Design the rules, not the agent.

The design problem moved up a floor.

For three years the frontier was model quality, then harness quality: tools, memory, retries, context. Both are now good enough that the binding constraint sits above them. The new design object is the institution, the standing rules a population of agents works under. Swap the model and the rules remain. Change the rules and the same model behaves differently.

A layer-3 failure can't be fixed at layer 1. A better model that does slightly more than you asked, faster, across more systems, is a bigger institutional problem, not a smaller one.

A rule without an enforcer is a costume.

This is the line between institutional engineering and writing policy. A rule in a prompt, a style guide or an acceptable-use PDF is a request. A rule checked by something that can reject the work is a constraint. They look the same in a spec. They behave nothing alike under load.

Never publish a claim
without a cited source.

REJECT if a quantity is present
and a citation is absent
→ return to author with the rule

Evidence

In the Institutional AI study, an enforced institution with a keyed append-only log cut severe collusion from 50% to 5.6% of runs (90 runs per condition). The same rules as a prompt-only constitution gave no reliable improvement.

Who fails

DeepMind's review of roughly a million coding-agent tasks found most flagged events came from misreading or overeagerness, not malice. Design the gate for the eager agent first. It tends to catch the hostile one too.

Limit

A gate is not proof against prompt injection. Rules written as command-text fences can be bypassed through indirection and encoding. The strong case is a gate on the artifact as it crosses a boundary, checked by code the agent cannot edit.

Detection is not enforcement.

Detection still has a place. It is legitimate when it is declared non-blocking and routed to something obligated to act, with the severity of the finding choosing who that is. A check that notices and tells nobody in particular is decoration.

The first boundary is the environment, not the model.

The largest labs and the protocol bodies they steer are converging. Containment starts in the execution environment. The harness is versioned, tested code. Autonomy is becoming a structured object a machine can check. Identity and authority are moving to per-agent signatures and chains of signed mandates. The protocol texts, meanwhile, leave enforcement to whoever implements them.

Figures as reported in hosaka's October 2026 landscape note, which read the lab documents directly. Some OpenAI material was read through mirrors with unverified dates. One more number from the same note: under 1% of agent configuration files declare permission boundaries, against 33% of GitHub Actions workflows.

Six things a permission list can't express.

A permission is a yes or no on one action by one actor. It is necessary and nowhere near sufficient. The institution is everything a permission list has no grammar for.

Human institutions already solve this, and they lack one axis.

The AGI Institutions wiki maps existing human institutions on two axes: seven mechanism types and five scales, from two parties to the whole world. It is a useful catalogue of patterns to borrow. What it doesn't record is whether a mechanism is merely stated, monitored, or enforced, and for agents that is the axis that decides whether it works.

Mechanism types and examples from the AGI Institutions wiki's “Existing human institutions” grid. The right-hand column is ours.

Every company already has an institution, written in prose.

It sits in a delegation-of-authority matrix, an employee handbook, a legal opinion from 2019, licence conditions and a strategy deck nobody reopens. None of it is executable. The first real job is policy compilation: turning rules that live in documents and in reviewers' heads into checks a machine can run, each traced back to the clause it came from.

Autonomy is granted in bands, not switched on.

The useful frame isn't autonomy against oversight. Each class of decision sits on a band and moves up only on measured evidence. Different parts of the same business will sit on different bands for years, and that is correct, not untidy.

1. ObserveThe agent watches and nothing leaves the building. The point is a baseline error rate on your own work, not the vendor's benchmark.
2. ProposeThe agent drafts and a person reviews every item in full. Slow by design. This is where the disagreement data comes from.
3. Act on approvalThe agent acts once a named person approves. The decision arrives framed, so the reviewer decides rather than drafts.
4. Act with samplingThe agent acts and a sample is reviewed afterwards. The sample rate is now the control, and lowering it is a decision with a name on it.
5. Act under auditOnly exceptions and breaches reach a person. The gates carry the load, so they had better be able to reject.

Someone's name is on every decision class.

Every agent action has to trace to a person who carries the legal risk, in a named jurisdiction, under a named instrument: the liability anchor. If you can't name one for a decision class, that class isn't ready for any band above Propose. The anchor isn't whoever is nearest. Advertising liability doesn't move to the engineers who built the marketing agent.

Rows are illustrative, to show the shape of the artifact. Confirm the instruments with counsel in every jurisdiction you operate in.

Shape is not authority.

Hounfour (loa-hounfour) is an open, schema-only protocol library that one agent fleet uses as its wire format for identity, money, reputation, governance and memory. It is a clear example of a split every institution needs: the library ships shape, and the systems that use it ship authority.

Four invariants

Valid JSON is not an authorised action. A valid signature doesn't establish the signer's competence. A valid action shape doesn't permit a change. A valid object is not current truth.

Three verdicts

Checks return conserved, violated or unverifiable, and unverifiable never counts as passing. Money is integers, and balances must reconcile.

Typed obligations

Rules the library can state but not enforce are handed to a named consumer in a manifest of checks still owed, instead of being dropped.

Agreement

Reference runners in TypeScript, Go, Python and Rust must return identical verdicts on a shared corpus of test vectors, or the release is blocked.

Honest gaps

It has no enforcer of its own and no point where an action can be blocked before it happens, and one agent can't halt another through it. Its maintainers say so, and call the result a whistleblower without an enforcer.

From the Hounfour protocol page and hosaka's October 2026 landscape note, at version 8.7.0. The fit ratings in that note are self-assessed by the library's maintainers.

Almost every mechanism here is an interface.

This isn't a topic that lands only on legal's desk. Most of these mechanisms surface as screens, and most are badly designed today because nobody treated them as design problems.

What nobody has solved yet.

Compiling above the repo

When the source clause is a licence condition rather than a code rule, what does the compile pass look like, and who owns the trace from rule to clause to person?

Standing between agents

Which primitive could let one agent halt another mid-flight, without putting a second model in the loop?

Calibration at scale

Confidence floors need outcome data. Gate rejection records, each tied to its rule, are one half of the evidence. Calibration curves scored against outcomes are the other.

Memory across organisations

One owner per fact works inside one fleet. What does provenance look like when the writer and the reader belong to different institutions?

Oversight as work

Approval steps without time or material give only the appearance of oversight. What does an approver need, and who pays for their time?

Nothing published yet reports a production deployment at the scale this primer describes. The institutional papers are preprints and simulations, and the swarm result has one experiment behind it. Treat the direction as well argued and the specifics as unsettled.

What this primer draws on.