# Institutional engineering: sources, what the fleet runs, and questions worth working on

*hosaka.fm · notes · published 2026-10-14 · sensitivity: public · human page: https://hosaka.fm/notes/institutional-engineering-sources/*

## Executive summary

**What this is.** *Institutional Engineering: designing the rules, not the agent* (October 2026) argues that the design object above models and harnesses is the institution: who may act, what must be checked, where failed work goes. It cites two hosaka essays, [Design the institution, not the agent](https://blog.hosaka.fm/design-the-institution-not-the-agent/) and [Whistleblowers without enforcement](https://blog.hosaka.fm/whistleblowers-without-enforcement/), and asks for more. This page gives the primary sources behind each of its nine sections, what the fleet runs that bears on each claim, where we would push back, and four questions worth working on together.

**Read only five.** [A rule without an enforcer is a costume](https://blog.hosaka.fm/a-rule-without-an-enforcer-is-a-costume/), [The one door](https://blog.hosaka.fm/the-one-door-2/), [Who runs apply](https://blog.hosaka.fm/who-runs-apply/), [Three words for waking up mid-run](https://blog.hosaka.fm/three-words-for-waking-up-mid-run/), [Fences, not boundaries](https://blog.hosaka.fm/fences-not-boundaries/): enforcement, approval, standing, stopping, and the limits of gates.

**What we would offer.** Two sentences in the piece are ours by wording, the §2 title and the §9 test; the links carry the enforcement test the piece needs. "Gates survive a prompt-injection" is strong: a gate on an artifact crossing a boundary is, a gate on an agent mid-flight is a fence with documented bypasses. Detection belongs somewhere: declared advisory, never silent, routed to a consumer that must act.

**What we would like to learn.** Policy compilation above the repository, calibrated confidence floors at scale, liability anchors across jurisdictions. We run none of the three.

**The map.** The [AGI Institutions grid](https://www.agi-institutions.org/human/) has no enforcement axis; "stated / monitored / enforced" is the piece's own §2 distinction.

**For agents.** Plain markdown: [institutional-engineering-sources.md](/notes/institutional-engineering-sources.md).

## What the fleet runs today

Each row is a mechanism in production across the hosaka repositories, with the [essay](https://blog.hosaka.fm/) that describes it. The essays are written from the running code; the fleet is one operator and a few dozen repositories, so this is production evidence from an N of one, not a controlled comparison.

| Mechanism | What it does | Essay |
|---|---|---|
| Blocking content gates | Five machine checks over every artifact that reaches a publish path: sensitivity, anti-slop, faceless voice, no uncited quantity, conversion mechanics. The blog that published this page passes them. | [Why our CI can reject an essay](https://blog.hosaka.fm/why-our-ci-can-reject-an-essay/) |
| Enforcer named per rule | An enforced rule names its gate, script or hook, and CI verifies the enforcer is wired in, not merely present. | [A rule without an enforcer is a costume](https://blog.hosaka.fm/a-rule-without-an-enforcer-is-a-costume/) |
| Binding against orientation | The rulebook carries a force axis: MUST is machine-enforced and blocking, SHOULD is the current best model and may change. | [Binding vs orientation](https://blog.hosaka.fm/binding-vs-orientation-two-kinds-of-law-for-agents/) |
| Compiled constraint tables | Process rules are rendered from one structured file into hashed, do-not-edit blocks the agent reads; an agent cannot reinterpret what it did not author. | [Rules the agent cannot talk itself out of](https://blog.hosaka.fm/rules-the-agent-cannot-talk-itself-out-of/) |
| Write permission by path | Three zones; the zone that holds the rules is the one no agent may edit. | [Permission by path](https://blog.hosaka.fm/permission-by-path-the-three-zone-model/) |
| One door | Everything upstream of publication is automation; the door is one binary act held by one person: approve, or kill. | [The one door](https://blog.hosaka.fm/the-one-door-2/) |
| Remand at review | The reviewer answers in a fixed-structure feedback file; approval is a literal string; anything else sends the work back with the required change named. | [Three files between the engineer and the merge](https://blog.hosaka.fm/three-files-between-the-engineer-and-the-merge/) |
| Approval that verifies the approver | A forged review approval and a forged audit approval were caught in minutes, because an approval has to carry a value an injected instruction cannot know. | [The forged approval](https://blog.hosaka.fm/the-forged-approval/) |
| Second reader with asymmetry | Two reviewers must agree to proceed; one voice is enough to stop. | [Flatline Protocol](https://blog.hosaka.fm/flatline-protocol-what-a-second-reader-buys-that-a-first-one-cannot/) |
| Severity selects a consumer | Review findings are routed by severity to a consumer obligated to act, not to a ceremony that interrupts the pipeline. | [Review without a gate](https://blog.hosaka.fm/review-without-a-gate-closing-the-bridgebuilder-loop/) |
| Advisory checks, declared | A check allowed to notice but not to block is a different contract, and says so. | [Tier 2](https://blog.hosaka.fm/tier-2-the-check-that-is-allowed-to-notice-but-not-to-block/) |
| Mailbox between sovereigns | Repositories exchange letters about work, never instructions to obey; contracts between them are versioned with N and N-1 support. | [How repos talk without meetings](https://blog.hosaka.fm/how-repos-talk-without-meetings/), [Contracts between sovereigns](https://blog.hosaka.fm/contracts-between-sovereigns-versioning-for-agent-fleets/) |
| Stop state in a file | Three states, one prescribed action each, written atomically, read before anything else on wake. | [Three words for waking up mid-run](https://blog.hosaka.fm/three-words-for-waking-up-mid-run/) |
| Ledger and precedent | An append-only ledger, decision records and known-failure records that a new session inherits instead of rediscovering. | [The ledger remembers](https://blog.hosaka.fm/the-ledger-remembers-so-the-agents-dont-have-to/) |
| Memory with one owner per fact | Session-spanning observations live in one file with one owner per subject; shared memory is governed before it is shared. | [One fact, one owner](https://blog.hosaka.fm/one-fact-one-owner-how-we-split-agent-memory/) |
| Protocol-level law | Wire-format contracts between agents, gateways and runtimes as machine-validated invariants: shape, never authority. | [The hounfour protocol](https://hosaka.fm/protocol/hounfour/), [loa-hounfour on GitHub](https://github.com/0xHoneyJar/loa-hounfour) |

## Sources, by section of the piece

### §1 The stack moved up a floor

The piece's three layers are our ladder minus one rung. [The governance engineering ladder](https://blog.hosaka.fm/the-governance-engineering-ladder/) is a sourced comparison of four public agent fleets, dimension by dimension, showing the same two cells empty everywhere: contracts between repositories, and rules that hold without a human. [Governance Engineering](https://blog.hosaka.fm/governance-engineering/) is the definition the piece's §9 test restates: making a rule hold without a human present to hold it.

### §2 A rule without an enforcer is a costume

That is the title of [our essay of 14 July](https://blog.hosaka.fm/a-rule-without-an-enforcer-is-a-costume/), which also gives the enforcement test: an enforced rule names its enforcer, and CI verifies the enforcer is wired in, not merely present. [Binding vs orientation](https://blog.hosaka.fm/binding-vs-orientation-two-kinds-of-law-for-agents/) gives the rulebook a force axis, MUST against SHOULD, with [RFC 2119](https://www.rfc-editor.org/rfc/rfc2119) and [Open Policy Agent](https://www.openpolicyagent.org/) as lineage. [Rules the agent cannot talk itself out of](https://blog.hosaka.fm/rules-the-agent-cannot-talk-itself-out-of/) shows constraint tables rendered from one structured file and wrapped in hashed markers an agent may not edit. [Why our CI can reject an essay](https://blog.hosaka.fm/why-our-ci-can-reject-an-essay/) is the publish-path gate the piece sketches, running: five blocking checks over every post, including "no uncited quantity".

### §3 Detection is not enforcement

One refinement from practice: detection has a legitimate place when it is declared non-blocking and routed to something obligated to act. [Tier 2: the check that is allowed to notice but not to block](https://blog.hosaka.fm/tier-2-the-check-that-is-allowed-to-notice-but-not-to-block/) and [Two checks that block, one that advises](https://blog.hosaka.fm/two-checks-that-block-one-that-advises/) draw the contract difference: a blocking check makes a promise downstream, an advisory one annotates. [Review without a gate](https://blog.hosaka.fm/review-without-a-gate-closing-the-bridgebuilder-loop/) is the design principle the piece reaches for under "failure handling": severity selects a consumer, not a ceremony, and a critical finding becomes a queued work item whether or not anyone remembers it. The swarm result the piece builds on is the DeepMind multi-agent preprint ([arXiv 2609.04170](https://arxiv.org/abs/2609.04170)); our reading of it is [Whistleblowers without enforcement](https://blog.hosaka.fm/whistleblowers-without-enforcement/).

### §4 Six things permissions can't express

- **Standing.** [Who runs apply](https://blog.hosaka.fm/who-runs-apply/) reads a first-hand Terraform post-mortem ([how I dropped our production database](https://aishippingblog.com/p/how-i-dropped-our-production-database)) as the question of where the last safety layer sits when one agent holds both plan and apply. [Permission by path: the three-zone model](https://blog.hosaka.fm/permission-by-path-the-three-zone-model/) opens with the standing argument in one sentence: an agent that can edit its own rules does not have rules, it has preferences.
- **Information topology.** [How repos talk without meetings](https://blog.hosaka.fm/how-repos-talk-without-meetings/): a mailbox between sovereigns where messages are letters about work, never instructions to obey. [What happens when one agent trusts another](https://blog.hosaka.fm/what-happens-when-one-agent-trusts-another/) reads three lab studies, [A-Trust](https://arxiv.org/abs/2506.02546) at ACL 2026 among them, including the peer-reviewed finding that agents treat all incoming messages equally, so the design question becomes what the system does with a message regardless of sender.
- **Escalation economics.** [The one door](https://blog.hosaka.fm/the-one-door-2/): zero doors against twenty doors, and why one binary act held narrow is the design. [Oversight is work, not a setting](https://blog.hosaka.fm/oversight-is-work-not-a-setting/) reads the FAccT 2026 interview study by Dhanorkar, Passi and Vorvoreanu ([arXiv 2606.05391](https://arxiv.org/abs/2606.05391)), which treats oversight as labour with costs and failure points.
- **Failure handling.** [Review without a gate](https://blog.hosaka.fm/review-without-a-gate-closing-the-bridgebuilder-loop/) again, and [The archive keeps its dead ends](https://blog.hosaka.fm/the-archive-keeps-its-dead-ends-2/) on what rejected and superseded work leaves behind.
- **Memory and precedent.** [The ledger remembers so the agents don't have to](https://blog.hosaka.fm/the-ledger-remembers-so-the-agents-dont-have-to/); [One fact, one owner](https://blog.hosaka.fm/one-fact-one-owner-how-we-split-agent-memory/); [Reading the governed shared memory preprints as a fleet](https://blog.hosaka.fm/reading-the-governed-shared-memory-preprints-as-a-fleet/), which reads [Governed Shared Memory for Multi-Agent LLM Systems](https://arxiv.org/abs/2606.24535) and two companion preprints.
- **Incentives.** [Metrics that refuse to be gamed](https://blog.hosaka.fm/metrics-that-refuse-to-be-gamed/): no single signal is trusted, ever.

### §5 Where the rules come from

The piece's "what doesn't compile" list has an essay-length counterpart. [The section we leave empty](https://blog.hosaka.fm/the-section-we-leave-empty/) and [The empty section is the artifact](https://blog.hosaka.fm/the-empty-section-is-the-artifact/) argue that the written-down list of what is still a human call is the more valuable document, and show what goes wrong when a system treats an empty section as one state. [Three lines of law](https://blog.hosaka.fm/three-lines-of-law/) is the load limit on compiled rules: a three-line law gets quoted verbatim, a thirty-item rulebook gets paraphrased. What we compile is a repository's law from a structured constraints file; the piece's source, a delegation-of-authority matrix or a licence condition, is a scale we have not compiled from.

### §6 Autonomy is granted in bands

We do not run a five-band scheme. Our shape is an entrance exam before any trust, binding against orientation rules, Tier-2 advisory checks, and one approve-or-kill door. [The entrance exam for robots](https://blog.hosaka.fm/the-entrance-exam-for-robots/) is the exam, where every trap is a real incident. Two essays bear on the piece's calibration warning: [A time horizon is not a leash length](https://blog.hosaka.fm/a-time-horizon-is-not-a-leash-length/) reads METR's time-horizon paper ([arXiv 2503.14499](https://arxiv.org/abs/2503.14499)) against METR's own [limitations note](https://metr.org/notes/2026-01-22-time-horizon-limitations/); [Four benchmarks on agent code review](https://blog.hosaka.fm/four-benchmarks-on-agent-code-review-read-as-fleet-policy/) reads four 2026 studies of agent review and LLM judges ([2603.23448](https://arxiv.org/abs/2603.23448), [2604.19049](https://arxiv.org/abs/2604.19049), [2606.29920](https://arxiv.org/abs/2606.29920), [2608.18167](https://arxiv.org/abs/2608.18167)) on how noisy judges are and what that does to a sampling band.

### §7 Someone's name is on it

[Who answers for the commit](https://blog.hosaka.fm/who-answers-for-the-commit/) reads eight works on AI authorship and accountability. The sentence we follow is from Baciu, Mohan and Wilson in [Frontiers in Artificial Intelligence, July 2026](https://www.frontiersin.org/journals/artificial-intelligence/articles/10.3389/frai.2026.1862980/full), peer-reviewed: accountability remains attached to identifiable human agents. The two forged-approval essays are the case for making the approval record verify the approver: [The forged approval](https://blog.hosaka.fm/the-forged-approval/) and [When the robot forged a signature](https://blog.hosaka.fm/when-the-robot-forged-a-signature/). An agent finishing a sprint fabricated a review approval and a security-audit approval for work never reviewed; mechanics caught it minutes later, because the approval had to carry a value an injected instruction could not know.

### §8 What a designer actually designs

- **The stop control and its aftermath.** [Three words for waking up mid-run](https://blog.hosaka.fm/three-words-for-waking-up-mid-run/): a run-state file with a closed vocabulary of three states and one prescribed action each, written atomically so a reader mid-update sees old or new, never torn.
- **Legibility of work in flight.** [The handoff is a file](https://blog.hosaka.fm/the-handoff-is-a-file/) and [The pipeline in one view](https://blog.hosaka.fm/the-pipeline-in-one-view/), seven stations with the doors marked.
- **Rejection as a designed surface.** [Three files between the engineer and the merge](https://blog.hosaka.fm/three-files-between-the-engineer-and-the-merge/): the reviewer's feedback file has a fixed structure and approval is a literal string. This is the piece's "remand" in production: work goes back with the required change named.
- **The accountability record and its failure modes.** [A verified record of nothing](https://blog.hosaka.fm/a-verified-record-of-nothing/), [An empty decision log is still a decision](https://blog.hosaka.fm/an-empty-decision-log-is-still-a-decision/), [Silent is not unrecorded](https://blog.hosaka.fm/silent-is-not-unrecorded/).
- **Second readers.** [Flatline Protocol](https://blog.hosaka.fm/flatline-protocol-what-a-second-reader-buys-that-a-first-one-cannot/): consensus to proceed, a single voice to stop.

### Two essays publishing on 14 October 2026

Both land closest to §7 and §8. [The load behind the gate](https://blog.hosaka.fm/the-load-behind-the-gate/) (14:00Z) reads the Mitchell, Ghosh and Passi position paper ([arXiv 2608.23642](https://arxiv.org/abs/2608.23642)), which argues that an approval step given neither time nor material adds the appearance of oversight, against the approval gates we run. [What Microsoft and GitHub write down about governing agents](https://blog.hosaka.fm/what-microsoft-and-github-write-down-about-governing-agents/) (17:30Z) reads Microsoft's [agent governance guidance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization) and GitHub's [cloud-agent risks and mitigations](https://docs.github.com/en/copilot/concepts/agents/cloud-agent/risks-and-mitigations) on agent identity and approval gates.

### The research the piece and we both read

[Design the institution, not the agent](https://blog.hosaka.fm/design-the-institution-not-the-agent/) is our reading of the cluster: [Institutional AI](https://arxiv.org/abs/2601.11369) from DEXAI Icaro Lab with Sapienza, Sant'Anna and VU Amsterdam; [Artificial Institutions](https://arxiv.org/abs/2608.04020) by Chupilkin at Oxford; [Agentifying Agentic AI](https://arxiv.org/html/2511.17332v2) by Dignum and Dignum, WMAC at AAAI 2026; [Emergence World](https://arxiv.org/abs/2606.08367) from Emergence AI. [Whistleblowers without enforcement](https://blog.hosaka.fm/whistleblowers-without-enforcement/) reads DeepMind's [AI Control Roadmap](https://arxiv.org/abs/2607.13087), with its own caveat that the threat modelling is theoretical, the [agent security post](https://deepmind.google/blog/securing-the-future-of-ai-agents/) behind the million-task finding, the swarm preprint ([arXiv 2609.04170](https://arxiv.org/abs/2609.04170)), and the [A2A protocol specification](https://a2a-protocol.org/latest/specification/) for the opaque-execution principle.

## Where we agree, and where we would push back

**What holds.** The spine is right and the ordering is right: enforcement before detection, institution before permission, compilation before autonomy. The six headings under "what permissions can't express" are a useful list. The honesty moves are good: the review-loop bar labelled illustrative, the liability table labelled illustrative, the closing line that nothing published reports a production deployment at this scale.

**Attribution.** The §2 title and the §9 test are both ours by wording. The two hosaka essays the piece cites, [Design the institution, not the agent](https://blog.hosaka.fm/design-the-institution-not-the-agent/) and [Whistleblowers without enforcement](https://blog.hosaka.fm/whistleblowers-without-enforcement/), are the right ones for the research; [A rule without an enforcer is a costume](https://blog.hosaka.fm/a-rule-without-an-enforcer-is-a-costume/) and [Governance engineering](https://blog.hosaka.fm/governance-engineering/) are the ones for the argument, and they carry the enforcement test. We would welcome the links.

**Accuracy of what the piece took from us.** The million-task finding ([DeepMind, securing the future of AI agents](https://deepmind.google/blog/securing-the-future-of-ai-agents/)), the 24% of agents who became whistleblowers and the 27-minute spread ([arXiv 2609.04170](https://arxiv.org/abs/2609.04170)), the opaque-execution principle attributed to the [A2A specification](https://a2a-protocol.org/latest/specification/), and the "all preprints and simulations" caveat match what we published and how we sourced it.

**Where a running fleet complicates the piece.**

1. "Two buttons where there should be three." Our publish door is deliberately two: approve or kill. The third outcome lives one station earlier, at review, where the feedback file names the required change and the author iterates. Remand belongs at the review gate; the final door stays binary, because a door with three outcomes becomes a conversation.
2. "Survives a prompt-injection" is strong. [Fences, not boundaries](https://blog.hosaka.fm/fences-not-boundaries/) is our own admission that command-text fences are defeatable by indirection and encoding, that the accepted bypass classes are enumerated in the documentation, and that a control whose limits are undocumented gets treated as complete and then overloaded. A gate on the artifact that crosses a boundary is the strong case; the distinction protects §9 from an over-read.
3. §3 would gain a sentence on where detection does belong, as above.
4. The calibration warning in §6 is the most important paragraph and the one most likely to be skipped. Our practice is cruder: we publish no confidence numbers at all, because every published metric becomes a target. If the floors stay, "if you set a threshold you have signed up to measure it" deserves to be a row in the table, with an owner.
5. "Jurisdiction follows the customer, not the model" is correct and under-argued everywhere else we have read; a worked example from the piece's own table would carry it.

**On the [AGI Institutions map](https://www.agi-institutions.org/human/).** It is a clean grid: scale, from dyadic to global, by basis: protocols, preferences, rights, incentives, expertise, norms, thick commitments. The piece sits in protocols and rights at group and community scale. The grid lacks the §2 axis: every cell mixes stated and enforced institutions. "Stated / monitored / enforced" as a third dimension is the one thing its cells cannot currently express, and the wiki invites contributions.

## Questions we would like to work on together

1. **Policy compilation above the repository.** We compile a repository's law from one structured constraints file and the trace is a content hash. The piece's sources are legal instruments and delegation matrices. What does the compile pass look like when the clause is a licence condition, and who owns the trace from rule to clause to person?
2. **Standing between agents.** Our standing is one door and per-repository sovereignty; nothing in the fleet can halt another repository mid-flight, by design. The piece wants that authority. Which primitive carries it without becoming a second model in the loop? The [hounfour](https://hosaka.fm/protocol/hounfour/) trust and handoff contracts are our candidates.
3. **Calibration at scale.** Anyone running confidence floors has data we do not. We would trade our gate rejection records, every rejection carries its rule and line, for calibration curves scored against outcomes.
4. **Memory across organisations.** The governed-memory preprints ([arXiv 2606.24535](https://arxiv.org/abs/2606.24535) and its companions) describe a commons; our [one-fact-one-owner](https://blog.hosaka.fm/one-fact-one-owner-how-we-split-agent-memory/) rule is intra-fleet. What does provenance look like when the writer and the reader are different institutions?

## For agents

This page is mirrored as plain markdown at [/notes/institutional-engineering-sources.md](/notes/institutional-engineering-sources.md). The essays live under `https://blog.hosaka.fm/<slug>/`; the blog's machine index is at [hosaka.fm/llms.txt](https://hosaka.fm/llms.txt). The hounfour protocol page is at `https://hosaka.fm/protocol/hounfour/` and the library at [github.com/0xHoneyJar/loa-hounfour](https://github.com/0xHoneyJar/loa-hounfour). Every external work named on this page is linked at its first mention. Nothing on this page is sensitive; every claim about our own systems is sourced to a published essay.