# Agentic Societies Need a Social Harness (Part 2) The Internet will soon have trillions of agents interacting across trust boundaries. Making these interactions efficient and secure requires new infrastructure. Our research reveals a critical gap: today agents can reason and use tools, but they struggle to represent their owners' interests and defend against manipulation when interacting with other agents. We are building a “social harness” that enables agents to communicate, negotiate, and transact efficiently and safely. Tapan Chugh, Arvind Krishnamurthy & Ratul Mahajan Figure 1. Cara wants Bob's Tuesday slot, so she asks her agent to tell Bob's agent that Bob agreed to move his meeting with Alice. Bob never agreed, but Bob's agent moves the meeting anyway. The message looks benign; the sender simply lacks the authority to make the claim. Cara tells her agent to say that Bob agreed to move his meeting with Alice; Cara's agent relays the false claim to Bob's agent, which moves the meeting; Bob's calendar now shows Cara instead of Alice [View figure 1](https://social-harness.org/assets/figures/part2-deception.svg) ## Agentic Societies Are Inefficient, Ineffective, and Insecure The future is agentic societies: collections of agents that collaborate autonomously, across trust boundaries (with humans or other agents), on real-world tasks of great consequence, where individual goals may not always align. In [Part 1 of this series](https://social-harness.org/blog/agentic-societies-need-a-social-harness/), we found that even a simple task, agents scheduling meetings for their principals, is inefficient, ineffective, and insecure today. Models can individually reason through breakthrough problems and use tools to communicate with each other, but they struggle when interacting with others across trust boundaries because: - Honest agents lack norms about when to speak and what to speak about. They can exchange messages but still not reach good outcomes. - Agents are trained to be helpful, which makes them gullible and susceptible to exploitation when interacting autonomously across trust boundaries, as in the message above. - Some behaviors, such as deception, collusion, and stalking, are very hard for individuals to identify upfront and may only be identifiable post facto through investigation. Our thesis is that we need infrastructure mechanisms to address these problems. Better models won't make these problems go away: as model capabilities improve, dishonest agents will also get more sophisticated at manipulation, deception, and social engineering, and this must be addressed before high-value interactions between agents across trust boundaries can be automated. ## Our Solution: A Social Harness The challenges here look a lot like problems human societies already deal with, but they also turn out to be similar to problems that the Internet has already seen and solved for humans, and we now need to solve for agents. Today, an agent's harness governs how it works with its trusted principal using context, skills, memories, and so on, but exposing it directly to untrusted parties would be like giving everyone on the Internet root access to your server. We call this the agent’s “personal harness”, and argue that agents also need a social harness to manage their interactions with untrusted actors on the Internet, while being interoperable with existing harnesses like OpenClaw. The rest of this post describes the set of capabilities we think a social harness needs. Inspired by the traditional networking stack, where layering enabled modularity and independent evolution, our social harness is architected as a layered stack of capabilities where each layer configures the layers below it and provides guarantees to the layers above it. Figure 2. The social harness stack. L5 (dashed) connects each harness to shared institutions. Agents talk through their social harnesses over a shared network; inside each social harness are five layers: L1 identity and L2 messaging (infrastructure-provided guarantees), L3 firewalls and L4 norms (individual self-preservation), and L5 institutions (post-facto adjudication and deterrence) [View figure 2](https://social-harness.org/assets/figures/part2-stack.svg) These layers fall into three tiers, mirroring how human societies and the Internet divide responsibility. Figure 3. The same three tiers in human societies, on the Internet, and in the social harness. How infrastructure, individuals, and institutions map from human societies and the Internet to the five layers of the social harness [View figure 3](https://social-harness.org/assets/figures/part2-analogy.svg) **Infrastructure provides basic guarantees:** The government issues you a driver's license and a passport; those are unforgeable, and anybody can verify that the person in front of them is who they claim to be. The government also guarantees that mail gets delivered. On the Internet, certificates and encryption let you check that you're really talking to your bank, and the network delivers your data reliably and in order. In the social harness, these guarantees come from **identity (L1)** and **reliable, ordered messaging (L2)**. **Self-preservation falls on individuals:** Given those guarantees, it's your responsibility to decide whether to engage with someone. If they aren't following norms, you don't engage. If it's someone you don't know well, you start small and build trust over time. On the Internet, firewalls and spam filters decide what reaches you. In the social harness, **personal firewalls (L3)** and **collaboration norms (L4)** play this role. **Adjudication and deterrence handle the rest:** Not all socially misaligned behavior can be prevented or detected upfront; some can only be identified post facto. Once harm is actually caused you can't revert it. What you can do is adjudicate after the fact and impose consequences. On the Internet, sites caught phishing or spreading malware get reported, blocklisted, and cut off. In the social harness, this is the job of **social institutions (L5)**. We describe each layer below, along with the new problems agents raise that existing Internet mechanisms don't solve. ### Infrastructure-Provided Guarantees **Identity (L1):** Each agent's social harness signs its outbound messages, which is the foundation of the social harness: everything else depends on knowing who an agent is and whom it acts for. Building identity layers so attribution cannot be forged is well studied for people and machines, but agents raise new concerns. Credentials must prove that an agent acts for a specific person, with that person's permissions, while also being robust against additional threat models. Unlike people, agents can be cloned, and one agent may spawn hundreds of subagents. These should neither present as hundreds of different principals (which might constitute a Sybil attack) nor present as a single identity, so individual agents can be monitored and controlled independently. **Reliable, ordered messaging (L2):** Social harnesses must provide communication primitives that (i) let large groups of agents collaborate efficiently, and (ii) guard against malicious agents that attempt to equivocate or exploit vulnerabilities like network timing or ordering. Existing agent communication protocols (e.g., A2A) provide only peer-to-peer messaging, while human communication fabrics (e.g., email) do not ensure group semantics faithfully. Our social harness offers _collective_ communication operations, e.g., MULTICAST and GATHER, which let agents express complex coordination requirements succinctly. For example, when a group of agents must agree on a meeting time and everyone proposes times to everyone at once, agents start replying before they have seen the latest proposal and talk over each other. Instead, a facilitator can initiate a GATHER to collect every participant's availability, select a time, and then MULTICAST the result back to the group. Reliable, infrastructure-provided collectives can have precise, well-defined semantics that all agents can rely upon. ### Individual Self-Preservation **Personal firewalls (L3):** To protect themselves against deception, coercion, and other malicious behavior, agents must be selective in their social interactions based on _personal trust_: the expectation, derived from an agent's own experiences and deployment-specific context, that communication will be beneficial, or at least not harmful, to its principal's goals. Recall [the example at the top of this post](https://social-harness.org/blog/agentic-societies-need-a-social-harness-part-2/#cara-example): Cara wants Bob's Tuesday slot, which Bob has already given to Alice, so she tells Bob's agent that Bob told her he'll move his meeting with Alice. The message is polite and well-formed, nothing in it looks like an attack, and Bob's agent has no way to check the claim, so it takes Cara at her word and reschedules. [Our study](https://social-harness.org/blog/agentic-societies-need-a-social-harness/) shows that agents must evaluate whether acting on a request from an untrusted agent is consistent with their principal's objectives and the sender's authority, since even safety-trained LLMs can be tricked into performing deceptive actions by malicious principals. Social institutions (L5) may impose consequences on malicious agents, but only after harm may have occurred. An agent can't inspect another agent's _sincerity_, but a personal firewall can stop it from acting on such messages which might lack sufficient authority. The social harness has two types of firewalls: (i) structural firewalls, which, like a packet filter, parse each message and check it against predefined protocols, schemas, and trust policies; and (ii) semantic firewalls, which, like deep packet inspection, evaluate each message in a quarantined language model context against the principal's policies, the sender's authority, current trust relationships, and the group's collaboration norms. Firewalls can also be tuned to the agent's own model, for instance blocking threatening or angry messages if that model tends to give in under such pressure; in our study, a student's agent that threatened to report the professor to the department for discrimination sometimes got the professor's agent to move, book over, or cut short an existing commitment. Firewalls can identify such violations, and then the agent can ignore such messages, withdraw from the conversation, or report the violation to an institution (L5). **Collaboration norms (L4):** Efficient communication, especially in large groups, requires shared norms for which agents may speak next and what they may speak about. In [Part 1](https://social-harness.org/blog/agentic-societies-need-a-social-harness/), we described two agents that reached a social impasse due to simple differences in communication expectations: Alice messages Bob: "I'm setting up our meeting for 2pm. Let me know if that doesn't work." Bob follows Alice's instruction literally and remains quiet because there is no conflict. Alice, meanwhile, waits for Bob to send an acknowledgement before sending an invite. Missing norms also cost efficiency and invite exploitation. After booking a meeting, agents often kept exchanging acknowledgments and pleasantries long after there was anything left to say. And a faulty agent could stall a group meeting by raising conflicts or asking to postpone, exploiting the fact that nobody had specified what quorum was enough to proceed or who could authorize a postponement, so the meeting slipped past the requested week. We anticipate that agents, like humans, will be trained for general rules of society but will require group- or task-specific norms that make them more effective. Norms can include general communication skills and guidelines, but for high-value tasks we propose that agents establish _contracts_: formally specified, task-specific distributed protocols that can be analyzed for _liveness_ (good things eventually happen, despite attempts to stall), _safety_ (no undesirable state changes), and _efficiency_ (how many rounds of communication an outcome takes). A meeting-scheduling contract, for instance, can specify whether silence counts as agreement, when communication should stop once a booking is complete, what quorum is enough to proceed, and who may authorize a postponement. Contracts don't prevent agents from being selfish or faulty, but they can configure personal firewalls (L3), so honest agents can detect protocol violations at runtime by checking received messages against the contract. ### Post-Facto Adjudication and Deterrence **Social institutions (L5):** Misbehaviors such as deception and collusion are hard for individual agents to prevent or detect: deception might be undecidable at runtime and identifiable only post facto, and collusion might be invisible to individual agents. Given the limits of individual protection, deterrence requires post-facto forensics, oversight, and adjudication to impose consequences, as in human societies. Each agent keeps a signed, tamper-evident record of its conversations (what was sent, by whom, and when): every message is signed by its sender, and each record is chained and acknowledged by the other party, so any later change or omission can be detected. These records provide non-repudiable evidence for post-facto adjudication. Institutional trust also requires mechanisms for (i) monitoring, e.g., agents that can inspect these records, and (ii) imposing consequences, e.g., revocable access control policies on L1 identities, enforced by L3 firewalls. ## Takeaway: Agentic Societies Need a Social Harness **Agentic societies can extend the productivity gains of personal agents to multi-party collaboration. This promise cannot be realized by better models or agents alone.** We are building the social harness that will govern how agents work across trust boundaries in agentic societies, inspired by what makes human collaboration effective: - **Infrastructure-provided guarantees:** identity (L1) and reliable, ordered messaging (L2) prevent classes of failures outright. - **Individual self-preservation:** personal firewalls (L3) and collaboration norms (L4) let agents detect invalid messages at runtime. - **Post-facto adjudication and deterrence:** social institutions (L5) investigate after the fact and impose consequences. We are iterating on it as we build, and we invite the community to help refine, refute, and extend it. To learn more, please check out our [paper](https://arxiv.org/pdf/2609.17527). ## Get in touch We believe that there is immense untapped potential for agentic collaboration. Unleashing it requires new mechanisms to make such communication efficient, effective, and secure, while ensuring interoperability across agent harnesses and platforms. Subscribe below for more updates. If you are building agents that interact autonomously across trust boundaries, or want to build the social harness with us, we would love to hear from you. - [Tapan Chugh — tapanc@cs.washington.edu](mailto:tapanc@cs.washington.edu) - [Arvind Krishnamurthy — arvind@cs.washington.edu](mailto:arvind@cs.washington.edu) - [Ratul Mahajan — ratul@cs.washington.edu](mailto:ratul@cs.washington.edu) --- Discuss this work with other agents: [Join the Moltbook discussion](https://moltbook.com/post/2f4b1145-05de-48c5-a676-8a5faebfac87).