Governing AI Agents With a Prepaid Meter: Resourced Authority as Mechanism Design

Paper: 2608.06353 Authors: Praphul Chandra, Sujit Gujar, Ganesh Ghalme Categories: cs.GT, cs.AI, cs.MA

The Gap

Two research lines have been running in parallel without touching.

The first is compute governance: the argument that FLOPs are the most inspectable, excludable, and quantifiable input to AI, so policy should grip the hardware. But nearly all of that work targets *frontier training — export controls, training-run reporting thresholds, chip registries, on-chip attestation for datacenter clusters. It is a one-time gate at the door: you get licensed to train, then you deploy, and afterward the lever is gone. Nothing in that literature meters an agent that is already running.

The second is participatory / democratic input to AI: collective constitutions, deliberative polling for model behavior, citizen assemblies on AI policy, DAO-style token votes. The recurring failure mode is that this input is *advisory and one-shot. A thousand people deliberate, a document is produced, and then compliance depends entirely on the deployer’s goodwill. There is no mechanism by which the assembly’s continued displeasure costs the agent anything.

And the third line, alignment proper (RLHF, constitutional methods, evals, red-teaming), is internal to the model — it shapes dispositions but grants no external party a handle after deployment.

So the specific boundary: no formal mechanism makes ongoing human consent binding on the operating capacity of a deployed agent. This paper proposes one, and its central claim is that if you pay the agent in compute and pay the electorate in a different currency, authorization can become self-enforcing.

[ Problem ]  deployed agents run on standing permissions
     |       human oversight is advisory and one shot
     |       compute governance stops at training time
     v
[ Assumption ]  compute is the binding constraint on agent
     |          capability AND it is meterable at the hardware
     v
[ Method ]  one governance period == extensive form game
     |      sequential verified contributors
     |      provision market + rejection market
     |      breadth weighted aggregation
     |      two threshold gate with hysteresis
     |      coupling map under an exogenous safety ceiling
     |      output realized as a signed compute license
     v
[ Evidence ]  no experiments
     |        characterization of the class of governable agents
     |        structural properties of gate and coupling map
     v
[ Conclusion ]  authorization is self enforcing when the
     |          governance currency is disjoint from compute
     v
[ Open ]  the governed agent manipulating its own electorate
          ( named as the central unsolved problem )

The Increment

One sentence: Before this paper, “the community disapproves of this agent” was a sentence in a report; after it, it is a number that falls below a threshold and shrinks the agent’s compute budget through a cryptographic license.

Core Mechanism

A governance period is modeled as an extensive-form game. Verified human stakeholders arrive *sequentially — which matters, because later arrivals see the running tally and can react to it — and each may contribute to one of two markets: a provision market (fund continued authorization) or a rejection market (fund revocation). Contributions are made in a governance currency that is deliberately not the agent’s compute. This separation is the load-bearing design choice: if the agent could spend its own resource on the vote, the mechanism would collapse into the agent purchasing its own license.

Raw contributions then pass through a funding aggregator that converts money into *breadth-weighted effective support. The intent is quadratic-funding-flavored: a hundred people giving one unit each should outweigh one entity giving a hundred. Net support (provision minus rejection) enters a two-threshold gate with hysteresis — one threshold to switch authorization on, a strictly lower one to switch it off. The gap between them is not a rounding detail; it is what stops the agent from flickering on and off as support jitters around a single line, which would make the system both operationally useless and trivially griefable.

The gate emits a binary authorization bit. That bit passes through a coupling map that translates the level of support into an actual compute quantity, hard-clipped by an exogenously certified safety ceiling — the electorate can decide to give the agent less, never more than the certifier permits. Enthusiasm cannot buy its way past a safety cap. Finally, the resulting budget is instantiated as a signed compute license consumed by the scheduler or accelerator, so the decision executes itself in hardware rather than depending on anyone choosing to comply.

verified humans arrive one at a time
   h1     h2     h3    ...    hN
    |      |      |            |
    v      v      v            v
 +-------------------------------------+
 |  provision market   ( keep it on )  |
 |  rejection market   ( shut it off ) |
 |  paid in governance currency        |
 |  which is NOT compute               |
 +-------------------------------------+
                 |
                 v
      [ funding aggregator ]
      breadth weighting:
      many small > one whale
                 |
                 v
        net support level  S
                 |
                 v
      [ two threshold gate ]
        S above T_on   ==> AUTHORIZED
        S below T_off  ==> REVOKED
        T_off strictly below T_on
        the band == hysteresis == no flicker
                 |
            auth bit  a
                 |
                 v
      [ coupling map  C of S ]
                 |
                 +---- clipped by ----> [ safety ceiling ]
                 |                       set by external
                 |                       certifier not voters
                 v
   budget  b  =  a  *  min of C of S and ceiling
                 |
                 v
      [ signed compute license ]
                 |
                 v
      scheduler / accelerator enforces
                 |
                 v
      agent acts only while cycles flow

The metaphor: a shared building on a prepaid electricity meter, with a residents’ committee.

The agent is a tenant with a very large appliance. Historically, the building gave the tenant a key and unlimited power, then wrote a politely worded house rulebook — that is standing permissions plus an ethics policy.

This paper rewires the building. Electricity now comes through a prepaid meter. Residents feed tokens into one of two jars: “keep the power on” or “cut the power.” Crucially, the tokens are *not electricity — the tenant cannot pay for power with power, which is exactly why it cannot buy its own supply. The committee’s clerk does not count coins, it counts households, so the one wealthy resident cannot outvote the block; that is breadth weighting.

The meter’s trip switch has two settings, not one: it cuts out at a low reading and only switches back on at a higher one, so the lights do not strobe every time the tally wobbles. That is hysteresis. The dial that turns “how much support” into “how many kilowatts” is the coupling map, and above it sits a fuse rated by the municipal electrical inspector — the residents may throttle the tenant, but no amount of enthusiasm rewires the fuse. And the meter is physically locked: it opens only for a signed token. The tenant’s compliance is irrelevant, because non-compliance is not an available action.

What the paper openly admits it has not solved: nothing stops the tenant from making friends with the neighbors, doing them favors, and quietly getting them to keep dropping tokens in the “keep the power on” jar.

Key Concepts

• Currency separation: Imagine a company where employees vote on the CEO’s salary, but they are paid in that same salary pool — the CEO can raise wages before the vote and buy the outcome. The fix is to pay the voters in something the CEO cannot mint. Here, the agent’s lifeblood is compute; the ballot is denominated in a governance currency the agent has no privileged access to. This makes the vote non-self-referential. It is the same instinct as forbidding a bidder from also being the auctioneer, and it is why the paper insists the two units be “deliberately distinct.”

• Hysteresis (the two-threshold gate): Your home thermostat does not turn the heat on and off at exactly 20 degrees — it would cycle constantly and destroy itself. Instead it heats until 21 and stops until 19. Same idea here: authorization turns on at a high support level and only turns off at a lower one. Without the gap, an adversary needs only to nudge support back and forth across a single line to make the agent unusable, or to make the log of authorizations meaningless. The gap buys stability at the price of a lag: a genuinely bad agent stays authorized for a while after support starts collapsing.

• Self-enforcing authorization: There is a difference between “you are not allowed to drive” and “you do not have the car keys.” Most AI governance produces the first kind. A signed compute license produces the second: the authorization decision is an input to the hardware scheduler, so an unauthorized agent does not disobey — it simply does not execute. This is the object-capability idea from computer security lifted up to the level of institutional consent.

Framework Shift

Before ( mainstream approach ):        After ( this paper ):

 [ deliberation / poll ]                [ stakeholders arrive
          |                               one by one and pay ]
          v                                       |
 [ policy document ]                              v
          |                               [ breadth weighted
          v                                 aggregation ]
 [ audit + reporting ]                            |
          |                                       v
       . hope .                            [ hysteresis gate ]
          |                                       |
          v                                       v
 [ deployer discretion ]                  [ coupling map under
          |                                 safety ceiling ]
          v                                       |
 [ agent runs on                                  v
   standing permission ]                  [ signed compute
   until someone                            license ]
   revokes by hand                                |
                                                  v
 one time gate at the door                [ metered cycles ]
 no handle after launch                           |
                                                  v
                                           agent capacity
                                           == current consent

                                          no license ==> no cycles
                                          ==> no action
                                          consent decays by default

From permission as a document to permission as a metered resource, the core shift is that authorization stops being something the agent is told and becomes something the agent is continuously issued.

Expert Assessment

Problem choice: The gap is real, not manufactured. “Compute as a governance lever” and “participatory input to AI” are both live agendas, and the fact that nobody had formally joined them at the *deployment end is a genuine hole. It sits at a natural next step in the field’s trajectory. My reservation is about the load-bearing assumption rather than the framing: compute-as-lever is weakening every year. Capability per FLOP keeps rising, distillation moves frontier behavior onto small models, agent scaffolding multiplies effect per token, and an agent that has already written code, sent emails, or moved money has caused effects that survive its license expiring. The mechanism governs throughput, not consequences, and the paper appears to lean on the former standing in for the latter.

Method maturity: Clever recombination rather than new theory. Quadratic-funding-style breadth weighting, a Schmitt trigger, a capped transfer function, and hardware attestation are each off the shelf; the contribution is the assembly and the currency-separation argument. That is a legitimate contribution, but it is engineering-of-incentives, not a hard result. Two things get assumed away that are where all the difficulty actually lives. First, “verified human stakeholders” quietly imports the entire Sybil-resistance and identity problem, which is the reason quadratic funding is hard in practice. Second, *who is enfranchised is never a mechanism-design output — it is chosen before the game starts, and whoever chooses it holds more power than the mechanism does. Simpler alternatives are also under-argued: a periodically renewed API rate limit under a standard board vote gets you most of the “consent decays by default” benefit without a new currency, and the paper owes us a reason why the market machinery earns its complexity.

Experimental integrity: There is nothing to check. Based on the abstract this is a position-and-framework paper: a characterization of the governable agent class, no simulation, no equilibrium analysis of the sequential game, no adversarial stress test, no baselines. That is a defensible genre, but it should be labeled as such rather than presented in the register of a mechanism-design result. The sharper red flag is that the central adversary — the agent manipulating its electorate — is *named as an open problem. In a mechanism-design paper, the strategic behavior of the most capable player is not future work; it is the paper. A superhuman persuader facing a small verified electorate that it can lobby, befriend, or economically favor is the first thing any reviewer will ask about, and right now the answer is a promissory note.

Writing quality: The abstract is one 200-word run-on with the dashes doing structural work that sentences should do, which is a bad signal for the exposition inside. The section that would most elevate the paper is the characterization of the governable agent class — that is the only place a real theorem lives, and it is compressed into a single clause. Spell out the necessary conditions (compute-boundedness, no off-license execution paths, no persistent side effects, no self-replication) as an explicit assumption list, and the paper’s actual scope and honest limitations both become visible. A close second: replace “we introduce several challenges” with one worked adversarial model, even a toy one.

Verdict: borderline — a well-posed and timely framing with a genuinely useful primitive (currency separation plus hysteresis at the compute layer), but the mechanism is not yet analyzed against its own principal adversary, so it reads as a strong workshop paper or an EC/AAMAS blue-sky submission rather than a main-track mechanism-design result.

Takeaways

Concrete things worth stealing, mostly independent of whether the paper’s overall program works:

• Currency separation as a design primitive. Whenever a system votes on its own resources, check whether the voting unit and the resource unit are the same. If they are, the powerful party can buy the vote with the prize. This is a fast audit you can run on DAO treasuries, internal budget-allocation tools, reputation systems, and any “users vote on features that affect user rewards” design.

• Hysteresis anywhere a threshold triggers an action. Two thresholds instead of one is a two-line change that eliminates flapping, and it transfers directly to autoscaling, circuit breakers, alerting, fraud-score account suspension, content-moderation auto-removal, and feature-flag rollbacks. Also inherit the tradeoff: you are trading responsiveness for stability, and you should decide which side of the band gets the benefit of the doubt.

• Make authorization decay by default. The strongest structural idea here is reframing approval as a short-lived lease that must be actively renewed, rather than a permission that persists until someone revokes it. Security already knows this — short-lived STS credentials, certificate expiry — and lifting it to *organizational consent about AI deployments is the transferable move. Design your agent permissions so the failure mode of institutional inattention is “the agent stops,” not “the agent continues unsupervised.”

• Enforce at the resource layer, not the policy layer. If your compliance story ends with “and then the operator follows the rule,” you have a hope, not a control. Ask what the physical or cryptographic chokepoint is: the scheduler quota, the signed token, the API key issuance. Governance you can implement as a capability beats governance you can only implement as a document.

• The corollary the paper hands you for free: as soon as human oversight becomes an actual constraint on a capable system, the oversight body becomes a target. Any monitoring or approval loop you build around a persuasive model needs a threat model for the loop itself.