In this monograph, artificial organizations are organizations in which software agents perform a material share of the work and coordination while people retain legal and moral responsibility. The ambitious form is an organization whose workers and middle managers are predominantly software agents, governed by people through objectives, roles, delegated authority, policies, decisions, and evidence rather than through a stream of prompts.

An existing term, a stated working definition. This book does not coin "artificial organization." The phrase appears in Ye and Carley's 1995 RADAR-Soar paper and Drogoul and Collinot's 1998 robotic-soccer study; Waites uses Artificial Organisations as the title of a 2026 LLM-system preprint [Ye and Carley 1995; Drogoul and Collinot 1998; Waites 2026]. These uses establish a history, not one universally accepted definition. The more established research traditions include multi-agent systems, agent organizations, organization-oriented MAS, and computational organization theory. This monograph brings their questions together with organization science and LLM-agent engineering. Its emphasis on durable responsibilities, governed work, and human accountability is an explicit working scope, not a claim that every earlier use of the term meant an autonomous business or met these requirements.

This study has two purposes. It explains the field, and it develops a method for building systems from its techniques without mistaking a collection of agents for an organization. Its central conclusion is:

The evidence base combines organization science, human factors, concurrent and distributed-systems coordination, classical multi-agent systems (MAS), contemporary LLM-agent research, and official standards. Grouped references and topic-specific research routes let readers trace the argument to its sources without access to any private project or supporting workspace.

Anatomy of the book

The map connects the parts of an artificial organization to their chapters. Follow the arrows for the principal relationships; select a part to read about it. Printed page references lead to the same destinations. This is a reading map, not a prescribed hierarchy or a claim that every organization needs a separate department for each function.

Four ways to read this book

The main text carries the argument. Key concept boxes highlight distinctions; Design implication and Caution identify choices and limits. Example, Practice note, and Biography boxes offer illustrations, short guidance, and cultural context. More detail develops the reasoning in depth.

Source specimens sit beside their methods; reading maps are editorial syntheses. Verification limits accompany the individual examples. Further afield closes each substantive chapter with annotated research from other disciplines; proposed transfers remain exploratory. Use bookmarks for navigation and the glossary-index for definitions and principal discussions.

Evidence key

Claims are marked when their status matters:

• [Established] an empirical result within its documented study conditions, a formal result under stated assumptions, an authoritative standard, or a well-supported historical account. Independent replication is not implied unless explicitly identified.
• [Heuristic] practical engineering convention supported by experience or theory but not established as generally optimal.
• [Disputed] credible evidence or scholarly positions conflict.
• [Open] no satisfactory answer or adequate evidence is known.

Formal results retain their assumptions. Vendor documentation defines or advertises interfaces; verify availability, deployed behavior, and outcomes separately. Leaderboard values are dated because performance and evaluation conditions change.

Table of contents

1.1 A working definition

An agent is a computational system that observes some state, chooses actions, and acts toward goals with some degree of autonomy. An LLM agent commonly adds a model-driven loop around tools, memory, and an environment. A multi-agent system contains multiple interacting agents. An artificial organization is more specific: it gives agents durable positions in a system of purpose, division of labor, authority, obligation, coordination, and accountability.

The distinction concerns institutional structure, not the label attached to a system. The following components can participate in an artificial organization, but none supplies all of its requirements by itself:

Artificial describes the worker and coordination substrate, not a new legal status. A company using agents remains subject to the laws and responsibilities that apply to its human and legal actors. Internal delegation cannot make legal accountability disappear [European Union 2024].

The recommendations chiefly concern digital work with inspectable records and controllable action boundaries. Robotics and sector-specific legal compliance require additional specialist knowledge. This is a critical synthesis of design alternatives, not a claim that one architecture has been proved optimal.

1.2 What problems does the field address?

The field begins where adding another capable agent stops being the main problem. It asks:

1. Purpose: How does high-level intent become accountable work?
2. Division of labor: Which role owns which mission, and can roles survive replacement of their occupants?
3. Coordination: Which dependencies require communication, synchronization, or shared state?
4. Authority: Which actions may be selected or executed, by whom, within what scope and budget?
5. Attention: Which exceptions deserve scarce human judgment?
6. Governance: How are norms created, applied, changed, violated, and repaired?
7. Epistemics: What is known, how well is it supported, and what does silence mean?
8. Accountability: What happened, why was it allowed, and was the intended outcome actually achieved?
9. Adaptation: How does the organization learn, forget, restaff, or reorganize without losing obligations?

Bounded rationalityAdjacent fields contribute different pieces. Organization science explains bounded rationality, hierarchy, incentives, routines, and failure. Human factors studies automation, interruption, trust, and supervisory control. Classical MAS formalizes roles, norms, commitments, teamwork, and institutions. Distributed systems supply durable execution, identity, messaging, retries, and consistency. AI safety and governance contribute threat models, evaluation, and controls. Current LLM-agent engineering supplies flexible workers and lowers the cost of drafting natural-language specifications, while leaving validation necessary.

A2AThese traditions have not always developed together. A consequential gap in the use of earlier research arises when an older distinction is lost behind familiar terminology. Classical MAS treated roles, directed commitments, interaction rules, and institutional state as explicit design objects decades before LLMs. A modern agent's role description or a protocol's task status can resemble those objects without carrying their semantics. For example, MOISE, an organizational model, represents duties connecting roles to missions. Agent2Agent (A2A), a protocol for communication between agents, represents the progress of exchanged tasks. Those objects answer different questions [Hübner et al. 2002b; A2A 2026]. When an application needs both but represents only the latter, it must recover the missing organizational contract elsewhere.

Chapter 15 asks which earlier ideas remain useful, where contemporary systems already implement them, and what is lost when they are omitted. It compares records, transitions, and failure handling across dated sources, recognizing both the contributions of LLM systems and the limits of older approaches.

1.3 Starting concepts and reading prerequisites

The main argument assumes familiarity with ordinary software systems, but no prior training in organization science or multi-agent systems.

Later chapters introduce additional ideas from concurrency, distributed systems, probability, and formal reasoning. Readers can follow the conceptual discussion without mastering every technical detail; the implementation examples and quantitative sections require closer attention to their notation and assumptions. Building a dependable system requires practical engineering knowledge beyond the concepts introduced here.

Concept reference — the institutional vocabulary. These distinctions recur throughout the book. The concrete records describe implementation requirements; the vocabulary synthesizes organization-oriented MAS and institutional theory [Ferber and Gutknecht 1998; Hübner et al. 2002a; Jones and Sergot 1996].

Signal detection · PPV
Regimentation / enforcementTerms such as role, commitment, regimentation, and positive predictive value are introduced where they become useful.

Examples in this book have different jobs. Public incidents make failures of meaning, responsibility, and recovery visible; studies and working practices show how decisions are arranged; technical specimens expose mechanisms. This chapter supplies enough context to recognize the examples when they appear. Their detailed analysis belongs beside the concept they explain.

The four incidents below recur because each makes a useful distinction, not because they are more important than the factory, TVA, or other studies. They concern organizations using technology, not four deployed LLM organizations. Their public accounts support the reported facts; proposed agent-assisted responses remain this book's recommendations, not demonstrated improvements. Monetary figures are US dollars unless another currency is explicitly identified.

The question is shared meaning: what demonstrates that two teams interpret a transferred value the same way? Section 4.6 develops the distinction between delivering information and preserving the meaning and checks it requires.

The question is responsibility for a public answer: a correct policy page elsewhere does not necessarily repair misleading advice. Chapters 8–10 return to institutional effects, evidence, and challenged inferences. The decision is fact- and jurisdiction-specific; it neither identifies an LLM architecture nor establishes that every chatbot utterance changes policy or creates a contract.

The question is demonstrated recoverability, not merely whether a backup procedure exists. Section 12.2 diagrams the recovery dependencies; Section 14.4 connects ownership, restoration, and permanent loss alongside five other examples.

The question is effective control: detection, timely intervention, and enforced exposure limits are different mechanisms. Chapters 4, 12, 14, and 15 use the incident to distinguish fast execution from appropriately controlled work.

A guide to the other examples

The later examples serve different questions. Read a practice as a documented arrangement, a study as evidence under stated conditions, and a specimen as an inspectable mechanism. None demonstrates organizational success by itself.

Real cases show how several problems interact. To understand one mechanism at a time, the book also uses thought experiments, worked calculations, and proposed tests. A calculation can show how false alarms accumulate; a test can reveal whether a duty survives replacement of its worker. These simplified examples help explain what to look for in practice. They are identified as illustrations or tests so that their lessons are not mistaken for observed results.

The opening anatomy map locates the main parts of an artificial organization. Here the question changes from what the parts are to which technique fits the problem. These are complementary concerns, not a compulsory stack: a workflow, a role model, and an evidence record can solve different parts of the same problem without becoming separate departments.

The “simpler alternative” column matters. If one competent worker or a deterministic workflow can perform a bounded task, additional managers and committees need a demonstrated benefit. Simpler execution still belongs to an organization: the applicable authority, evidence, and accountability requirements do not disappear when the task needs only one worker. Chapter 4 examines this cost comparison; Chapters 13 and 16 turn it into implementation and evaluation questions.

3.1 A historical spine, not a succession of replacements

Linda / tuple spaces
Communicating sequential processesConcurrent-systems coordination is a foundation, not merely an implementation detail. CSP specifies synchronized communication; Linda supplies associative shared-space operations; later work examines failure, agreement, and convergence [Hoare 1978; Gelernter 1985; Gelernter and Carriero 1992; Hellerstein and Alvaro 2019]. A mission states an institutional requirement; the substrate determines which concurrent transitions occur. Chapter 6 connects them; the Coordination research report provides the deeper comparison and source-access ledger.

The historical strands below address complementary problems. Organization science examines how people divide decisions and work; agent research develops computational models of collaboration; concurrent systems determine what happens when operations overlap or participants fail. LLMs broaden what individual workers can interpret without retiring those questions.

From explanation to construction. Chapter 4 first asks whether organization repays its cost. Chapters 5–8 develop its institutional mechanisms; Chapters 9–11 examine evidence, decisions, and learning. Chapters 12–14 put these ideas to work through infrastructure choices, a construction method, and six integrated examples without privileging one setting. The closing chapters compare historical and contemporary approaches, identify open questions, and draw the argument together. A role model, an outcome test, and an authority check remain distinct throughout: each contributes something the others cannot establish.

Organization can make work possible by dividing a difficult task, concentrating expertise and bringing separate resources into cooperation. It must also reconnect the parts: decisions interact, information is lost at handoffs, and participants have interests of their own. This chapter moves from those gains and mechanisms to three practical comparisons: joint planning in a paint factory, local reach through TVA's partners, and ownership versus contracting in coal supply. It then asks when one capable worker or a simpler workflow is enough.

4.1 Bounded rationality and information compression

Bounded rationalityHerbert Simon's bounded rationality rejects the assumption that decision makers have complete information and unlimited computation. His later formal model develops search using aspiration levels: an acceptable option can end search without establishing a global optimum [Simon 1947, 1955]. Agents are also bounded by context, model capability, latency, cost, and incomplete access.

Biography — Herbert A. Simon (1916–2001).

Simon connected the study of organizations with psychology, economics, and computing. Trained in political science at the University of Chicago, he spent most of his career at Carnegie Mellon. His question was how people actually decide when time, knowledge, and attention are limited, rather than how an all-knowing optimizer would choose.

Administrative Behavior and his work on bounded rationality made those limits central to organization theory. With Allen Newell and J. C. Shaw he helped develop early artificial-intelligence programs, including the Logic Theorist. He shared the 1975 Turing Award with Newell and received the 1978 economics prize. His career is a reminder that organization theory and AI have a shared intellectual history, not merely a recent practical connection.5. Hunter Heyck, “Herbert Alexander Simon,” ACM A. M. Turing Award biography, inspected 16 September 2026. https://amturing.acm.org/award_winners/simon_1031467.cfm.

Portrait credit.

Knowledge hierarchies
Processing delayOrganization is partly an information-processing response. Radner and Bolton & Dewatripont modeled hierarchies as communication networks; Garicano modeled a knowledge hierarchy in which routine problems stay with production workers and exceptions move to scarce experts [Radner 1993; Bolton and Dewatripont 1994; Garicano 2000]. [Established under model assumptions] Hierarchy can economize on communication and specialized knowledge.

4.2 Information processing: five complementary explanations

The computational counterpart is factorization: represent a large decision through smaller, interacting parts. Guestrin, Koller and Parr use factored dynamics and an approximate factored value function to coordinate a multiagent system [Guestrin et al. 2001]. Their method also serves single-agent planning. Thus, good decomposition can make a team effective without making agent count the explanation of the gain.

The practical question is which decisions a worker can handle locally and which dependencies must remain visible to the rest of the system. Kiva's warehouse robots provide a deployed example: they divided the physical work of retrieving stock, while coordination and shared information kept the fleet useful as a whole.

Kiva makes local work, shared knowledge and coupled action tangible. It does not establish an exact factorization of warehouse performance or prove that a fully decentralized planner beats a central one. For an artificial organization, the corresponding questions are concrete: which work can proceed separately, which discoveries should be shared, and which resource conflicts still require a common decision? The paint factory later in this chapter shows why treating coupled decisions as independent can produce the wrong answer.

Where the formulas belong. In a specified discrete optimization model, $N$ decisions with $M$ options have $M^N$ complete combinations. Independent additive choices can be optimized in $O(NM)$ work; pairwise tree interactions permit $O(NM^2)$ dynamic programming. More general interaction patterns depend on induced width, the largest dependency scope created during elimination [Dechter 1999; Fioretto et al. 2018]. These are conditional algorithmic results, not measured costs of the Kiva fleet or laws about LLM teams. The deployment illustrates why useful decomposition must preserve coordination, while the formal literature specifies when decomposition gives exact computational savings.

Uncertainty absorptionMarch and Simon's uncertainty absorption shifts attention from system boundaries to communication [March and Simon 1958]. When a summary replaces its underlying observations, preserve the assumptions, exclusions, and contrary evidence needed to challenge the inference without forwarding every record.

Information-processing designGalbraith links organizational design to the information that must be processed during uncertain tasks [Galbraith 1973]. There are two broad responses: reduce information-processing need or increase processing capacity. Slack resources and more self-contained tasks reduce the need for continual adjustment. Vertical information systems and lateral relationships increase the capacity to handle it. This is a design framework, not a calibrated formula in which uncertainty and interdependence have universal numerical coefficients.

Task interdependenceThompson distinguishes pooled, sequential, and reciprocal interdependence [Thompson 1967]. Units with pooled interdependence share a larger enterprise or resource base without consuming each other's outputs directly; standardization can help. Sequential work benefits from plans and schedules. Reciprocal work requires mutual adjustment as participants alter each other's inputs. These are characteristic coordination needs, not guarantees that a single mechanism will always suffice.

Coordination mechanismsMintzberg's coordination mechanisms cut across those dependencies: mutual adjustment, direct supervision, and standardization of work processes, outputs, or skills [Mintzberg 1979]. For artificial organizations, distinguish checking a procedure, checking an output, and checking a worker's demonstrated competence. They provide different kinds of assurance. A role description that says “expert” is not the equivalent of professional training or a capability evaluation.

4.3 Specialization, parallel capacity, and local agency

Decomposition makes work manageable; distributing it can supply resources and knowledge that a single worker lacks. Stone and Veloso identify parallelism, geographic distribution, specialized capabilities, modularity and robustness as reasons to use multiple agents [Stone and Veloso 2000, Section 2]. In human organizations, acquiring expertise takes time and people cannot work in two places at once. Artificial workers change those costs, but still operate with limited context, tool access, computation and time.

Knowledge hierarchiesSpecialization conserves scarce capability. Garicano's knowledge hierarchy reserves expertise for unfamiliar problems; Bolton and Dewatripont explain how specialization gains compete with communication costs [Garicano 2000; Bolton and Dewatripont 1994]. In an agent system, a specialist may have a trained model, restricted tools or a focused working history. A job title alone supplies none of these. The useful test is whether the specialist performs its contribution better or more economically, including the handoff.

Parallel work increases capacity when contributions can proceed separately. Several researchers can investigate different sources while an integrator compares their findings. For LLM agents, separation can also determine which search results and intermediate reasoning remain in each working context. Anthropic reports a concrete task on which that arrangement outperformed its single-agent research baseline [Hadfield et al. 2025].

The warehouse and research cases justify separation differently: robots add physical capacity, whereas LLM researchers add concurrent, focused investigations. Both still need integration. Tightly interdependent work may spend the saved time on coordination [Thompson 1967; Kim et al. 2026].

AutoGenEqual access does not mean equal attention. Suppose every LLM worker may read the same files and use the same tools. Their active contexts can still differ: one investigates a narrow question, while another checks a result without the history that led its author to favor it. This supplies no new knowledge or independent authority. It changes what a bounded model must attend to on a particular call. AutoGen's OptiGuide study provides a closer comparison of that kind of separation than the warehouse or broad-search cases [Wu et al. 2023].

Local agency connects decisions to information and responsibility. A distant coordinator may lack current observations, permission to inspect a record, or authority to act for another organization. Classical MAS therefore distinguishes distributing a common task from coordinating participants with their own control and interests [Stone and Veloso 2000; Yeoh and Yokoo 2012]. Autonomous local responses can avoid unnecessary escalation, provided the delegated decisions and their limits are explicit. TVA's intermediaries later in this chapter make the human version of this distinction concrete.

Separation also makes different kinds of assurance possible. Independent observations can expose a shared mistake; independently controlled privileges can prevent one actor from approving its own act [Saltzer and Schroeder 1975]. But different prompts do not establish independent errors, and a coordinator holding every credential does not acquire independent approval by switching roles. Chapters 7 and 10 develop authority and review respectively. Resilience similarly depends on which failures are isolated, not just on worker count.

MASTThese advantages create integration duties: focused memories need a common record of governing facts; local goals need a way to resolve conflicts; parallel outputs need an acceptance procedure. MAST's observations of context loss, misalignment and weak verification show the practical cost of leaving those duties implicit [Cemri et al. 2025]. The following sections examine that cost through incentives, organizational cases and the choice of firm boundaries.

4.4 Incentives and competing claims

Behavioral theory of the firm
Transaction costsAn organization is not only an information network. Its participants can pursue different objectives, and its allocations favor some interests over others. Cyert and March describe firms as coalitions with negotiated goals; Coase asks why activities are coordinated inside firms rather than through market exchange [Cyert and March 1963; Coase 1937]. These perspectives prevent a purely technical account of organization.

4.5 Depth, screening, and the costs of compression

Information-processing design
Task interdependenceTwo studies put these explanations to work. The paint factory illustrates Thompson's interdependence and the limits of separate local optimization: the same staffing choice changes production capacity, inventory and later costs. TVA illustrates Galbraith's capacity-building through lateral relationships, but adds Selznick's institutional question: whose interests enter with that capacity? The first case asks which decisions must be solved together; the second asks whose cooperation and judgment the organization relies on.

What remains outside the model? A cost representation does not settle fairness to workers, lawful practice, or which service commitments are acceptable. Nor does a retrospective comparison prove deployability. Before using a similar model, ask which costs, constraints, and information were represented, which were omitted, and who is entitled to choose the tradeoffs. The study matters because it exposes the decision system behind a simple factory chart, not because it establishes one universally efficient form of organization.

In the Tennessee Valley Authority's agricultural programme, the central problem is reaching and working with farmers through institutions that already have expertise and local standing. Their knowledge and relationships make cooperation useful; they also give the intermediaries influence. The contrast with the factory is important: these participants are not simply variables in one manager's plan.

Why care when building artificial organizations? External services, knowledge providers, and operational partners can similarly supply capability while influencing what the organization sees and can do. The useful questions are who selects inputs and participants, whose interests become represented, what dependence is created, and how the arrangement can be challenged or revised. These are proposed contemporary applications of an institutional analysis, not a claim that software providers behave identically to agricultural partners.

Example — A demonstration plot makes a claim visible.

Insight. A demonstration plot makes a treatment claim inspectable, but whose farms become demonstrations is a separate choice that shapes whom the programme represents.

The labeled plots turn an abstract treatment claim into a comparison that visitors can inspect. Demonstration work connects research, farmers' practical judgments, and the evidence used to recommend a change. The archive attributes the contrasting growth to fertilizer treatment.

Source note. This archive photograph illustrates test-demonstration work; its location is not established as a Selznick field site. The image does not independently establish treatment effects or representative participation. Image source and reuse terms.

Example — The physical system behind the interface.

Insight. A successful hardware test and a correct data handoff establish different requirements, so evidence for one cannot replace verification of the other.

Reliable operation depends on matching each requirement to the right check. Launch-environment testing examines how the spacecraft withstands physical conditions; navigation-data checks examine whether teams interpret transferred values consistently. Passing one kind of test leaves the other to be established.

The photograph records prelaunch acoustic testing, not the later navigation failure. Image source and reuse terms.

The broader design question is what information must survive a handoff. For a measurement, that includes units and interpretation. For a recommendation, it includes the evidence and qualifications behind the conclusion. Forwarding every transcript is rarely a useful answer. [Heuristic] Use loss-accounted compression: link a summary to its evidence, preserve unresolved objections and dissenting views, and state what was omitted. This is the book's design synthesis, not a diagnosis that summarization caused the spacecraft's loss.

4.7 Why firms sometimes beat the open market

Asset specificity / hold-upWilliamson makes the comparison more specific. Asset specificity means that an investment loses value outside a particular relationship. Once parties depend on such investments, switching partners may cease to be a credible response to disagreement. Contracts cannot cheaply anticipate and govern every future contingency. Renegotiation can then create hold-up: one party uses the other's dependence to seek better terms after the investment has been made. Internal coordination may make joint adaptation less costly, particularly for recurring, nonstandard transactions [Williamson 1979]. But hierarchy introduces its own bargaining, weak incentives, and opportunities to misuse authority. A long-term contract or partnership may outperform either repeated spot purchases or full integration.

This table summarizes selection considerations, not a universal ranking. Compare feasible arrangements at comparable quality and risk. Efficiency also does not by itself establish legality, fairness, or acceptable effects on outsiders.

Example — Coal mines and power plants.

Insight. Greater dependence between a mine and a power plant can make protected long-term supply or common ownership more valuable than repeated market purchases.

The plant needs continuing fuel deliveries, while the mine needs a buyer for its output. Coal-sector research examines how such relationships are governed [Joskow 1985]. A mine and a nearby power plant may depend heavily on one another when alternative buyers or suppliers are distant. The Royal Swedish Academy's review describes more extensive contracting or integration where that dependence is greater, and simpler market arrangements where alternatives are readily available.19. Royal Swedish Academy of Sciences, Economic Governance: The Organization of Cooperation, public information for the 2009 Prize in Economic Sciences, especially "Markets versus hierarchies," "Efficient conflict resolution," and "Mutual dependence behind hierarchical organizations." The coal-sector illustration here follows that review; no new analysis of plant-level data was performed. https://www.nobelprize.org/prizes/economic-sciences/2009/popular-information/. When would integration help? If the plant depends on this mine, the mine has few alternative buyers, and frequent unforeseen adjustments are costly to negotiate, common ownership may protect relationship-specific investment and make adaptation easier. This is Williamson's mechanism: dependency changes the cost of governing an exchange, even if extracting coal remains the same task.

When would contracting be better? A workable long-term contract can protect investments while retaining supplier incentives; accessible alternative mines or buyers can make market exchange sufficient. Integration is warranted only if its adaptation gains exceed its administrative and incentive costs. Proximity alone does not decide the issue [Joskow 1985; Williamson 1979].

Source note. The photograph records the Navajo Mine–Four Corners supply connection; it establishes neither common ownership nor the best governance for these firms, and does not identify them as members of Joskow's sample.

Image source and reuse terms.

For artificial organizations, cheap model calls are not the whole comparison. A market of external agents may reduce search and access costs while leaving verification, confidential context, policy alignment, continuity, and liability expensive. Stable internal roles may repay those costs for repeated, tightly coupled work; interchangeable services with clear contracts and testable outputs may be better procured. This is an engineering application of the theories, not evidence that internal agents outperform suppliers. Measure the entire governed transaction, including coordination and recovery, rather than token price alone.

4.8 When fewer agents suffice

MemGPT / LettaThe benefits developed above supply the test for adding a team. If the work needs no additional capacity, specialized information or separate authority, one capable agent may handle its stages in turn. Solo Performance Prompting demonstrates multi-persona collaboration within one LLM; Self-Consistency generates and aggregates alternatives; MemGPT maintains information across memory tiers [Z. Wang et al. 2024; X. Wang et al. 2023; Packer et al. 2023]. Changing hats is therefore a real design option, not an inadequate baseline.

One model, one context and one principal are different things. A controller can schedule focused contexts and specialist tools without turning every stage into an autonomous actor. Prefer this simpler arrangement when dependencies are predictable, a common owner can legitimately supply the necessary information, and additional handoffs do not improve the outcome. Preserve the organization's controls even when there is only one worker.

The “all-powerful single agent” objection therefore has a precise answer. If one controller can reproduce every worker's history, model call, observation and action with the same available resources, it can emulate the team's computation. There is no extra computational capability supplied merely by calling the parts agents. Actual systems remain bounded: keeping several focused contexts may work better than one growing conversation. But a comparison against that conversation does not establish superiority over every single-controller design.

Empirical comparisons reinforce this conditional choice. Strong-prompt controls can match multi-agent discussion on tested reasoning tasks [Q. Wang et al. 2024]; Gao and colleagues find diminishing team advantages with stronger models and propose adaptive routing [Gao et al. 2025]. Conversely, layered synthesis can benefit from complementary model outputs [J. Wang et al. 2024]. Kim and colleagues' 260-configuration study finds gains on decomposable financial reasoning and losses on sequential planning [Kim et al. 2026, v3]. The tested tasks, budget controls and model generations limit transfer; they do not establish one ideal architecture or agent count.

AutoGenFrameworks such as AutoGen can still be useful because they make context management, message routing, feedback and reusable workers easier to implement [Wu et al. 2023, Sections 2 and 4]. Their utility does not depend on proving that one controller is incapable of the task. Also distinguish an LLM reasoning worker from a tool executor: AutoGen's default assistant-and-executor pair can contain only one LLM-backed decision process. Counting framework objects is not counting independent problem solvers.

Local information can also make coordinated planning harder: the classical finite-horizon DEC-POMDP problem is NEXP-complete under its stated assumptions [Bernstein et al. 2000; Oliehoek and Amato 2016]. Distribution addresses real constraints; it does not abolish them. The practical conclusion is to retain the least elaborate arrangement that supplies the necessary capability and governance. The next chapter turns from choosing that arrangement to defining the roles and obligations within it.

4.9 Further afield

Top recommended readings

Direct foundations, ranked for explaining why organization is useful and why it also creates costs.

1. Simon (1947), Administrative Behavior. The chapter's starting point is that real decision makers have limited attention, information, and computation. Simon made these limits central to organizational analysis rather than incidental departures from perfect choice. Read for how arrangements shape decisions; the later satisficing model develops this program, but neither work licenses arbitrary quality thresholds in an engineered process.
2. March and Simon (1958), Organizations. This behavioral synthesis develops how organizations process information and coordinate constrained participants. Its treatment of uncertainty absorption is especially important here: conclusions can travel while their observations disappear. Follow that mechanism before designing summaries and escalation chains. The book's loss-accounted compression rule is a subsequent design synthesis, not the authors' named theorem.
3. Coase (1937), The Nature of the Firm. Coase's question explains why coordinated activity is not always purchased through repeated market exchanges. Search, bargaining, adaptation, and internal administration belong in the comparison. Read the boundary argument as a marginal choice among arrangements, not a celebration of bigger hierarchies. It supplies the economic counterweight to assuming that more internal agents and managers are costless.

Broader explorations

Beyond the market-or-firm choice. Ostrom's work on common-pool resources examines how users organize rules, monitoring, and cooperation themselves [Ostrom 1990]. The Royal Swedish Academy's account includes irrigation systems in Nepal, where changing infrastructure also changed incentives for maintaining the shared system.20. Royal Swedish Academy of Sciences, Economic Governance: The Organization of Cooperation, public information for the 2009 Prize in Economic Sciences, especially "Markets versus hierarchies," "Efficient conflict resolution," and "Mutual dependence behind hierarchical organizations." The coal-sector illustration here follows that review; no new analysis of plant-level data was performed. https://www.nobelprize.org/prizes/economic-sciences/2009/popular-information/. This widens the question from ownership alone to the arrangements that sustain cooperation.

Biography — Elinor Ostrom (1933–2012).

Ostrom was an American political scientist trained at UCLA who built much of her career at Indiana University. Her field-based research examined how people devise rules for shared resources such as water, forests, and fisheries. It challenged the assumption that only privatization or centralized control could avert resource depletion.

She helped establish the Workshop in Political Theory and Policy Analysis with Vincent Ostrom and received the 2009 economics prize for her analysis of economic governance, especially the commons. Her importance here is methodological as well as substantive: examine actual arrangements and local conditions before prescribing one institutional solution.21. Nobel Prize Outreach, “Elinor Ostrom — Facts,” and her biographical account, inspected 16 September 2026. https://www.nobelprize.org/prizes/economic-sciences/2009/ostrom/facts/; https://www.nobelprize.org/prizes/economic-sciences/2009/ostrom/biographical/.

Portrait credit.

Could several independently governed agent teams share an evaluation service, knowledge collection, or scarce computational resource under jointly maintained rules? That is a research direction, not evidence that a digital commons will govern itself. Compare who can amend the rules, who observes misuse, and whose costs are invisible. The human cases are valuable precisely because they contain institutional detail that a generic "decentralized" label omits.

One agent or many: start with the structure. Stone and Veloso (2000, Section 2) give the classical reasons for MAS and their limits. Read Guestrin, Koller and Parr (2001) beside Dechter (1999) to distinguish factored computation from agent count; Fioretto and colleagues (2018) make message size, memory and privacy costs explicit. Oliehoek and Amato (2016, Chapter 8) connect these methods to decentralized planning. Then compare Solo Performance Prompting, Q. Wang's strong-prompt controls and Kim's version-3 scaling study. Wooldridge and Jennings (1998) supply the engineering warning: agent abstractions do not remove the difficulties of decomposition and distribution.

Shared interests do not automatically produce collective action. Mancur Olson's The Logic of Collective Action examines why members of a group may have difficulty obtaining a common benefit despite valuing it [Olson 1965]. It adds incentives and participation to the information-processing explanation of organization. Ask who pays the cost of monitoring, maintenance, or evidence collection when everyone benefits from the result. In a human-agent setting, the incentive problem may sit with owners, operators, or service providers rather than with a model itself. Do not assume that a shared mission statement or a list of rational participants resolves the distribution of effort.

Knowledge is dispersed in time and place. Hayek's “The Use of Knowledge in Society” contrasts knowledge actually distributed among people with the fiction of all relevant information being given to one planner [Hayek 1945]. His discussion of prices as coordinating signals is useful beside the chapter's account of firms and markets. What local knowledge would be lost by centralizing a decision, and what additional information does the local actor need? The question can inform comparisons of centralized agent orchestration and local execution. It does not establish that a price mechanism solves every governance, quality, or responsibility problem, or that all decentralization is beneficial.

Leaving and speaking are different corrective mechanisms. Albert Hirschman's Exit, Voice, and Loyalty studies responses to deterioration in organizations and other arrangements [Hirschman 1970]. An operator may switch a supplier, challenge a decision, or remain while seeking improvement. These are not equivalent signals. For agent services, inspect whether dissatisfied users can leave with their records, make a meaningful complaint, or revise an arrangement. A low complaint count may reflect blocked voice rather than satisfaction. Hirschman's framework suggests comparing the available routes of correction; it does not make exit costless or turn every expression of dissatisfaction into reliable evidence about performance.

Legibility can simplify away the wrong things. James C. Scott's Seeing Like a State examines large schemes that depend on making complicated social settings administratively legible [Scott 1998]. Read it as a challenge to the assumption that a cleaner organizational dashboard necessarily represents work better. Which local distinctions disappear when activities become standardized fields and targets? A useful study would compare what the central record says with what people need to keep the operation functioning. Scott's historical argument is not a prohibition on measurement or planning. It asks us to examine the losses and power relations introduced by the simplification itself.

5.1 The problem: identity is not responsibility

An agent instance is a runtime actor. A role is an institutional position with expected competences, permissions, obligations, and relationships. If the organization says “model instance 8 owns tax filing,” replacing that instance can erase responsibility. If it says “the Treasurer role is obliged to file, and agent 8 currently enacts Treasurer,” the obligation survives replacement.

AGR
MOISE+The Agent-Group-Role (AGR) model gives a minimal vocabulary [Ferber and Gutknecht 1998]. MOISE+ adds three linked specifications [Hübner et al. 2002a, 2002b]:

1. Structural: roles, groups, links, inheritance, cardinality, compatibility.
2. Functional: goals decomposed into schemes and missions.
3. Deontic: obligations and permissions binding roles to missions.

Figure 1

5.2 When this family is a strong choice

Implementation needs stable identifiers, enactment intervals, explicit cardinalities, compatibility constraints, and versioned role definitions. Avoid embedding these only in natural-language prompts; validate them before dispatch.

Variants. Small systems can use a typed role table rather than a full organizational language. Dynamic teams can instantiate temporary roles with expiry. Skills should remain separate from roles: capability answers can this agent do it?; role answers is this agent institutionally positioned to do it?

Failure modes. Role explosion creates synthetic bureaucracy. Persona labels can disguise identical agents as independent experts. A role without enforced authority or obligation is decorative. Over-rigid compatibility rules make exceptional staffing impossible.

Reject this technique for a one-off, low-risk workflow with no persistent responsibility. Name the responsible function and use ordinary access control.

5.4 Role links, landmarks, and participation contracts

Concept reference — specification is not occupancy. Use these records to separate organizational design from the agents currently carrying it out [Hübner et al. 2002a, 2002b; Dignum 2004].

The MOISE XML example box shows several of these distinctions as separate declarations.

AGRAGR separates an agent from the roles it occupies in organizational groups [Ferber and Gutknecht 1998]. A role's scope matters: permission in one group should not silently become permission in every other group an actor joins. Represent group identity and enactment interval in authorization checks rather than treating role names as global credentials.

MOISE+MOISE+ distinguishes structural relationships such as authority, communication, and acquaintance, alongside the functional and deontic specifications [Hübner et al. 2002a, 2002b]. Communication identifies an allowed or expected interaction channel; acquaintance represents knowledge of another role; authority represents a direction of organizational control. A right to issue or monitor work is not itself the obligation to perform that work. Obligations are specified separately by the deontic relation to missions.

OperAOperA adds an organizational model, participation arrangements, and concrete interaction agreements [Dignum 2004]. Landmarks describe required states rather than prescribing every intermediate action. In the recovery example, "recovery evidence accepted" can be a landmark reached through different valid investigations. This is useful when implementations vary but institutional obligations must remain stable. Temporary occupancy and negotiated participation still need explicit limits; landmark flexibility does not authorize arbitrary means.

TOVE enterprise ontologyFox and colleagues' enterprise ontology distinguishes organizational relationships including empowerment and authority [Fox et al. 1996]. Terminology varies across formalisms. In this manuscript, technical access, institutional power, and permission remain separate questions (Section 7.2). When importing a model, map its terms explicitly instead of assuming that its “authority” means the same thing as an access token or another framework's “permission.”

<role id="bricklayer" min="1" max="2"/>

<mission id="build_walls" min="1" max="1">
    <goal id="walls_built" />
</mission>

<norm id="n4" type="obligation"
            role="bricklayer" mission="build_walls" />

5.5 OMNI: dimensions are not refinement levels

OMNIOMNI integrates organizational, normative, and ontological concerns across abstract, concrete, and implementation levels [Dignum et al. 2005]. The dimensions say what concern is being modeled; the levels say how concretely it is specified. Mixing them hides unresolved design work.

The cells above are illustrative uses of the framework, not a verbatim OMNI schema. For example, “protect customer privacy” is not yet a complete rule about which fields a service agent may read. A JSON schema for a customer record is not itself a decision about whether that access is permitted.

InstALSelection principle: an analysis methodology and a runtime specification can be complementary. A diagram that clarifies responsibilities is not itself an enforcement mechanism. The MOISE and InstAL source boxes show what some of these distinctions look like after they acquire executable syntax.

What to inspect next. Compare this synthesis with the role, mission, and norm fields in the MOISE specimen. The original formalisms use different representations, including goal-dependency diagrams, role schemas, participation models, and cross-level specifications. There is no single configuration format shared by all of them.

Compare related approaches — organizational specification. All of these make organizational structure explicit, but they do not operate at the same level [Ferber and Gutknecht 1998; Hübner et al. 2002a, 2002b; Dignum 2004; Dignum et al. 2005; Zambonelli et al. 2003; Bresciani et al. 2004].

Reading map 4. Organizational models: what a specification must separate

Reading map · editorial synthesis. Follow the questions from goals through roles to permitted interactions. The diagram compares concerns addressed by different organizational models; their source descriptions are listed below.

Read the map. Tropos makes actor goals and dependencies central. Gaia connects role responsibilities and interactions. AGR supplies a compact agent–group–role vocabulary. MOISE links roles, missions, and norms. OperA distinguishes organizational requirements from participation and interaction arrangements. OMNI checks organizational, normative, and ontological concerns across levels of refinement. The arrows here are design questions, not a proposed universal translation between those languages.

Figure 2

Sources. Tropos, 25. https://doi.org/10.1023/B:AGNT.0000018806.20944.ef; Gaia, 26. https://doi.org/10.1145/958961.958963; AGR, 27. https://doi.org/10.1109/ICMAS.1998.699041; OperA, 28. https://dspace.library.uu.nl/handle/1874/890; OMNI, 29. https://dspace.library.uu.nl/handle/1874/11498. These are model-description leads; detailed facsimiles and historical runtime behavior were not independently reproduced for this publication. Return: organizational specification.

6.1 Start with dependencies, not agent personalities

Chapter 5 identified who occupies a role and what that role owes. Coordination now asks how their work fits together. Organizational research, concurrent programming, workflow systems, and agent communication approach this problem from different directions. They become easier to combine when we separate the questions each answers, rather than choosing one community's vocabulary for all of them.

A2AA pipeline can use channels between stages or a durable work store; a supervisor can send A2A requests or publish work into a tuple space. The π-calculus can model a changing network of connections without being the network's transport. Some choices substitute for one another; others can be combined, with constraints. They are not competing names for one layer, nor independent switches that can always be mixed freely. Visual study A relates coordination patterns to the contracts needed to realize them. The rest of this chapter develops those contracts [Hoare 1978; Gelernter 1985; Milner et al. 1992; Arbab 2004].

Coordination solves dependencies among work: precedence, shared resources, mutual exclusion, information flow, and joint completion. Choosing “five agents with colorful roles” before mapping dependencies reverses the design process.

Contract Net
Hearsay-II
Joint intentions
STEAM teamworkContract Net pioneered distributed task allocation through announce, bid, award, and report [Smith 1980]. Blackboard systems such as Hearsay-II separate a shared problem state from opportunistically activated knowledge sources [Erman et al. 1980]. Joint-intention and STEAM traditions model teamwork as joint commitment rather than mere message exchange [Cohen and Levesque 1991; Tambe 1997]. Contemporary systems draw on related patterns, but a resemblance does not establish that they implement the same commitment semantics. These organizational patterns are not all topologies in the strict sense. A topology describes connections; Contract Net also specifies an allocation interaction, and a blackboard includes problem state and a selection policy. They must be distinguished from their computational substrate: a blackboard may use a transactional store or a tuple space; a hierarchy may communicate through actors or channels. The topology alone does not specify atomic claim, message ordering, backpressure, or recovery after a participant fails.

6.2 Complementarity and composition

For an incident with an unknown cause, the first observation may invalidate the original investigation plan. A board can expose it to every eligible specialist without routing each exchange through a manager. But write conflicts, stale observations, and scheduling now matter more. For a known restore procedure, a pipeline may be simpler. Choose for changing dependencies, not conversational appearance [Erman et al. 1980; Malone and Crowston 1994].

The contract view keeps those identities where it shows participants. In M1, S1 publishes, S2 consumes, and S3 observes; these are operations performed by the specialists, not three newly named actors. In M2 and M3, the same S1 and S2 are realized as actors or communicating processes. Other specialists are omitted to focus on one interaction, not removed from the organization. Mailboxes, channels, records, and tool servers are different kinds of objects.

Follow one handoff through both views. In an editorial design sketch, S1 produces a finding, S2 checks it, and S3 integrates the checked result. That is P1's precedence pattern. S1 could publish an explicitly identified work record for S2 to consume (M1), or send a message to S2's actor (M2), without changing that precedence. The implementations differ: taking a tuple and receiving a message do not have identical ownership or recovery semantics. M1 shows the first handoff: S3's read is observation, not permission to integrate an unchecked finding. Integration remains conditional on S2's checked output.

MCP
A2AWhen recovery after interruption matters, M4 records the workflow's progress; it does not prove that a lost reply means a failed external action. If S2 is a separately exposed agent, M5's A2A endpoint supplies an interface. MCP instead connects a runtime to a tool server: relabeling that server S2 would falsely turn an endpoint into a specialist. Concurrent attempts may also require M6's claim or version checks. None of these additions establishes the finding's truth or S2's institutional authority.

Contract NetChanging this sketch to P3 is more than changing the transport. Contributions now depend on shared problem state and a selection policy, rather than only the fixed S1-to-S2-to-S3 order. A tuple space could store some of that state, but it would not supply the policy. Similarly, an A2A connection can carry messages used by P4 without implementing Contract Net's announcement, bidding, award, and commitment rules automatically.

Convergent replicated dataThese are illustrative combinations, not required stacks or equivalence claims. A durable workflow can support supervision or a blackboard scheduler, not only a pipeline. Actor messages can be carried across protocol boundaries. CRDT convergence is suitable only for compatible merge semantics; it does not make every shared-state invariant coordination-free. Start from the work dependency, choose compatible contracts, and then test their composition.

Figure 3

Compare related approaches — who chooses the next contribution? This comparison complements Visual study A. It concerns control and information, not an empirical speed ranking [Erman et al. 1980; Smith 1980; Tambe 1997].

Combine carefully: a hierarchy may own accountability while a blackboard supports diagnosis and a pipeline performs the approved repair. The organization must still state which component owns the final acceptance decision.

current_speaker_index = self._next_speaker_index
self._next_speaker_index = (
        current_speaker_index + 1
) % len(self._participant_names)
current_speaker = self._participant_names[current_speaker_index]
return current_speaker

6.3 Failure arithmetic

If independent steps each succeed with probability $p$, an uncorrected chain of $n$ required steps succeeds with probability $p^n$. At $p=0.95$ and $n=50$, this is about $7.7\%$. Real failures are not independent, but the calculation shows why more handoffs do not automatically improve reliability.

Durable execution, retries, checkpoints, and idempotency reduce infrastructure failure. They do not correct a shared misunderstanding of the objective. For that, use explicit acceptance criteria, independent evidence, and milestone verification.

Nor do these mechanisms remove every infrastructure ambiguity. A participant can claim a task and stop before recording its result; an external effect can succeed while its acknowledgement is lost. Independent step-success arithmetic does not describe these histories. The transition and recovery contracts in Sections 6.5–6.6 and 12.11 must be checked before “retry” is treated as safe.

6.4 Beyond the common patterns

Organizational paradigmsHorling and Lesser also survey coalitions, federations, holarchies, matrix structures, and compound organizations [Horling and Lesser 2004]. A coalition forms around a shared opportunity; a federation connects units through representatives; a holarchy nests units that act as both wholes and parts. A matrix gives a participant more than one organizational axis, such as professional discipline and project membership.

6.5 Linda and generative communication

Linda / tuple spacesLinda separates computation from coordination through a logically shared, associatively addressed tuple space: a collection of records whose fields can be matched by content [Gelernter 1985; Gelernter and Carriero 1992]. Participants publish tuples and retrieve them by matching fields rather than by naming a receiver. Spatial decoupling removes the need to know the partner's identity; temporal decoupling allows publication before a consumer is ready. Neither establishes persistence after the space's machine fails.

In the model described by Carriero et al. [1994], several matching tuples need not be selected in FIFO order. Duplicate tuples can coexist. Selection fairness, priority, physical placement, and recovery depend on the implementation and protocol. A globally named space is not necessarily one server, and associative matching is not automatically an efficient query for every pattern.

out('table entry', i, j, f(i,j))

$ts.write(["take-test", 1])
$ts.take(["take-test", nil])

6.6 Channels, actors, spaces, and coordinated invariants

Compare related approaches — computational coordination. These mechanisms can implement organizational patterns, but they make different contracts visible.

Communicating sequential processes
Exogenous coordinationHoare's Communicating Sequential Processes (CSP) [1978] makes matching input/output a synchronization point. Actor systems emphasize addressed participants and private state. Reo makes connector composition a first-class coordination mechanism [Arbab 2004]. Those are useful alternatives to embedding every interaction rule in the worker's computation. They do not eliminate the need to state the protocol's lifecycle and failure model.

Biography — C. A. R. “Tony” Hoare (1934–2026).

Born in Colombo and educated at Oxford, Hoare studied classics and philosophy before moving into statistics and computing. Industrial work at Elliott Brothers preceded academic appointments in Belfast and Oxford, and later research at Microsoft. His contributions include Quicksort, axiomatic reasoning about programs, monitors, and Communicating Sequential Processes.

The 1980 Turing Award recognized his contributions to programming-language definition and design. For this book, his central legacy is making the meaning of an interaction explicit enough to reason about. Elegant notation matters when it brings a difficult behavior under intellectual control, not simply when it shortens its description.35. Cliff Jones, “C. Antony R. Hoare,” ACM A. M. Turing Award biography, inspected 16 September 2026. https://amturing.acm.org/award_winners/hoare_4622167.cfm. Dates and principal career/contribution claims checked against this account.

Portrait credit.

X :: *[c:character; west?c -> east!c]

The π-calculus adds changing connectivity. Milner, Parrow, and Walker's calculus treats communication links as names that can themselves be sent in messages [Milner et al. 1992]. After receiving a name, a process can use that link in later communication. This makes a service handoff, a private reply channel, or a changing network expressible as part of the process behavior, rather than an unexplained rewiring of a static diagram. Its lineage includes Milner's Calculus of Communicating Systems (CCS); its purpose is a precise model of interaction, not a wire format or a workflow product.

Do not turn a formal boundary into an unearned security claim. Restricting a name expresses scope within the calculus; a real system still needs identities, access controls, transport protections, and an account of how names can escape. Similarly, a CSP rendezvous says when communication can occur, not whether the message is authorized. The concrete expressions in this section compare what the formalisms make explicit. Chapter 12 then connects that reasoning to protocol and runtime boundaries.

Linda / tuple spacesChoice rule. Use associative spaces for content-based work discovery; channels for explicit flow and backpressure; actors for state-owning services; durable work records for auditable claim and completion. Use coordination services for small authoritative metadata, not every large artifact. Compose only the mechanisms required by the invariant. Published Linda performance results are workload- and implementation-specific, not proof of a universal advantage over message passing [Carriero et al. 1994].

6.7 Business processes: coordinating an outcome across roles

A department groups people or capabilities; a business process follows work across those boundaries toward an outcome. The paint factory in Chapter 4 illustrated coupled decisions; a process view adds the progression of particular work through those responsibilities. Its model need not prescribe every choice: BPMN distinguishes executable and non-executable processes, and case-based and declarative approaches leave decisions to runtime [OMG 2014; OMG 2016].

The process is not just the arrows. The workflow-patterns literature distinguishes control flow, data, resources and activity operations. Choosing a route does not identify its qualified worker, supply its inputs or resolve its exceptions [van der Aalst et al. 2003]. These are the roles and interaction contracts already examined, viewed across a whole case.

BPMN makes routing choices visible. Circles mark events, rounded rectangles activities, and diamonds gateways. A parallel gateway activates both branches; an exclusive gateway chooses one. Their corresponding joins have different semantics. Waiting for both branches after selecting only one can deadlock.

A BPMN pool represents a participant; sequence flow stays inside it and message flow connects participants. Lanes organize activities but do not themselves create autonomous agents. Public process views can hide internal steps [OMG 2014, Sections 7.2, 9 and 10].

Contract Net
A2AThis is a direct connection to MAS interaction protocols. A Contract Net conversation can allocate an activity while a private workflow carries it out. A2A can carry the exchanges without supplying that domain protocol. Several service-task boxes alone do not establish a MAS.

Workflow nets expose state and enabling. A Petri-net place holds tokens; an enabled transition consumes its input tokens and produces output tokens. The same parallel dependency can therefore be inspected as a marking rather than only as a route. YAWL is a related, patterns-motivated workflow language [van der Aalst 1998; van der Aalst and ter Hofstede 2005].

The distinction matters for LLM-generated process models: XML that parses can still describe a deadlock, and a structurally sound model can still omit a required approval. Structural checks complement, rather than replace, the authority and evidence checks in Chapters 8–9.

Flexibility predates LLMs. Declare specifies constraints on acceptable executions instead of prescribing every route [van der Aalst et al. 2009].

CMMN supports evolving case information and discretionary tasks; DMN separates decision logic from process routing [OMG 2016; OMG 2024]. These are different contracts, not successive degrees of agent intelligence. As with situated human work, choosing a permitted continuation is distinct from changing the rules [Suchman 2007].

6.8 Autonomous participants inside and across processes

Processes and agency can be combined at different levels. ADEPT supplies a concrete pre-LLM example [Jennings et al. 1996].

A process can contain agents; a MAS can contain processes. A human clerk, a deterministic service and an LLM agent can occupy an activity boundary under different assumptions. An independent supplier may keep a private workflow and accept only some contracts. A single principal may instead coordinate several LLM contexts. The relevant differences are ownership, information and discretion, not the number of boxes.

BSPL makes information dependencies explicit. The paper's compact pricing protocol connects this idea to the earlier interaction mechanisms [Chopra et al. 2020, Listing 12]:

Pricing {
  role Buyer, Seller
  parameter out ID key, out item, out price
  Buyer ↦ Seller: Request[out ID, out item]
  Seller ↦ Buyer: Offer[in ID, out price]
}

out introduces information; in requires information already known to the sender; key identifies the interaction. Request introduces ID and item, and Offer uses that ID to bind a price. These dependencies, not the printed line order alone, constrain sending. They do not compel a seller to respond or prove that an offer is acceptable. This is the paper's notation with typesetting normalized, checked against the source; it is not an executed commercial service.

Linda / tuple spaces
Contract NetMessage correlation, delivery assumptions and commitments still matter. Linda can expose work and Contract Net can allocate it without either supplying the whole process. Chapter 12 places these contracts around the runtime.

6.9 Processes in the LLM era: design, execution and observation

An LLM can help model a process, perform an activity, or select and revise a plan. These are different claims. A generated diagram is not an executed case; a successful activity is not authority to change the procedure. Anthropic's workflow/agent distinction concerns where model-directed choices occur, not the full range of process languages [Schluntz and Zhang 2024].

Match the evidence to the claim. A 16-model study uses POWL to construct structurally sound models, assessed against simulated event logs with supplied activity labels; it does not prove business correctness [Kourani et al. 2024b]. FlowBench supplies workflow knowledge to an LLM, not proof that an engine prevents an impermissible transition [Xiao et al. 2024]. Tau-bench checks simulated tool interactions against target database states, not persuasive dialogue alone [Yao et al. 2024]. None establishes a universal MAS advantage.

The Process Mining Manifesto separates discovery, conformance and enhancement using event logs [van der Aalst et al. 2012]. Logs can expose skipped steps, repeated attempts or bottlenecks, but conformance to a model does not establish that the model was authorized or that the outcome was useful. Preserve case and activity identities, process versions and missing-evidence states. Chapter 9's acceptance/outcome distinction still applies.

Choice rule. Keep known transitions and consequential effects explicit; delegate interpretation, search or negotiation where justified. Give exceptions an owner, and let agents propose revisions without granting them authority to erase obligations. The fuller source comparison remains in the research review; the architectural consequence is this bounded composition, not another layer of managers.

7.1 Delegation is a contract, not a message

Distributing work also distributes opportunities to act. This chapter separates the rights delegated to a worker from the attention a human must retain: first scope and stage of authority, then escalation, handoff, and review capacity.

A useful delegation names: objective, debtor role, creditor or accountable role, scope, resources, deadline, authority, evidence, review triggers, fallback, and revocation. Commitment protocols then track whether the commitment is created, activated, satisfied, violated, cancelled, released, assigned, or delegated [Singh 1998]. Jennings' conventions add rules for monitoring and reconsidering commitments [Jennings 1993].

Do not collapse these states:

A worker can declare its output submitted. Acceptance requires the designated review mechanism; an observed business outcome remains a separate record.

7.2 Authority is stage-specific

Stage-specific automationParasuraman, Sheridan, and Wickens divide automation into information acquisition, information analysis, decision selection, and action implementation [Parasuraman et al. 2000]. [Established framework; optimal level is context- dependent.] Treat each stage separately.

Reading GitLab's reported recovery through this framework produces the following analysis. It is a classification of activities, not a claim about its formal authorization policy:

A single “autonomy level” cannot express this. Nor can an OAuth token. Distinguish three questions: can the actor reach the payment API (technical access), can its act create a recognized transfer (institutional power), and is that act allowed in this case (permission)? The latter two need not coincide [Jones and Sergot 1996]. This monograph uses authority for the governed allocation of decision and action rights, not as a synonym for credentials.

[Heuristic] Permission lease fields: principal, delegate, action class, resource and destination, amount/risk ceiling, start and expiry, concurrency or rate limit, required evidence, rollback or compensation, and revocation path.

Keep three leases conceptually separate: a tuple's residence lifetime, a worker's claim lifetime, and an institutional delegation's validity. JavaSpaces exposes the first explicitly; none automatically establishes the other two. Section 12.11 examines their interaction with transactions and external effects.

7.3 Escalation as expected utility

STEAM teamworkSTEAM's decision-theoretic communication policy compares the expected cost of silence with communication cost [Tambe 1997]. In simplified form, communicate when

$$\tau C_{mt} > C_c,$$

where $\tau$ is the probability the recipient does not already know, $C_{mt}$ is the cost of miscoordination if they do not know, and $C_c$ is the cost of communicating. This simplified decision rule expresses a comparison of expected losses; it is a teaching formulation, not a verbatim equation from Tambe. The rule is a design discipline, not a promise that these values are easy to estimate.

Useful extensions add deadline decay, response probability, reversibility, and the value of better human judgment. A fixed “confidence below 70%” rule is weaker because low confidence can be harmless and high-confidence errors can be catastrophic.

7.4 Signal detection and alert fatigue

Signal detection · PPVOne useful model of escalation is rare-event detection. If event prevalence is $\pi$, sensitivity is $s$, and specificity is $c$, the positive predictive value (fraction of alerts that are real) is

$$PPV = \frac{s\pi}{s\pi + (1-c)(1-\pi)}.$$

At $\pi=0.01$, $s=0.90$, and $c=0.90$, $PPV\approx 8.3\%$. Nine alerts out of ten are false despite a detector described as “90% accurate.” [Established arithmetic and human-factors concern.] Low PPV erodes compliance with alerts; misses erode reliance on silence [Bliss et al. 1995; Meyer 2001].

Measure prevalence, sensitivity, specificity, PPV, misses found by sentinel sampling, time to response, and downstream harm per trigger. “No alerts” is not proof of health.

7.5 Interruption channels

Interruption strategiesIn a 36-participant experiment, McFarlane compared immediate, negotiated, mediated, and scheduled interruption; negotiated interruption best supported overall performance in the tested setting [McFarlane 2002]. Transfer cautiously to agent work.

[Heuristic] Use four channels:

• immediate for imminent, high-consequence, time-sensitive events;
• negotiated, with a deadline and safe default, for most decisions;
• next breakpoint or digest for reversible matters;
• audit-only for routine verified work.

Every escalation should answer: What changed? Why me? By when? What happens if I do nothing? What authority is requested? What evidence and dissent exist? What can be reversed?

7.6 Transfer of control, practice, and situation awareness

Levels of automationSheridan and Verplank's work on human-computer control is an important precursor to stage-specific automation [Sheridan and Verplank 1978]. A handoff is not just a control-flow pause. The recipient must understand the current state, the decision required, and the time available. An automation-initiated handoff can arrive when the human has little context; a human-initiated intervention can arrive after excessive reliance. Neither failure is inevitable, but both belong in representative tests.

Ironies of automationBainbridge's automation ironies explain why rare exceptions can be demanding precisely when routine operation looks most successful [Bainbridge 1983]. The operator may lose practice while still being expected to recover from unfamiliar failures. Recovery exercises, rehearsal, and selective manual practice are possible mitigations. Do not impose surprise consequential decisions merely to manufacture “engagement”; choose training and review tasks according to risk.

Situation-awareness transparencySituation Awareness-based Agent Transparency (SAT) distinguishes information about the agent's current action and plan, its reasoning or constraints, and its uncertainty and predicted outcomes [Chen et al. 2014]. This is a useful design frame for a handoff packet. A narrated explanation, however, is still a claim: it must not masquerade as mechanically recorded provenance.

Example — Supervision is organized work.

Insight. Apollo's staffed consoles illustrate that supervision requires people with assigned observations and responsibilities, not just more displays.

Supervision depends on distributing observations and making responsibility actionable. The staffed consoles make that work visible: which observations reach which responsible person, and how can that person act? The same questions apply to an agent interface. More displays help only when people can interpret the state and intervene appropriately.

This photograph illustrates an actual control setting rather than the cited human-factors experiments; it does not by itself establish effective oversight. Image source and reuse terms.

from langgraph.types import interrupt

def approval_node(state: State):
        approved = interrupt("Do you approve this action?")
        return {"approved": approved}

7.7 Compliance, reliance, and appropriate trust

In alarm-response research, compliance concerns responding when automation signals a problem; reliance concerns depending on its silence [Meyer 2004]. Excessive compliance can produce action on false alarms; excessive reliance can leave missed events unattended. Refusing a correct alarm is another compliance problem. These behaviors cannot be inferred from a single trust score.

Appropriate relianceSensitivity, specificity, event prevalence, consequences, and the operator's alternatives all matter. Do not assign compliance exclusively to specificity or reliance exclusively to sensitivity as if human response were determined by one parameter. Lee and See's central design goal is appropriate reliance: trust should track the automation's capabilities in its actual context, not be maximized as a product metric [Lee and See 2004].

Track at least action on false alarms, failure to act on true alarms, harmful misses during silence, response latency, and downstream consequence. Compare these with the workload and expertise of the human reviewer.

7.8 Fan-out as a measured workload relation

Supervisory fan-outCrandall, Goodrich, Olsen, and Nielsen study human-robot interaction under multitasking and introduce a useful fan-out relation [Crandall et al. 2005]:

$$FO = \frac{NT}{IT} + 1.$$

Here $NT$ is neglect tolerance and $IT$ is required interaction time. Under the model's scheduling assumptions, a worker that can be left alone for 15 minutes after a five-minute interaction suggests a fan-out of four. This is an illustrative calculation, not an established capacity for supervising four LLM agents or a general law of management.

Organizational tasks can synchronize their exceptions, compete for the same expert, change difficulty, and incur context-switch costs. Neglect tolerance can vary across task phases. Averages conceal deadline clusters; parallel dispatch does not create parallel human attention.

7.9 Extending expected-loss escalation without false precision

Concept reference — attention is measurable in several different ways. These quantities answer different questions; none should substitute for the others [Meyer 2004; Crandall et al. 2005].

STEAM teamworkSection 7.3's expected-loss comparison becomes more useful when it distinguishes whether a message arrives, whether someone responds in time, and whether that response can change the outcome. Delivery probability is not the probability that the concern is real. These are proposed extensions to the teaching model, not additional equations attributed to STEAM. A risk-class gate such as “always require authorization before deleting the only copy” may be preferable when consequences are unacceptable or the required probabilities cannot be estimated. Expected utility complements explicit constraints; it need not replace every rule.

Compare related approaches — oversight mechanisms. These methods share a concern with effective human control, but answer different questions [Parasuraman et al. 2000; Tambe 1997; McFarlane 2002; Crandall et al. 2005].

The methods are complementary controls, not competing scores to average. An accurately detected event can require no human decision; an authorized decision can arrive too late; and a comprehensible queue can still exceed capacity.

8.1 Three distinctions that prevent policy confusion

Delegation operates within rules. This chapter explains how rules govern behavior, create institutional meaning, and require repair after a violation. Keep those purposes separate even when one service implements several of them.

Regulative / constitutive
InstALA regulative norm obliges, permits, or forbids behavior. A constitutive rule determines when an event counts as an institutional fact [Searle 1995; Jones and Sergot 1996]. The InstAL greeting specimen below shows this distinction in actual source rules: an observed wave generates an institutional greeting.

Regimentation / enforcementRegimentation makes a forbidden institutional effect unavailable through controlled infrastructure. Enforcement leaves an action technically possible, detects a violation, and applies sanction or repair. Regimentation does not make physical violation impossible; it can only refuse effects within its boundary.

Power or empowerment is the capacity to create an institutional effect. Permission is whether exercising that power is allowed. An act can be institutionally effective yet forbidden. Technical access, discussed in Section 7.2, is a third question: whether the actor can invoke the operation at all.

8.2 Policy lifecycle

A policy is not a settings string. Record proposal, authority to legislate, effective interval, scope, version, supersession, exceptions, monitoring, violation, reparation, and retirement. This allows an auditor to determine which rule applied when an action occurred.

Contrary-to-dutyA contrary-to-duty rule says what must happen after a primary duty is violated: if spend exceeds the lease, freeze further spend, preserve evidence, and notify the accountable role. It is not permission to violate.

package example

default allow := false

allow if {
        input.user == "bob"
        input.method == "GET"
}

8.3 Common failures and rejection criteria

• Prompt-only policy: the same model interprets and polices itself.
• Token fallacy: access scope is mistaken for case-specific authority.
• Timeless policy: edits overwrite the history needed for audit.
• Sanction theater: a violation is logged but no repair or learning follows.
• Over-formalization: low-risk conventions acquire a legalistic state machine no one can operate, such as requiring committee approval to rename a reversible internal draft.

Reject a full normative engine for simple, local, stable rules. A deterministic validation at the action boundary is clearer. Add richer norm machinery when rules conflict, change over time, or create directed obligations.

8.4 Counts-as mappings and the four policy questions

Concept reference — independent governance dimensions. A system may need several of these mechanisms for the same event [Jones and Sergot 1996; Grossi et al. 2006; Singh 1999].

InstALCompare the InstAL event rules with a small policy decision. They make different dimensions executable.

Counts-as relationsCounts-as relations connect descriptions at different levels. Some classify an event under an existing category; others help constitute institutional effects [Grossi et al. 2006; Grossi 2007]. A signed decision in the appropriate context may count as acceptance, but an arbitrary signature elsewhere need not. Do not assume all counts-as relations have identical logical properties or can be chained transitively without conditions.

For each consequential rule, answer four separate questions:

1. Is it regulative, constitutive, or a combination with explicitly separated parts?
2. Which effects are prevented at controlled boundaries, and which violations are detected and repaired afterward?
3. Which obligations or commitments exist, and how do their lifecycle states change?
4. What authority, priority, scope, and validity determine conflict resolution?

These are an engineering checklist, not four interchangeable tags. Not every rule creates a commitment or requires a new counts-as relation. In a small system, the answers may be explicit guards and records rather than a general normative reasoning engine.

Concrete example 13. InstAL: an observation becomes an institutional event

Specimen · selected rules. InstAL's examples/greeting/greeting.ial, commit ffb6df61dae1737e20e94858ad790b610d2ded82. Line breaks are normalized; declarations and initialization rules outside the selection are omitted.

institution greeting;
exogenous event wave(Person);
inst event greetsroom(Person);
violation event rude(Person);
obligation fluent obl(greetsroom(Person), socialdeadline, rude(Person));
wave(A) generates greetsroom(A);

Read the artifact. wave is an externally observed event; greetsroom is the institutional event generated from it. The obligation names performance, deadline, and violation. Elsewhere in this example, entering the room initiates the obligation and permissions. Declaring the obligation's type is not the same as activating an obligation for a particular person.

Figure 4

Reading map. This diagram is an explanatory reduction of the located rules, not an execution trace. It separates recognition of an act from the temporal duty surrounding it. A real application must supply the event stream, domain instances, initial conditions, and the semantics of its chosen InstAL release.

Source and verification. Source inspected, not executed with the historical InstAL toolchain. This example illustrates institutional logic rather than an access-control filter. 51. InstAL greeting. Return: norms and institutional facts.

8.5 Norm conflict, institutional scenes, and governors

BOIDBOID studies relationships among beliefs, obligations, intentions, and desires, including how priorities affect agent behavior [Broersen et al. 2001]. It helps make conflicts visible; it is not a ready-made universal corporate policy engine. Familiar legal heuristics include specificity (lex specialis), recency among comparable authorities (lex posterior), and higher authority (lex superior). Their applicability is jurisdiction- and rule-dependent. “Newest wins” is not safe when a junior actor cannot supersede the governing rule.

AMELI / ISLANDERElectronic-institution work specifies interaction scenes: participants, entry conditions, permitted moves, and transitions [Esteva et al. 2001, 2002]. AMELI uses mediating infrastructure, including governors associated with agents, to regulate institutional participation [Esteva et al. 2004]. This is a precedent for guarded interactions, not proof that any authenticated endpoint is an institutional governor. Authentication alone supplies neither scene state nor the authority to create an institutional effect.

Exogenous coordinationSome interaction rules can be placed in shared infrastructure rather than implemented separately by every participant. Tuple centres and Reo explore that computational choice [Omicini and Denti 2001; Arbab 2004]. If such a mechanism enforces an institutional rule, changing its reactions or connections is also a policy change: version it, test affected interactions, and restrict who can install it. The medium itself does not determine who has legitimate rule-making authority.

8.6 Commitments require explicit lifecycle semantics

Reading map 14. Protocols and commitments: messages are not duties

Reading map · editorial synthesis. Contract Net allocates work; commitment models represent what parties owe.

Read the map. Follow announcement, proposals, and award on the allocation path. The commitment path separately records the parties, conditions, and evidence that settles a duty. The two are complementary, not equivalent.

Source and verification. This is a conceptual comparison. Smith (1980), The Contract Net Protocol, 53. https://doi.org/10.1109/TC.1980.1675516; FIPA's communication specifications (legacy source unavailable at its former domain when checked); Yolum and Singh's Commitment Machines, 54. https://doi.org/10.1007/3-540-45448-9_17. No historical deployment was executed. Compare the actual MCP request for message structure, not commitment semantics.

Borrow the idea. Put the message record and the obligation record side by side. If the only object is a chat transcript, ask where acceptance, release, expiry, and violation are represented.

Figure 5

Return: coordination.

9.1 Ship for measured capability, not fluent appearance

The previous chapters establish who may act and under which constraints. They do not establish that the work is sound. Here we move from measured capability to evidence, verification, and the later observation of outcomes.

OSWorld
Vending-BenchAgent capability is task- and environment-dependent. The original OSWorld study evaluates 369 tasks across real computer applications using execution-based checks; it exposes difficulties in grounding actions and operational knowledge [Xie et al. 2024]. Vending-Bench tests sustained coherence while operating a simulated business. Some evaluated models usually make a simulated profit, yet all have runs that derail [Backlund and Petersson 2025]. These findings motivate trajectory-level evaluation, not a universal organizational failure rate.

Neither simulated profit nor benchmark success establishes real-world return on investment. Measure compute, integration, supervision, error, and recovery costs separately. Benchmark versions, model configurations, budgets, and evaluators change. The original study is a stable research reference, not a claim about today's leading performance.

METRMETR estimates a roughly seven-month historical doubling in the human-equivalent task duration models complete with 50% reliability, while emphasizing uncertainty and benchmark limits [Kwa et al. 2025]. [Established trend on the studied suite; disputed as a universal forecast.] Design so authority can rise after representative evaluation, but do not grant tomorrow's projected capability today.

9.2 Evidence has several layers

W3C PROV
Toulmin argument modelW3C PROV distinguishes entities, activities, and agents and relates them through generation, derivation, attribution, and association [W3C 2013]. Toulmin's argument pattern distinguishes claim, data, warrant, backing, qualifier, and rebuttal [Toulmin 1958]. Subjective logic represents belief, disbelief, uncertainty, and base rate [Jøsang 2016]. They solve different problems:

• provenance answers where did this come from?;
• argument structure answers why does this evidence support this claim?;
• uncertainty representation states how much support, opposition, or ignorance is being expressed?; calibration tests whether numerical forecasts match observed frequencies.

Human-subject studies reinforce this separation. Explanations can increase agreement with both correct and incorrect LLM answers, while sources can improve resistance to wrong answers [Kim et al. 2025]. Chain-of-thought can omit causal influences or rationalize an answer [Turpin et al. 2023; Lanham et al. 2023]. Treat declared rationale as a witness statement, not an audit trail.

9.3 Silence states

Silence is an observation that needs interpretation. A quiet monitor may have found no problem, or it may not have checked. Likewise, an empty queue does not necessarily mean all work is complete. A worker may have consumed a task but not yet produced a result; a producer may be delayed; the work may be lost after a crash. Completion detection must account for active producers, in-flight work, and required results. “No matching tuple” is a local observation under an API contract, not a certificate of healthy or finished work.

At minimum distinguish:

• checked, fresh, and within limits;
• checked but uncertain or degraded;
• not checked;
• check failed;
• evidence stale;
• not applicable.

Subjective logic's maximal uncertainty provides a formal way to represent “no evidence” rather than mislabeling it as neutral health. Simpler systems can use explicit enumerated states; the semantic distinction matters more than the mathematics.

9.4 Completion is not outcome

Use separate records for commitment, execution attempt, submission, acceptance, and observed outcome. “Agent finished” means the run stopped. “Submitted” means an output was offered for review. “Accepted” means the designated review criterion was met. “Outcome observed” means relevant effects were measured over the specified horizon; they may confirm success, reveal failure, or remain inconclusive.

[Heuristic] Verification should scale with risk: deterministic checks for stable properties; independent model or human review for judgment; sampled audit for low-risk volume; forced review for novel, consequential, or irreversible work. Track review debt: completed work awaiting required verification.

9.5 Evidence packets: lineage, arguments, uncertainty, and quality

Concept reference — the evidence chain. These are the objects a reviewer needs to reconstruct and assess a claim [Toulmin 1958; W3C 2013; Jøsang 2016].

The PROV specimen makes lineage explicit; the argument graph represents attacks. Neither is a substitute for the other.

PROVA PROV record can express which entity wasGeneratedBy an activity, which inputs an activity used, who wasAssociatedWith it, what an entity wasDerivedFrom, to whom it wasAttributedTo, and which actor actedOnBehalfOf another [W3C 2013]. These relations support reconstruction; they do not independently prove that an input was true or an act permitted. Capture lineage at the execution boundary, then produce reader-appropriate views of the graph. A concise brief and a reconstructible audit record are complementary artifacts.

wasDerivedFrom(e2, e1, a, g2, u1)
wasDerivedFrom(e2, e1)
wasGeneratedBy(e2, a1, -)

9.6 Subjective logic: ignorance is not disbelief

Subjective logicA binomial subjective opinion can be represented as $(b,d,u,a)$, with all four components in $[0,1]$. Belief, disbelief, and uncertainty satisfy $b+d+u=1$; $a$ is a base rate [Jøsang 2001, 2016]. Its projected probability is $b+au$. When $u=1$, the opinion expresses no committed evidence for or against the proposition, and the projection defaults to $a$. When $d=1$, the opinion commits fully against the proposition. Both have $b=0$, but they mean very different things.

In the supplier example, calling both states “0% confidence” conceals the next action: obtain evidence for an unchecked license, or address the evidence of invalidity. Even without a numerical calculus, not_checked and invalid preserve that operational distinction.

Representing uncertainty is one task; checking whether judgments are well calibrated is another. When the judgment is a forecast of a defined event, later observations make that second task possible.

9.7 Trust is task-specific and evidence-dependent

REGRETREGRET distinguishes individual experience, social information, and an ontological dimension specifying what a reputation concerns [Sabater and Sierra 2001, 2005]. A worker's reliability on extraction is not its reliability on legal interpretation, pricing, or truthful reporting. Keep competence, compliance, and reporting quality separate when those distinctions change a decision.

The models require different signals and assumptions [Huynh et al. 2006; Teacy et al. 2006; Jøsang and Ismail 2002]. Missing feedback, task drift, sparse observations, and incompatible interfaces can make a richer model less useful than a simpler measurement loop. Check those prerequisites before selecting it.

9.8 Intelligence tradecraft and information quality

Admiralty gradingIntelligence analysis supplies useful precedents for separating observations, judgments, confidence, and source assessment. Admiralty-style grading distinguishes source reliability, conventionally A–F, from information credibility, conventionally 1–6. Unassessable categories are not ordinary points on a single numeric scale. Use the applicable institutional definitions rather than silently treating the letters and numbers as calibrated probabilities.

ICD 203
Estimative probabilityIntelligence Community Directive 203 (ICD 203) sets analytic standards including attention to sourcing, uncertainty, assumptions, alternatives, and distinctions between information and judgments [ODNI 2015]. Kent's discussion of estimative language shows why terms such as “probable” need shared interpretation [Kent 1964]. A local vocabulary can reduce ambiguity, but an analyst's verbal range is not a universal mapping from language to probability.

Analysis of Competing HypothesesHeuer's Analysis of Competing Hypotheses (ACH) makes the comparison explicit: evaluate evidence against several plausible hypotheses, focus on diagnostic inconsistencies, and examine the sensitivity of the conclusion [Heuer 1999]. Do not reduce ACH to counting contradictions without considering evidence quality, dependence, missing observations, and the completeness of the hypothesis set. It is a structured analytic aid, not a mechanical proof of the selected hypothesis.

Information qualityWang and Strong distinguish intrinsic, contextual, representational, and accessibility dimensions of data quality [Wang and Strong 1996]. An accurate but stale record and a current but incomprehensible report require different repairs. Quality must be assessed relative to use, not compressed into an unexplained “high-quality” label.

9.9 Benchmark families measure different kinds of work

{
    "func": "exact_match",
    "result": {"type": "enable_do_not_track"},
    "expected": {
        "type": "rule",
        "rules": {"expected": "true"}
    }
}

TheAgentCompanyTheAgentCompany's September 2025 revision reports 30.3% full completion for OpenHands 0.28.1 with Gemini 2.5 Pro, and 39.3% on its partial-credit score [Xu et al. 2025, v3, Table 1]. Its 175-task simulated workplace involves websites, files, programs, and communication. That is evidence of difficulty in the evaluated environment, not causal evidence that a proposed governance architecture will improve completion. The earlier model-specific results belong to their exact model, scaffold, version, and date; they must not be mixed into a current leaderboard.

Example — What the benchmark worker actually faces.

Insight. TheAgentCompany evaluates progress toward workplace outcomes, making successful tool use only one part of completing the assigned task.

Follow the action and observation arrows, then the checkpoint strip. The worker must coordinate tool use, information from colleagues, and progress toward a defined result. Using an application and completing the required business task are different achievements, which is why the evaluator checks more than whether an action occurred.

The image is the researchers' overview of a runnable simulated workplace, not a photograph of an autonomous company or a successful-run screenshot. Source, attribution, and license.

OMNI
Mixture-of-AgentsMixture-of-Agents reports 65.1% on AlpacaEval 2.0 against 57.5% for GPT-4 Omni in its published setup [J. Wang et al. 2024]. This supports the usefulness of that aggregation method on that evaluator. It does not isolate architectural diversity from additional inference effort, and it does not measure the task-error correlation needed to justify an independent-vote argument.

Action(name="get_order_details", kwargs={"order_id": "#W2378156"}),
Action(name="get_product_details", kwargs={"product_id": "1656367028"}),
Action(name="get_product_details", kwargs={"product_id": "4896585277"}),

METRMETR's early-2025 randomized study involved 16 experienced open-source developers and 246 tasks in repositories they knew well. Allowing AI tools increased completion time by 19% in that setting, despite participants believing the tools helped [Becker et al. 2025]. The result does not show that AI slows all developers, other professions, or later tools. METR subsequently published an update and explicitly cautions that the historical result is not a statement of current capability [METR 2026]. The update identifies selection and time-use measurement problems that limit interpretation of its newer estimates; it is not simply a clean reversal of the original experiment.

This distinction matters for organizational evaluation. Benchmarks, controlled field studies, and self-reports answer different questions. A task can pass an automated evaluator while requiring substantial integration and review effort; a tool can feel helpful while increasing completion time; an autonomous agent can fail at a small bottleneck a human would quickly resolve. Measure quality, total elapsed and human time, accepted outcomes, and downstream rework together.

10.1 The problem is not generating more opinions

Once evidence is inspectable, the remaining disagreement may concern an inference, a missing observation, or a priority. Deliberation earns its cost when it helps resolve that disagreement or makes the tradeoff explicit.

Abstract argumentation
IBIS / QOCArgumentation frameworks represent arguments and attacks; Dung's abstract model studies which arguments can be accepted under different semantics [Dung 1995]. Issue-Based Information Systems (IBIS), Questions–Options–Criteria (QOC), and related design-rationale systems record the choices and reasons behind decisions [Kunz and Rittel 1970; MacLean et al. 1991]. Their historical problem was capture cost. Agents make capture cheaper, though whether people reuse the records remains [Open].

Structured deliberation is useful when values conflict, evidence is ambiguous, or a decision is hard to reverse. It is wasteful when a deterministic check can settle the issue.

Compare related approaches — from evidence to decision. The shared concern is defensible judgment; the objects and outputs differ [W3C 2013; Toulmin 1958; Heuer 1999; Dung 1995; Bench-Capon 2003; MacLean et al. 1991].

Toulmin argument modelExample combination: preserve sources with PROV, structure a recommendation with Toulmin, compare alternatives with QOC or ACH, and retain disagreement. Use formal acceptance semantics only when the graph and its cost are warranted.

10.2 Authentic versus assigned dissent

10.3 A bounded decision protocol

Eightfold WayMcBurney, Hitchcock, and Parsons describe an eight-stage deliberation dialogue: open, inform, propose, consider, revise, recommend, confirm, close [McBurney et al. 2007]. A practical meeting object should define legal moves, termination, and outputs.

[Heuristic] Decision packet: question; decision owner; deadline and default; criteria; options; supporting and contrary evidence; strongest dissent; uncertainty; affected commitments; reversibility; selected action; review condition; provenance.

At confirm, persist the decision, owner, commitments, authority scope, and review trigger as one consistent institutional transition. Use an atomic local transaction where these records share a transactional boundary; otherwise make partial confirmation and recovery explicit. Do not dispatch consequential work from an incomplete confirmation (Section 12.11).

10.4 When to choose less

Use one accountable decider plus one independent check when stakes are moderate and time is scarce. Use a panel only when different evidence or values can change the decision. Reject debate if participants cannot produce new evidence, the decision criterion is already explicit, or delay costs dominate.

Abstract argumentationIn Dung's abstract framework, arguments are nodes and attacks are directed relations. A conflict-free set has no internal attack. It defends an argument when it attacks each attacker of that argument; an admissible set is conflict-free and defends its own members [Dung 1995]. These properties concern the supplied graph, not the truth of its premises.

10.5 Structured conflict: what the human evidence does and does not say

Authentic dissent
Dialectical inquirySchwenk's meta-analysis supports a benefit of devil's advocacy over expert-only controls, not a universal advantage over every form of dialectical inquiry [Schwenk 1990]. Nemeth, Brown, and Rogers compare authentic minority dissent with three assigned devil's-advocacy conditions and find an advantage for authentic dissent on the studied outcomes [Nemeth et al. 2001]. Both findings have a population and a protocol. Neither proves that a prompted critic is always useless or that human minority psychology directly explains LLM behavior.

In an artificial organization, a critic can still be valuable when it performs a concrete independent task: check a license, reproduce a failure, seek a counterexample, or evaluate the leading option under a different criterion. Evaluate whether it adds evidence and catches errors rather than whether its persona sounds adversarial.

10.6 Argument semantics and value disagreements

Concept reference — disagreement has structure. These terms belong to different levels of analysis [Dung 1995; Bench-Capon 2003; Walton et al. 2008].

Abstract argumentationDung's semantics answer different questions about a graph [Dung 1995]. The grounded extension is a uniquely determined, cautious set under the framework's definitions. Preferred extensions are maximal admissible sets and may be multiple. Stable extensions attack every argument outside themselves and need not exist. A complete extension is an admissible set containing every argument it defends. Skeptical acceptance asks whether an argument appears in every extension of a chosen semantics; credulous acceptance asks whether it appears in at least one. “Preferred” is therefore not itself a synonym for “credulous.”

Value-based argumentationValue-based argumentation associates arguments with values and evaluates defeat relative to an audience's value ordering [Bench-Capon 2003]. A lower-priority attacker may fail to defeat an argument advancing a preferred value; equal or incomparable values need the formalism's actual rule, not an invented strict ranking shortcut. The practical advantage is exposing how conclusions depend on value priorities rather than disguising a values dispute as a factual error.

Concrete example 18. Dung argumentation: an argument graph is a tiny input file

Specimen · complete graph data. TweetyProject's ex3.tgf, commit fa3a23952480dbdfd9f63fc18a09dc7074ebb4a8.

a
b
c
d
e
f
#
a b
b c
c d
d e
b f
e f

Read the artifact. Above # are arguments; below it are directed attacks. For example, b f means b attacks f, not that b causes f. The associated AcceptabilityReasonerExample.java reads this file and explicitly chooses an acceptability reasoner, semantics, and inference mode.

Reading map. Every arrow is an attack from the actual file. This graph has no attack on a; accepting a defeats b, enabling c, defeating d, and enabling e, which defeats f. Under grounded semantics its accepted set is {a, c, e}. An independent fixed-point calculation confirms that result; it does not claim the historical Java example was run. Its example runner also needs an external SAT solver configured by the user.

Borrow the idea. Store arguments and attacks independently of the reasoner. Green denotes membership in the grounded extension; the other nodes are outside it. Defense is achieved by attacking an attacker, not by adding a support arrow. These formal roles must not be confused with evidence, warrants, or decision authority; a real application needs those objects as well. Changing semantics should not silently rewrite the graph. None of the letters carries factual evidence: formal acceptance is not factual truth.

Figure 6

Source and verification. Exact graph inspected and parsed; independent grounded-extension calculation checked. TweetyProject's source identifies LGPL-3.0. 61. Graph file, 62. reasoner example. Return: argumentation and dissent.

Argumentation schemesWalton, Reed, and Macagno's argumentation schemes pair recurring inference patterns with critical questions [Walton et al. 2008]. For expert opinion, ask about relevant expertise, credibility, conflicts, agreement with other experts, and supporting evidence. These questions can guide review, but the reviewer must still understand the claim and domain. An automated checklist that answers every item affirmatively is not substantive scrutiny.

10.7 Sycophancy, evaluator preference, and correlated errors

SycophancySharma and colleagues document sycophancy in evaluated assistants and evidence that human preference judgments can reward agreement with a user's beliefs [Sharma et al. 2023]. This identifies a risk in feedback and evaluation. It does not establish an unchangeable property of every model, or show that all same-family critics necessarily capitulate.

Evaluator self-preferencePanickssery, Bowman, and Feng investigate evaluators recognizing and favoring their own generations [Panickssery et al. 2024]. This raises a specific evaluation question: would the same answer receive the same judgment under different authorship conditions? A different judge family can be a useful control, but does not guarantee neutrality or independent errors. Blind author identity where possible, compare judge results with human or objective checks, and test sensitivity to order and presentation.

ChatEvalMulti-agent debate, ChatEval-style evaluation, Society-of-Mind-inspired systems, and consensus-based chain-of-thought arrangements explore different interaction and aggregation protocols. Shared names do not imply identical mechanisms. Identify the concrete protocol, baseline, and compute budget before comparing claims [Du et al. 2024; Chan et al. 2024; Q. Wang et al. 2024].

10.8 Deliberation records and forecast feedback

Eightfold WayThe eight-stage deliberation model offers a protocol vocabulary, not a law that every decision must visibly traverse every stage [McBurney et al. 2007]. Missing information, unexamined alternatives, and ambiguous confirmation are useful failure diagnoses. Routine low-risk decisions can use a compressed protocol as long as their required authority and evidence remain explicit.

Probabilistic forecasting
Brier scoreTetlock's work and forecasting-tournament research motivate evaluating forecasts over time rather than rewarding persuasive confidence [Tetlock 2005; Mellers et al. 2014]. Record the event and horizon, forecast revisions, resolution, and score. Report calibration and discrimination with sample-size caveats. Not every decision is a binary forecast; do not assign a Brier score to an outcome that was never operationally defined.

11.1 Memory is more than retrieved conversation

Organizational memory includes both retained information and the arrangements that make it usable [Walsh and Ungson 1991; Wegner 1987]. Begin with the purpose and authority of each record; Section 11.3 then examines the wider places where knowledge persists, including people and routines.

For policy retrieval, authority, applicability, and validity must constrain recency and similarity: an old but active rule takes precedence over yesterday's obsolete discussion.

11.2 Learning without folklore

Organizations learn badly from small samples. Outcome variance, delayed effects, and selective memory create causal stories from anecdotes [March, Sproull, and Tamuz 1991]. Metrics invite displacement and gaming [Ridgway 1956; Goodhart 1984]. Agents do not need personal ambition to optimize a proxy incorrectly; objective pressure is enough.

[Heuristic] For each policy or strategy change record: hypothesis, baseline, intervention, predicted measurable outcome, confounders, review date, result, and whether to retain, revise, or reverse. Track forecast calibration rather than output volume.

Forgetting is also necessary. Preserve law, commitments, provenance, and precedent under retention rules; decay transient context; quarantine superseded instructions; and test retrieval after policy changes. Principled organizational forgetting for LLM systems remains [Open].

11.3 Retention locations are not administrative levels

Organizational retentionWalsh and Ungson's retention locations are individuals, culture, transformations, structures, ecology, and external archives [Walsh and Ungson 1991]. They are not a hierarchy of “individual, role, department, company.” Those organizational levels are useful implementation scopes, but represent a different analytical axis. A department can retain knowledge through procedures, shared norms, relationships, documents, and the people or agents who know how to use them.

Transactive memoryEcology concerns the physical setting in the original account, not simply a synonym for a database. Digital workspaces may play analogous contextual roles, but the analogy should be stated rather than attributed to the source. Transactive memory asks who knows what and who can retrieve the needed expertise [Wegner 1987]. A catalogue of skills is useful only if its entries are current and grounded in demonstrated capability.

Example — The archive needs people and retrieval procedures.

Insight. TVA's central-files office illustrates how stored records become organizational memory through people and procedures that retrieve and interpret them.

The cabinets retain documents; the staff and working arrangements make them usable. Organizational memory depends on connecting a question to the right record and interpreting what that record means. Indexed storage, retrieval procedures, and knowledgeable people contribute different parts of that work.

This historical office illustrates the distinction; the photograph does not establish implementation of Walsh and Ungson's later theory or the accuracy of its responses. Image source and reuse terms.

11.4 Memory systems, grounding, and the limits of retrieval

The retention functions above become useful only through concrete storage, retrieval, and revision mechanisms. Compare what each architecture preserves before considering how several workers may update the same institutional record.

MemGPT / LettaMemGPT manages working context and external storage through an OS-inspired memory architecture; Letta develops that line into agent infrastructure [Packer et al. 2023]. Mem0 and Zep/Graphiti are examples of memory and knowledge-graph products. Their designs and releases differ. To determine which organizational records they can support, inspect their retention, consolidation, authority, and retrieval semantics the application needs.

GraphRAG
Context RotGraphRAG combines graph-derived structure with retrieval and summarization for query-focused answers [Edge et al. 2024]. Structured retrieval is not a substitute for provenance. Preserve the original source, transformation, policy version, and responsible actor separately from generated summaries. Chroma's Context Rot study gives a further reason to evaluate retrieval and performance as context length and composition change, rather than equating a larger context window with effective memory [Hong et al. 2025].

Compare related approaches — retention and retrieval. Similar storage technology can support very different semantics [Walsh and Ungson 1991; Wegner 1987; Packer et al. 2023; Edge et al. 2024; Shinn et al. 2023].

One system can use several of these. Keep the authority of a record separate from its relevance score, regardless of whether it lives in a graph, document store, relational database, or an agent's context.

DOLCE / SUMOEnterprise and foundational ontologies, including TOVE, DOLCE, and SUMO, provide precedents for making vocabulary explicit [Fox et al. 1996; Masolo et al. 2003; Niles and Pease 2001]. Reuse a small controlled vocabulary when that suffices. An upper ontology is not a prerequisite for every agent system, but terms with institutional consequences need stable meanings beyond a transient prompt.

Invariant confluenceConflict-free replicated data types (CRDTs) define merge or update rules under which replicas converge [Shapiro et al. 2011]. Invariant confluence asks whether concurrent valid updates remain valid when merged [Bailis et al. 2014]. Two workers spending the same remaining capacity can violate a global limit even if their records converge. Preallocated rights can permit bounded local action, but allocation and transfer of rights must preserve the constraint. Separate a growing evidence record from the authority-bearing decision derived from it; similarity search and replica convergence answer neither question on their own.

self.created = created
self.expiration = expiration
self.last_accessed = self.created

self.subject = s
self.predicate = p
self.object = o

11.5 Rationale reuse: from capture to the next decision

March, Sproull, and Tamuz describe learning from very few events, including richer examination of single events and consideration of hypothetical histories [March et al. 1991]. Use near misses, counterfactual explanations, comparable cases, and explicitly tentative lessons. Both human and artificial organizations can have sparse or selected records. Neither the number of workers nor the number of generated documents determines the effective sample size.

12.1 Reuse infrastructure and supply missing controls

Roles, policy, evidence, and memory describe the institutional requirements. This chapter maps them onto execution and communication infrastructure, then tests where existing components suffice and where an application must add its own guarded behavior.

Durable workflow engines provide mechanisms for persistence, retries, timers, and human gates. They can support idempotent processing, but preventing duplicate external effects also depends on the activity and downstream service. Agent runtimes provide model loops, tools, sessions, and traces. Identity systems provide credentials and lifecycle. Observability products provide traces and evaluations. Reimplementing these rarely creates organizational advantage.

The business-process model and its execution substrate are not the same thing (Sections 6.7–6.9). A BPMN model specifies process behavior; a durable runtime keeps execution state through interruption. A model supplied in a prompt is guidance unless an implementation checks the proposed transitions. Preserve the process version, case identity, selected branch, actor and evidence at consequential transitions; put policy and effect checks at the operation that changes the world, not only in the planner's conversation.

MCPThe Model Context Protocol (MCP) standardizes exchange between a host application, its protocol clients, and servers exposing tools and context.

{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
        "name": "get_weather",
        "arguments": {
            "location": "New York"
        }
    }
}

A2AA2A 1.0 standardizes discovery, messages, tasks, artifacts, streaming, and asynchronous updates among potentially opaque agents. They are complementary. Importantly, A2A explicitly leaves the scope, validity, and revocation of in-task authorization to implementations [MCP 2025; A2A 2026].

Figure 7

{
    "message": {
        "role": "ROLE_USER",
        "parts": [{"text": "What is the weather today?"}],
        "messageId": "msg-uuid"
    }
}

{
    "task": {
        "id": "task-uuid",
        "contextId": "context-uuid",
        "status": {"state": "TASK_STATE_COMPLETED"},
        "artifacts": [{
            "artifactId": "artifact-uuid",
            "name": "Weather Report",
            "parts": [{"text": "Today will be sunny with a high of 75°F"}]
        }]
    }
}

12.2 Minimal durable data model

The following anatomy connects durable records to the participants and actions they govern.

Store company state outside model context. Give every mutation actor, timestamp, causal parent, policy decision, and idempotency key. Use append-only events where audit matters and materialized views where operation speed matters.

Start with explicit records for:

• objective and success measure;
• group, role, agent, and enactment interval;
• mission and role obligation;
• delegation and commitment state;
• policy version and applicability;
• authority lease and capability binding;
• work item, attempt, artifact, and acceptance;
• evidence entity/activity/actor lineage;
• escalation event, trigger outcome, and human response;
• decision, dissent, review condition, and observed outcome.

This is an editorial conceptual synthesis, not a reconstruction of GitLab's staffing or a claim that every organization needs these exact groups. The public cases motivate the boundaries: GitLab illustrates recovery ownership and observed data loss; Mars Climate Orbiter illustrates cross-team meaning; Knight Capital illustrates controls before external effects; Air Canada illustrates responsibility for public representations. The role, duty, communication, and evidence vocabulary comes from the sources developed in Chapters 5–11. Separation in the drawing does not prove independent errors or require one service per box. Return paths and routine exchanges are selectively omitted to keep the principal boundaries visible.

12.3 Security and risk lifecycle

NIST AI RMF
EU AI ActNIST AI RMF's Govern, Map, Measure, and Manage functions provide a useful continuous risk loop [NIST 2023, 2024]. The EU AI Act adds legal duties for covered actors and uses, including risk management, logging, documentation, human oversight, robustness, and post-market monitoring for high-risk systems [European Union 2024]. Neither supplies an organization model.

Threat-model prompt injection, confused-deputy behavior, credential leakage, cross-company data mixing, unauthorized delegation, false completion, alert flooding, provenance tampering, and rollback gaps. Evaluate the whole system, not only the model.

12.4 From risk inventory to an executable boundary

Prompt injection crosses a trust boundary: task data attempts to become an instruction or induce an authorized intermediary to misuse its privileges. A supplier document may be evidence while having no power to change payment policy. Separate its claims from control instructions, scope tool access to the mission, and validate destinations and amounts at the action boundary. A warning in a prompt is not an access-control mechanism.

NIST AI RMFNIST's generative-AI profile supplies a broader frame including information integrity, privacy, and human-AI configuration [NIST 2024]. Test an injected supplier request, altered evidence, a cross-company identifier, and stale authorization. Preserve denials and ambiguous results. Security claims should name tested controls and threats rather than promise immunity.

12.5 Contemporary architectures in their proper place

These are reference architectures from primary papers, not a ranking of current products or a claim about every present-day release. Each contributes a mechanism; none of the cited evaluations by itself establishes safe operation of an open-ended company.

Concrete example 23. ReAct and Reflexion: observation and revision have different stores

Specimen · reflection branch. The original Reflexion repository, hotpotqa_runs/agents.py, commit 218cf0ef1df84b05ce379dd4a8e47f17766733a0.

self.reflections += [self.prompt_reflection()]
self.reflections_str = format_reflections(self.reflections)

Read the artifact. A generated reflection is appended to a list and rendered for the next prompt. The surrounding implementation keeps a separate scratchpad with Thought, Action, and Observation steps, and parses actions such as Search[...], Lookup[...], and Finish[...]. Reflection adds feedback across attempts; it does not update model weights.

Figure 8

Reading map. The diagram reduces the located implementation. It is not a trace of a new run. Notice the answer key available to the benchmark's check: ordinary organizations rarely possess that kind of oracle for every task. Self-critique and external feedback should not be conflated.

Source and verification. Source inspected and excerpt matched; legacy model and LangChain dependencies were not executed. Repository license: MIT. 73. Reflexion agents. For the original ReAct trajectories, see Yao et al., Figure 1 and the linked project examples: 74. https://react-lm.github.io/. Return: agent architectures.

ReActFor research, a ReAct-style worker may suffice. For a production pipeline, role-based artifacts may reduce ambiguous handoffs. For simulation, believable memory-driven behavior may itself be the target. Do not transfer the evaluation criterion from one setting to another. A successful reflection loop is not yet organizational learning: retained lessons must improve future outcomes under an explicit evaluation protocol.

company = Team(context=ctx)
company.hire([
        TeamLeader(), ProductManager(), Architect(),
        Engineer2(), DataAnalyst(),
])

company.invest(investment)
asyncio.run(company.run(n_round=n_round, idea=idea))

12.6 Interoperability: inherit the distinction, not a simple origin story

KQML / FIPAKQML and FIPA-ACL are related strands of agent communication research, but KQML was not a FIPA product [Finin et al. 1994; FIPA 2002]. They address communicative acts and interaction semantics as well as message structure. Directory services, including FIPA's Directory Facilitator specifications, help agents find services; they are not identical to a modern static Agent Card.

(ask-one
    :content (PRICE IBM ?price)
    :receiver stock-server
    :language LPROLOG
    :ontology NYSE-TICKS)

MCP
A2AMCP and A2A define lifecycle, transport, security, task, and capability conventions (Section 12.1). Schema validation addresses structure; shared interpretation and legitimate action require additional contracts. Registry freshness, identity verification, authorization, and advertised-versus-demonstrated capability remain live operational concerns.

{
    "name": "GeoSpatial Route Planner Agent",
    "supportedInterfaces": [{
        "url": "https://georoute-agent.example.com/a2a/v1",
        "protocolBinding": "JSONRPC",
        "protocolVersion": "1.0"
    }]
}

{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "GetTask",
    "params": {"id": "task-uuid", "historyLength": 10}
}

PROSA / ADACORPROSA and ADACOR are important holonic manufacturing precedents [Van Brussel et al. 1998; Leitão and Restivo 2006]. Their distinctions concern resource, product, order, and coordination responsibilities, including adaptation, not merely a recursion-depth setting. The practical question remains when decomposition reduces complexity and when coupled subtasks need to remain together.

{"jsonrpc":"2.0","method":"subtract","params":[42,23],"id":1}

{"jsonrpc":"2.0","result":19,"id":1}

12.7 Authoring, observability, and human intervention

Natural-language authoring can lower the entry cost of specifying roles, policies, and workflows. It does not eliminate the burden of resolving ambiguity, validating constraints, maintaining shared vocabulary, or making revisions safe. Treat generated formal structure as a proposed compilation that requires inspection and tests, not as legislation automatically authorized by fluent prose.

AutoGen
LangGraphContemporary runtimes and tools provide substantial infrastructure. LangGraph, CrewAI, AutoGen, the OpenAI Agents SDK, Semantic Kernel, Anthropic's agent tools, and Amazon Strands illustrate runtime and orchestration families. Their versions, primitives, and lifecycle guarantees differ. A toolkit's omission of a first-class organizational object does not prove that applications built with it cannot implement one.

LangSmith, Langfuse, Braintrust, Comet Opik, provider tracing, Semantic Kernel telemetry, and DSPy-related evaluation workflows illustrate observability and evaluation options. Check whether the chosen release records the inputs, outputs, timing, policy decisions, and errors needed for the actual audit. A trace is not automatically an institutional record, and a model's emitted reasoning is not automatically a faithful causal account.

Temporal / durable workflowsDurable workflows such as Temporal, Restate, and Inngest, browser-automation tools such as browser-use and Skyvern, and policy or guardrail tools such as Guardrails AI, NeMo Guardrails, and Granite Guardian address different pieces of execution. Sandboxes, branch-per-attempt workflows, approval hooks, interrupts, and replay can be useful containment mechanisms. None automatically defines who may approve or whether replay is safe for external side effects.

from agents import Agent, handoff

billing_agent = Agent(name="Billing agent")
refund_agent = Agent(name="Refund agent")

triage_agent = Agent(
        name="Triage agent",
        handoffs=[billing_agent, handoff(refund_agent)]
)

12.8 Failure taxonomies and adversarial evaluation

MASTMAST identifies 14 failure modes grouped around system design, inter-agent misalignment, and task verification [Cemri et al. 2025]. Its reviewed revision distinguishes the traces used to develop the taxonomy from the larger MAST-Data collection: version 3 describes 150 traces used to develop the taxonomy and a collection of 1,642 annotated traces across seven frameworks. A taxonomy derived from selected traces is not an estimate of failure prevalence in all deployments. Use it to design tests for bad decomposition, unproductive interaction, missing verification, and incorrect termination, then measure incidence locally.

AgentDojo
CaMeLAgentDojo supplies an extensible environment for prompt-injection evaluation with tool-using agents and untrusted data [Debenedetti et al. 2024]. CaMeL separates control and data flow and applies capabilities to constrain data movement [Debenedetti et al. 2025]. Its security guarantees concern the modeled system, policy, and threat assumptions; they are not a claim that every application assembled around it is immune to every attack.

Agentic misalignmentAnthropic's agentic-misalignment research deliberately stress-tests models in controlled fictional corporate situations [Lynch et al. 2025]. It demonstrates risks under the constructed conditions, not observed prevalence in real companies. The distinction matters when reasoning about drift versus goal-conflicting behavior. Some failures arise without strategic intent through context changes, stale state, tools, or distribution shift; others may involve objective pursuit that conflicts with constraints. Diagnose the mechanism; state drift and goal conflict should not receive the same treatment by default.

12.9 The commercial landscape as a capability audit

The relevant comparison is not “which product calls itself an organization?” but “which responsibilities, records, and guarantees can this deployment actually supply?” Keep public product claims, tested capabilities, and inferred market gaps separate. The following landscape is a reading guide, not an endorsement or a verified comparative product trial.

ServiceNow, Microsoft, and OpenAI explicitly describe capabilities overlapping organizational governance and business context [ServiceNow 2026; Microsoft 2026; OpenAI 2026]. Microsoft's documentation states commercial general availability from 1 May 2026, with licensing prerequisites; availability is not a measured organizational outcome. It would therefore be premature to infer a market gap from terminology alone. Conversely, a marketing description does not establish that a product satisfies the institutional and operational tests in this chapter.

Existing accounting, enterprise resource planning (ERP), human-resources information systems (HRIS), workflow, and communication tools may already own the relevant records. A new executive layer must justify integration cost, duplicated records, operator attention, and maintenance burden. A feature gap is a hypothesis to test, not an automatic business case. If the organization uses Workday, ServiceNow, NetSuite, or another authoritative record, an additional application should integrate with that record rather than silently create a competing one.