The case
A41 §8 names it “Robust Governance Under Internal Compromise”, with the research question: “Under what conditions can a distributed organization preserve essential functions and its capacity for self-revision when some constituent processes are faulty, adversarial, or pursuing divergent objectives?”
The design (A41 §7). Extend the planned multitask learner “with three types of constituent processes: ordinarily cooperative specialists, honest but systematically dissenting specialists, and adversarially manipulated specialists.” Compare four architectures:
| Architecture | Governing mechanism | Potential failure (A41) |
|---|---|---|
| Unrestricted influence | All processes can shape aggregate updates | ”Vulnerability to manipulation” |
| Reliability-weighted influence | Historical performance determines authority | ”Self-reinforcing capture or unfair suppression” |
| Role-limited governance | Separate authority for proposing, criticizing, approving and auditing | ”Coordination cost or collusion” |
| Adaptive governance | Role limitations plus internally revisable safeguards | ”Manipulation of the revision mechanism itself” |
Measures: “not only attack success but also the loss of legitimate capabilities, suppression of honest minorities, cost of safeguards, and the ability to revise governance after failures.”
Two variants:
- Compromised evaluators. “One particularly revealing experiment would compromise the processes responsible for evaluating other processes’ competence. That tests whether the organization has any genuinely independent means of checking its own allocation of authority.” This is CLAIM-342’s thesis put to an attack: what keeps a loop from confirming itself is evidence whose arrival or scoring does not pass through what it tests. Here the scorer is itself the insider.
- A legitimate novelty that looks like an attack. “introduce a novel task whose solution initially resembles suspicious behavior. A resilient but rigid organization may reject it; an adaptively robust organization may find a bounded way to test and eventually incorporate it.”
Testbed. A41 §6: in federated learning, participants send model updates to a shared learner and some may be wrong, biased or malicious. Local update maps to a process’s proposed transformation, aggregation weight to effective influence, robust aggregation to governance under compromise, and “Distributed but valid minority signal” to “Productive difference that should not automatically be suppressed”. The robust-aggregation literature A41 cited is the anthology’s (ANTH-LIT-257, ANTH-LIT-344 hold Byzantine-robust learning there).
Held fixed across arms: the tasks, the population of specialists and the attack class.
What it can show
That safeguards which block capture cost legitimate learning, and how much, for each architecture: the trade-off CLAIM-359 asserts, measured. A positive result for adaptive governance would show the trade-off can be moved, not that it is absent. The evaluator variant would show whether role-limited audit gives independent scoring or only relocates the single point of failure.
It is stipulated and unrun. It shows nothing yet. Its results would be about the designed population, whose objectives the modeller fixes, so by CLAIM-288 it can test the governance claims and not that the organization constitutes itself. Which specialists count as “honest but dissenting” is fixed by the designer, which is exactly the judgment a real organization lacks (QUESTION-087).
Note of 2026-10-23: the honest-dissent arm has a human analogue
Cited at A5 of the exchange of 2026-10-23, “Framework Overview Request”. In three-person human groups, prediscussion dissent improved hidden-profile decisions even when the dissent was itself wrong, and its size did not matter (Schulz-Hardt et al., LIT-1409); making members’ preferences known degraded attention to the information (Mojzisch and Schulz-Hardt, LIT-1403). Both are Unavailable and read from abstracts (QUESTION-089’s note). So suppressing honest minorities has a measurable cost in people. They say nothing about adversarial members or governance architectures. A5 also cited a comparison of Byzantine-robust federated-learning methods under heterogeneous data, which was not identified with confidence and is not filed. CASE-144 proposes the evaluator-compromise test in a form that bears on this case and CASE-092 at once.
Note of 2026-10-29: a bound for collusion, and a score that can be farmed
Three of the works behind A41’s design are now read, two of them in part.
- Castro and Liskov, LIT-1217 (NOTE-1356). The role-limited arm’s failure, “coordination cost or collusion”, has a quantitative counterpart there: the quorum design tolerates collusion of up to f members of 3f + 1 and nothing beyond. The study could report its results against such a bound. The variant that compromises the evaluators corresponds to a faulty primary, which that protocol survives because the primary’s proposals are checked by everyone and the role rotates.
- Zero trust, LIT-1226 (NOTE-1371). The reliability-weighted arm, with its failure “self-reinforcing capture or unfair suppression”, is close to a score-based contextual trust algorithm, whose confidence rises with a history of normal behaviour. The document does not consider that such a score can be farmed.
- The SEI insider-threat guide, LIT-1216, skimmed (NOTE-1355). Its own separation-of-duties case is a failure by collusion, four insiders splitting the steps the separation was meant to keep apart: the role-limited arm’s failure, observed.
The design is unchanged.
Note of 2026-10-29: Edmondson, read
Edmondson 1999, LIT-1220, which CLAIM-359 takes as A41’s anchor for the cost side, is now read (NOTE-1404). The “honestly dissenting” specialists are the role its construct, team psychological safety, protects: in 51 work teams of one company, members’ belief that speaking up will not be punished went with the team’s asking, admitting and questioning. The evidence is cross-sectional, and its teams are cooperative, with no adversarial or compromised members. It bears on why the honest-dissent arm matters, not on what protecting it costs, which is what this design scores. The design is unchanged.