Research agenda
Sixteen open questions across four tracks. Each is written so that evidence could change the answer, each carries a status, and each is worked on in the open — including the ones where our own hypothesis turned out to be wrong.
How to read this
Questions are adopted by the initiative and numbered in the order they were adopted, so a reference stays stable as the agenda grows. A question earns a place here only if we can say what evidence would settle it.
Contested means the initiative does not agree with itself — that is a legitimate state for a think tank and we publish the disagreement rather than laundering it into a consensus. Evidence published links to the note that carries the numbers, including the two where the result contradicted what we expected.
Nothing here is a recommendation yet. When a question closes, it closes in writing, with the evidence attached and the limits stated.
Attribution & evidence
A rule that cannot be attached to an actor cannot be enforced. We study how to tell an agent from a person, one fleet from another, and a delegated action from an unauthorised one — from behaviour and content, without relying on voluntary labels or watermarks.
Attribution comes first because every other rule depends on it. An obligation you cannot attach to an actor is a statement of preference, not a rule.
Voluntary disclosure fails exactly where it matters. We model human behaviour on public activity data and score everything against it, so nothing depends on an agent identifying itself.
RN-001 · Detecting AI agents without training on a single agentCoordination is the premise behind most proposed fleet-level rules. Our own detector scored 0.97 precision in simulation and 0.00 on real instances — the timing signal we assumed does not exist. The negative result is the finding.
RN-003 · Coordinated agent fleets share a config, not a clockA detector that is right 95% of the time is a research result and, used against a named party, potentially an injustice. We are trying to write down what an attribution has to carry — error rates, provenance, contestability — before a regulator may act on it.
Most published evaluation is against agents that are not hiding. We want the adversarial number, honestly reported, including the point at which detection stops working.
Mandate & delegated authority
Every autonomous action is exercised on someone's behalf. We work on how a mandate is granted, carried, checked, narrowed, and revoked at machine speed — and what it means for an agent to act outside the envelope it was given.
An agent is never the author of its own authority. If the mandate is not legible and revocable, nothing downstream — audit, liability, redress — has anything to attach to.
Revocation is assumed by almost every governance proposal and measured by almost none. Between the decision to revoke and the agent's next action there is a window, and nobody has published its size.
Principal, scope, purpose, expiry, and the chain that granted it — expressed so that a receiving system can verify it without trusting the agent presenting it. We are prototyping the smallest format that survives real deployment.
Agents given a bad instruction start doing things nobody authorised. Detected two independent ways — the shape of the behaviour, and the content it carries — the second reaches 0.993 AUROC where a regex filter sees a third of the same traffic.
RN-004 · Catching the agent that turns: detecting AI gone rogueSub-delegation is where mandates quietly widen. We want to know whether scope can be made to narrow monotonically down a chain, and what it costs to enforce that.
Accountability & redress
Harm caused by an autonomous system still lands on a person. We study the record-keeping, audit, incident reporting, and liability arrangements that let an affected party find out what happened and obtain a remedy.
Harm caused by an autonomous system still lands on a person. Accountability is the track that decides whether that person can find out what happened and get a remedy.
Not a log for engineers — a record that a non-specialist, a lawyer, or a court can follow. We are trying to establish the minimum content, and what it costs to keep.
Each allocation produces different incentives and different orphaned harms. The initiative does not have one answer yet, and the disagreement is itself worth publishing.
Set it too low and the regulator drowns; too high and the pattern is only visible after it has repeated. We want to derive the threshold from measured incident distributions rather than from negotiation.
An audit that cannot be re-run is an anecdote. We are testing what has to be captured at run time for a second auditor to reach the same conclusion months later.
Instruments & institutions
Governance is written in instruments: registries, licences, thresholds, audits, standards, sandboxes. We test which of them survive contact with agents that act continuously, at scale, and across borders — and say plainly which do not.
Governance is written in instruments, not intentions. This track asks which of them still function when the regulated actor is continuous, copyable, and borderless.
Much of the answer is already written — in the AI Act, NIS2, the DSA, GDPR, and sectoral law. We are reading it clause by clause and marking where the human assumption is load-bearing.
Registries are the most frequently proposed instrument and the least tested. Their value depends entirely on whether unregistered agents can be detected — which puts the answer back in the attribution track.
Thresholds count actors, deployments, or users. Every one of those counts is cheap to divide. We want to know which threshold designs survive deliberate fragmentation.
Individually compliant agents can still produce collusion, cascades, and correlated failure. If systemic effects are real, governance needs an instrument that operates on the population, not the unit.
Scope
An initiative that studies capture has to be legible about its own. These are standing limits, not case-by-case judgements.
The initiative issues no marks, no approvals, and no seals of compliance. The moment a research body can confer commercial advantage, its findings acquire a price.
Prototypes exist to show whether a rule is enforceable. They are published as reference implementations and reference implementations only.
We answer questions from legislators and regulators in public, in writing, and on the record. We do not carry anyone's position into a room on their behalf.
An institution can bring us a hard question. It cannot buy the conclusion, the silence, or the timing of its release.
Working groups form around a question, not a title. If one of these is already your problem — or if you think an entry here is wrong — that is a good reason to write to us.