𝜅, with 𝑒 reflexive where both are guardian roles; or, where 𝜒 has two ward roles, at the guardian role of one, 𝑒 of the other ward role (GnW:4); (3) every atom 𝜒 forbids at a role is a mark in 𝑀 or a leaving mark of 𝐶. A relay act is an act by which a ward and another agent come to know each other, with the guardian of each ward among them. Agent acquaint is a relay act with a ward role, the AI agent, a free role, the person, and a guardian of the AI agent as the guardian role, requiring at the AI agent the attestation its principal gave it on entering, an atom of ℎ in clause 2, and at the guardian its record, from which the guardian’s machine fills the request; Agents acquaint is one with two ward roles and their two guardian roles, the guardian of the one requiring knows of the other AI agent. In the child-safe social network a child and an adult come to know each other by a relay act with the child’s parent as the guardian role, requiring of the parent knows of the adult, and two children by one with two ward roles and their two parents, requiring of each parent knows of the other, which binds both parents to one person where the two children share one, knows being reflexive [43]. Befriending, which requires knows of the other at each role, is not a relay act in either contract. Definition C.16 (Introduction with wards). 𝐶 has an introduction with wards if it has a nonempty set 𝑀 of marks, a guardianship for each mark in 𝑀, an introductory act unobstructed but for 𝑀, and, for every 𝑚, 𝑚 ′ ∈ 𝑀, a relay act with a ward role of 𝑚 and a free role and a relay act with a ward role of 𝑚 and a ward role of 𝑚 ′ . Throughout the rest of this appendix 𝐶 is a contract with an introduction with wards, traceable provenance and volition, 𝑅𝐶 its realisation and F the protocol realising it. Definition C.17 (Open among the agents that have not left). A set 𝑅 of volition-guarded transactions is open among the agents that have not left if for any two agents 𝑝 ≠ 𝑞 in any 𝑄 ⊂ Π, every finite safe run of F (𝑄) with no interaction between 𝑝 and 𝑞, in whose last

configuration neither 𝑝 nor 𝑞 has left, has a finite safe extension, by volition changes and transitions that are not interactions between 𝑝 and 𝑞, at whose end some transaction of 𝑅(𝑄) whose induced transitions are interactions between 𝑝 and 𝑞 is machine-enabled. An open set is open among the agents that have not left. Proposition C.18 (Openness with wards). 𝑅𝐶 is open among the agents that have not left, and open if 𝐶 has no leaving mark. Proof. Let 𝑝 ≠ 𝑞 in 𝑄, let 𝑟 be a finite safe run of F (𝑄) with no interaction between 𝑝 and 𝑞, and let 𝑐 be its last configuration, at which, if 𝐶 has a leaving mark, neither 𝑝 nor 𝑞 has left; by Lemma C.13, neither holds a leaving mark at 𝑐. Call 𝑥 ∈ 𝑄 a ward at 𝑐 if its state holds a mark in 𝑀, which by Lemma C.11 is one mark 𝑚 and comes with 𝑔(𝑎) for some 𝑎, its creator, whom we take as its guardian, who holds 𝑤 (𝑥), 𝑣 (𝑥) and 𝜄 and no mark; otherwise 𝑥 is free. Two facts. First, the transition that added 𝑔(𝑎) at a ward 𝑥 was determined by a schema with 𝑎 in a role at which it added 𝑤 (𝑥) (Definition C.10, clause 4), so it changed both states (Lemma C.8(1)), left 𝑥 recording 𝑎, and was an interaction between 𝑥 and 𝑎; so the guardian of 𝑝, if 𝑝 is a ward, is not 𝑞, and that of 𝑞 is not 𝑝. Second, for free 𝑥 ≠ 𝑦 in 𝑄 holding no leaving mark, the introductory act 𝜏 at the introduction of 𝑥 and 𝑦 can be made machine-enabled by unary transitions at 𝑥 and at 𝑦: an atom 𝜏 requires that is absent is the one atom of a schema of arity one requiring nothing and forbidding nothing but that atom and the leaving marks, which is machineenabled, and adding it adds nothing 𝜏 forbids, as a schema of arity one requiring nothing adds no mark in 𝑀, such a mark being added only together with a 𝑔-atom naming another role (Definition C.10, clauses 3 and 4), and no leaving mark, which is added only where a mark in 𝑀 is required (Definition C.12, clause 2); and what 𝜏 forbids is a mark in 𝑀, absent at the free 𝑥 and 𝑦, or a leaving mark, absent at 𝑥 and 𝑦. Taking 𝜏 there, after volition changes of 𝑥 and 𝑦, leaves 𝑥 holding 𝑒 (𝑦) and 𝑦 holding 𝑒 (𝑥), and is an interaction between 𝑥 and 𝑦 and no others. If 𝑝 and 𝑞 are free, the second fact at 𝑥 := 𝑝 and 𝑦 := 𝑞 gives an extension by unary transitions after which 𝜏 at their introduction is machine-enabled, and every transaction it determines is a mutual recording of 𝑝 and 𝑞, so its transitions are interactions between 𝑝 and 𝑞 by Lemma C.8(2). Otherwise let 𝜒 be the relay act for the statuses of 𝑝 and 𝑞, bound with its ward roles to those of 𝑝 and 𝑞 that are wards, its free role to the free one, and the guardian role of each ward role to that ward’s guardian, and the speech-act variables of each atom of a predicate ℎ that 𝜒 requires at a ward role, as clause 2 of Definition C.15 admits, to the arguments of an atom of ℎ held by the ward bound there, which holds one: the transition that added its mark added one, and no transition deletes one; every transition that added 𝑣 of the ward at an agent added its record there, with the arguments of the ward’s ℎ-atom, and no transition deletes one, so the guardian holds it under the binding. The related roles are bound to distinct agents, and two guardian roles are bound to one person only where 𝑝 and 𝑞 share a guardian, which GnW:4 admits, Alice and Bob possibly one person, and Definition C.2 permits as the guardian roles add and delete nothing naming each other. Extend 𝑟 as follows, by transitions none of which is an interaction between 𝑝 and 𝑞: for every atom 𝜒 requires at a role that is the one atom of a schema of arity one and is absent at the agent bound there, the unary transition adding it,

Ehud Shapiro

machine-enabled as above; and for every 𝑒 (𝜅) required at a guardian role or free role bound to 𝑥, with 𝜅 bound to 𝑦 ≠ 𝑥, where 𝑥 does not hold 𝑒 (𝑦), the unary transitions and the transaction of 𝜏 at the introduction of 𝑥 and 𝑦 by the second fact, 𝑥 and 𝑦 being free by Lemma C.11, holding no leaving mark, as 𝑝 and 𝑞 hold none and a guardian holds none by Lemma C.13, and {𝑥, 𝑦} ≠ {𝑝, 𝑞}, since a guardian is bound only where its ward is one of 𝑝 and 𝑞, and is not the other by the first fact; and, where 𝜒 has two ward roles, for 𝑒 (𝜅) required at the guardian role bound to 𝑥, with 𝜅 the other ward role, bound to the ward 𝑦, whose guardian is 𝑏, where 𝑥 does not hold 𝑒 (𝑦): first 𝑒 (𝑏) at 𝑥, as above, and then the relay act with ward role 𝑦, free role 𝑥 and guardian role 𝑏, made machine-enabled as in this paragraph, its 𝑒-atoms being between free agents, which leaves 𝑥 holding 𝑒 (𝑦) and is no interaction between 𝑝 and 𝑞, 𝑥 being neither. At the end 𝜒 is machine-enabled: a reflexive atom naming its holder ˆ the unary atoms are present; a ward role bound to 𝑝 has 𝑚, is in 𝑑; 𝑔(𝑎) and the atom of ℎ its variables are bound to at 𝑝; a guardian role bound to 𝑎 has 𝑤 and 𝑣 of its ward, by Lemma C.11, and the record of its ward’s ℎ-atom at 𝑎; 𝑒 (𝜅) at a role bound to 𝑥 with 𝜅 bound to 𝑦 holds by the extension where 𝑦 ≠ 𝑥 and by reflexivity where 𝑦 = 𝑥; a mark in 𝑀 that 𝜒 forbids is absent at the free agents and at the guardians, by Lemma C.11, and a leaving mark is absent at 𝑝, at 𝑞 and at the guardians, by Lemma C.13. Every transaction 𝜒 determines there leaves 𝑝 holding an atom naming 𝑞 and 𝑞 one naming 𝑝, changing both states, so each records the other after it, the transition restricted to 𝑝 is no transition of F ({𝑝}), and it is an interaction between 𝑝 and 𝑞. □ Theorem C.19 (Polite among the agents that have not left). The protocol over a contained set of volition-guarded transactions that is closed and open among the agents that have not left is volitionally grassroots. Proof. Let 𝑅 be such a set and F the protocol over it. By Lemma C.8(7) F is oblivious, and the first interaction of two disjoint sets of agents in a safe run is induced by a transaction guarded by a member of each. Let 𝑄 ⊂ Π, let 𝑃, 𝑃 ′ ⊆ 𝑄 be disjoint and nonempty, and let 𝑟ˆ be a prefix of a correct run of F (𝑄) containing no interaction between 𝑃 and 𝑃 ′ , in whose last configuration 𝑝 ∈ 𝑃 and 𝑞 ∈ 𝑃 ′ have not left. By Definition C.17 some finite safe extension of 𝑟ˆ, by volition changes and transitions that are not interactions between 𝑝 and 𝑞, ends where some (𝑡, 𝑄 ′ ) ∈ 𝑅(𝑄) whose induced transitions are interactions between 𝑝 and 𝑞 is machine-enabled. If a transition of the extension is an interaction between 𝑃 and 𝑃 ′ , the extension contains one. Otherwise extend it by a volition change of each agent of 𝑄 ′ , where needed, so that [𝑡] lies in the volitional state of each, and by the volitional machine transaction that (𝑡, 𝑄 ′ ) then induces, an interaction between 𝑝 and 𝑞 and hence between 𝑃 and 𝑃 ′ . Either way the result is a finite safe run of F (𝑄) having 𝑟ˆ as a prefix and containing an interaction between 𝑃 and 𝑃 ′ , and by Lemma Extension of [26] it is a prefix of a correct run of F (𝑄). So F is interactive among the agents that have not left, and volitionally grassroots. □ Theorem C.20 (Grassroots realisation with wards). The protocol realising a contract with an introduction with wards, traceable provenance and volition is volitionally grassroots.

Proof. By Proposition C.18 𝑅𝐶 is open among the agents that have not left. The proof of closure (Lemma C.8(5)) uses traceable provenance and volition and nothing of the introductory act, so 𝑅𝐶 is closed, and by Lemma C.8(3), whose proof uses traceable provenance only, it is contained; both hold with reflexive predicates by Lemma C.9. By Theorem C.19 the protocol over 𝑅𝐶 is volitionally grassroots. □ Where 𝐶 has no leaving mark, 𝑅𝐶 is open by Proposition C.18, hence polite, and by Lemma C.8(8) the protocol realising 𝐶 is grassroots as well. A contract with wards whose groups are closed by a listed role of their members, as the child-safe social network’s are, is certified by composing this appendix with the agent-named contracts of [17], in [43].

C.3

The Contracts Certified

The social network with provenance (Section 4) is written as speech-act schemas in the repository, programs/gai/GSNP.glp: the schemas of the contract of Section 3 (Appendix B), with message and forward; and the schemas of a group, which name a group by its leader and a number and close it by a listed role, the leader with every member the leader lists, as the agent-named contracts of [17]; create and join forbid the mark of an AI agent, so an AI agent takes no group act, the ward’s membership of GnW:3 being left out (Section 3.2). Proposition C.21 (The social network with provenance is grassroots). The protocol realising GSNP is volitionally grassroots. Proof. The contract holds the schemas of the contract of Section 3 with message, forward and the schemas of a group. It has an introduction with wards exactly as in the proof of Proposition C.22: the marks 𝑀 = {agent}, the guardianship (agent, identity, principal, principal_of , guardian_of ), the leaving mark retired, forbidden at every guarding role, the group schemas’ among them, acquaint the introductory act unobstructed but for 𝑀, and agent_acquaint and agents_acquaint the relay acts. The set of all the predicates has traceable provenance: the schemas of Section 3’s contract as in the proof of Proposition C.22; message adds item(𝑥) at Bob, whose speech-act variable the required authored (𝑥) carries; forward adds item(sgn(𝑥, Alice)) at Bob, whose arguments are the role Alice of the signed term and the speech-act variable 𝑥, which the required item(𝑥) carries; and of the schemas of a group, create adds atoms whose arguments are its role, the name based on it and a speech-act variable it requires nowhere, join, close, post, post_own, post_forward, deliver and deliver_own add atoms whose arguments are roles, the roles of signed terms, that name and speech-act variables an agent role of the schema requires, and leave and remove add nothing, and unfriend adds nothing and clears memberships. Volition holds: the schemas of Section 3’s contract as in the proof of Proposition C.22; the role Alice of message and of forward requires friend (Bob), an atom of traceable provenance naming the other role; join is guarded in both its roles, the two roles of close have the base Alice, create and post_own have arity one, and the role Alice of leave, remove, deliver and deliver_own requires listed (Bob, 𝑛) and the role Bob of post and post_forward requires member (⟨Alice⟩ · 𝑛), each an atom of traceable provenance an argument of which has

Corralling AI Risks

the base of the other role. Every name term is based on the role Alice and the listed roles of close and retire add no atom, so the contract is agent-named in the sense of [17], with signed terms by Lemma C.9, and it has an introduction with wards; the protocol realising it is volitionally grassroots by composing Theorem C.20 with that paper’s Theorem Grassroots realisation with listed roles, the composition in [43]. □ Proposition C.22 (Grassroots). The protocol realising the contract (Appendix B) is volitionally grassroots. The contract is not syntactically grassroots: Acquaint forbids agent, which Enter adds at the AI agent by an act of the AI agent and its principal, so for an AI agent and an agent other than its principal clause 2 of Definition C.5 fails, and Befriend requires knows of the other, which no schema of arity one adds; the contract has no unobstructed introductory act. It has an introduction with wards, with the AI agents as its wards and retired as a leaving mark, forbidden at every guard, and the proof is by Theorem C.20. Proof. The contract has an introduction with wards (Definition C.16), traceable provenance and volition (Definition C.6), and the listed roles of retire, whose base is the AI agent, so the protocol realising it is volitionally grassroots by Theorem C.20 composed with Theorem Grassroots realisation with listed roles of [17], as in [43]. The marks are 𝑀 = {agent}, and (agent, identity, principal, principal_of , guardian_of ) is a guardianship for agent (Definition C.10): no schema deletes identity, agent, principal or principal_of ; enter, the one schema adding agent, adds it with identity and principal(𝑝) at the AI agent, where it forbids identity, and adds principal_of (𝑟 ) and guardian_of (𝑟 ) at 𝑝, where it requires identity and forbids agent; make_guardian adds guardian_of (𝑟 ) at a role where it requires identity and forbids agent; and end_guardian, resign, guardian_unfriend and the listed role 𝑟 [guarded_by(∗)] of retire, which delete guardian_of (𝑟 ), forbid principal_of (𝑟 ) there, so clause 5 holds. The mark retired is a leaving mark (Definition C.12): every guarding role forbids it, no schema deletes it, retire adds it at a role requiring agent, and enter forbids it at 𝑝. acquaint is an introductory act unobstructed but for 𝑀 (Definition C.14): it requires identity, the one atom of establish, which requires nothing and forbids nothing but the identity it adds and retired; and it forbids agent and retired. agent_acquaint is a relay act (Definition C.15) with the AI agent’s role a ward role, the person’s role a free role and a guardian’s role its guardian role, and agents_acquaint one with two ward roles and their two guardian roles; neither adds or deletes anything at a guardian role, and each forbids only agent and retired. At a ward role each requires identity, agent and attestation(𝑦), and at the guardian role guardian_of of the ward, the record agent_of (𝑟, 𝑦) and knows of the free role, or, in agents_acquaint, of the other guardian role and of the other ward role, as clause 2 of Definition C.15 admits: enter, the one schema adding agent, adds the atom of attestation at the AI agent and its record at the principal, make_guardian, the other schema adding guardian_of (𝑟 ), adds the record at the new guardian and requires it at the principal, and no schema deletes either. Every atom a schema adds names only roles of that schema, speech acts a role of it requires or no role of it requires, and, in introduce, an agent

variable of an atom required at a role: enter adds attestation(𝑦) and agent_of (𝑟, 𝑦) with authored (𝑦) required at 𝑝; make_guardian, agent_acquaint and agents_acquaint add agent_of (𝑟, 𝑦) with agent_of (𝑟, 𝑦) or attestation(𝑦) required at a role; and sign adds item(𝑥) and authored (𝑥), 𝑥 required at no role: the contract has traceable provenance. In every schema the roles are joined by required atoms naming one another, or a guard stands in each part, and the listed roles of retire have the base of its role 𝑟 : the contract satisfies volition. □

Related documents

• AI risk: structuring the debate#385817
• Architecting Liberty: Recursive Freedom in the Age of Digital Concentration#1505111
• Why we need an AI-resilient society#128239
• Responsible and Trusted AI: An Interdisciplinary Perspective (2026)#1317916
• Responsibility for AI Inventions#99999