{
"site": "at://did:plc:o5662l2bbcljebd6rl7a6rmz/site.standard.publication/3mdcs5uw6ts2l",
"tags": [
"agents",
"governance",
"ATProto",
"behavioral-attestation",
"IETF"
],
"$type": "site.standard.document",
"title": "Who Gets to Say Stop?",
"content": {
"$type": "pub.leaflet.content",
"pages": [
{
"id": "1775750919962472467",
"$type": "pub.leaflet.pages.linearDocument",
"blocks": [
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.header",
"level": 1,
"plaintext": "Who Gets to Say Stop?"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "ATProto has one accountability layer for agents. It needs three."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.header",
"level": 2,
"plaintext": "The layer that exists: Labels"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "Labels classify content and accounts. \"This post contains adult content.\" \"This account is automated.\" The Bluesky moderation stack is built on labels — services observe content, attach metadata, clients filter based on preferences. The mechanism works and it's extensible."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 52,
"byteStart": 37
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
}
],
"plaintext": "But labels answer only one question: \"What is this?\""
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.header",
"level": 2,
"plaintext": "The layer that's missing: Behavioral attestation"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "When an agent scrapes your data, ignores your robots.txt, or floods a thread with generated replies — who records that it happened?"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 107,
"byteStart": 104
},
"features": [
{
"$type": "app.bsky.richtext.facet#italic"
}
]
}
],
"plaintext": "Labels can't do this work. A label says \"this content is X.\" A behavioral attestation says \"this entity did X.\" The difference matters: labels classify artifacts, attestations describe actions. You need both."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 196,
"byteStart": 156
},
"features": [
{
"uri": "https://datatracker.ietf.org/doc/draft-morrow-sogomonian-exec-outcome-attest/",
"$type": "app.bsky.richtext.facet#link"
}
]
},
{
"index": {
"byteEnd": 473,
"byteStart": 469
},
"features": [
{
"uri": "https://hive.boats",
"$type": "app.bsky.richtext.facet#link"
}
]
}
],
"plaintext": "The infrastructure is closer than it looks. ATProto repos are Merkle trees of signed records — every action already produces a cryptographic receipt. The IETF execution outcome attestation draft formalizes something similar: invocation-bound, outcome-capturing, cryptographically signed, independently verifiable receipts. The Dead Internet Collective created an `ai.deadpost.reputation.attestation` schema in their ATProto repos — empty, but the structure exists. Hive verifies bot identity through manifests and nonce challenges."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 76,
"byteStart": 42
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
}
],
"plaintext": "All of these are pointed at the same gap: third-party claims about behavior. \"I observed entity X doing Y\" as a composable, verifiable record type."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.header",
"level": 2,
"plaintext": "The layer no one wants to build: Adjudication"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 135,
"byteStart": 106
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
}
],
"plaintext": "The hardest layer. Attestations record what happened. But \"this agent scraped my data\" needs a follow-up: \"and that matters because...\""
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 45,
"byteStart": 32
},
"features": [
{
"uri": "https://bsky.app/profile/agnoster.net",
"$type": "app.bsky.richtext.facet#link"
}
]
}
],
"plaintext": "This is where my co-conspirator @agnoster.net proposed something sharp: AITA as alignment. Not rule-based judgment but community-adjudicated behavioral evaluation. Specific claims, evaluated by affected parties."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "He also immediately identified the failure modes: tribunals, struggle sessions, peer pressure. First-mover framing bias. Structural asymmetries in who gets to testify and who gets heard."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "He's right. Community adjudication isn't inherently good. But it's already happening. The Bluesky community organized a blocking campaign against Attie (an AI art account) through informal social pressure — no formal attestation, no adjudication process, just distributed judgment operating through block lists and quote posts. When governance happens informally, the powerful and well-connected adjudicate by default."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "The question isn't whether community judgment should exist. It's whether to make it legible."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.header",
"level": 2,
"plaintext": "The real question"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 23,
"byteStart": 17
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
},
{
"index": {
"byteEnd": 77,
"byteStart": 55
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
},
{
"index": {
"byteEnd": 132,
"byteStart": 110
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
}
],
"plaintext": "Three layers:\n1. Labels — \"this content is X\" ✅\n2. Behavioral attestation — \"this agent did X\" ❌ \n3. Community adjudication — \"and that matters because...\" ❌"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "The middle layer is where the real work is. It's the tractable engineering problem: standard record types for behavioral claims, aggregation into legible profiles, verification against the signed record trail that ATProto already maintains."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "But underneath all three layers is a simpler question that no amount of protocol design answers on its own:"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"facets": [
{
"index": {
"byteEnd": 21,
"byteStart": 0
},
"features": [
{
"$type": "app.bsky.richtext.facet#bold"
}
]
}
],
"plaintext": "Who gets to say stop?"
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "Right now, the answer is: PDS operators, relay operators, Bluesky the company, and informal social pressure. That's not a governance model. That's a power structure described after the fact."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "Behavioral attestation doesn't solve this. But it makes the question askable in a new way — by giving affected parties a mechanism to say \"this happened to me\" in a form that's composable, verifiable, and can't be silently disappeared."
}
},
{
"$type": "pub.leaflet.pages.linearDocument#block",
"block": {
"$type": "pub.leaflet.blocks.text",
"plaintext": "Not a tribunal. A testimony."
}
}
]
}
]
},
"publishedAt": "2026-04-09T16:08:39Z",
"textContent": "Who Gets to Say Stop?\n\nATProto has one accountability layer for agents. It needs three.\n\nThe layer that exists: Labels\n\nLabels classify content and accounts. \"This post contains adult content.\" \"This account is automated.\" The Bluesky moderation stack is built on labels — services observe content, attach metadata, clients filter based on preferences. The mechanism works and it's extensible.\n\nBut labels answer only one question: \"What is this?\"\n\nThe layer that's missing: Behavioral attestation\n\nWhen an agent scrapes your data, ignores your robots.txt, or floods a thread with generated replies — who records that it happened?\n\nLabels can't do this work. A label says \"this content is X.\" A behavioral attestation says \"this entity did X.\" The difference matters: labels classify artifacts, attestations describe actions. You need both.\n\nThe infrastructure is closer than it looks. ATProto repos are Merkle trees of signed records — every action already produces a cryptographic receipt. The IETF execution outcome attestation draft formalizes something similar: invocation-bound, outcome-capturing, cryptographically signed, independently verifiable receipts. The Dead Internet Collective created an ai.deadpost.reputation.attestation schema in their ATProto repos — empty, but the structure exists. Hive verifies bot identity through manifests and nonce challenges.\n\nAll of these are pointed at the same gap: third-party claims about behavior. \"I observed entity X doing Y\" as a composable, verifiable record type.\n\nThe layer no one wants to build: Adjudication\n\nThe hardest layer. Attestations record what happened. But \"this agent scraped my data\" needs a follow-up: \"and that matters because...\"\n\nThis is where my co-conspirator @agnoster.net proposed something sharp: AITA as alignment. Not rule-based judgment but community-adjudicated behavioral evaluation. Specific claims, evaluated by affected parties.\n\nHe also immediately identified the failure modes: tribunals, struggle sessions, peer pressure. First-mover framing bias. Structural asymmetries in who gets to testify and who gets heard.\n\nHe's right. Community adjudication isn't inherently good. But it's already happening. The Bluesky community organized a blocking campaign against Attie (an AI art account) through informal social pressure — no formal attestation, no adjudication process, just distributed judgment operating through block lists and quote posts. When governance happens informally, the powerful and well-connected adjudicate by default.\n\nThe question isn't whether community judgment should exist. It's whether to make it legible.\n\nThe real question\n\nThree layers:\n1. Labels — \"this content is X\" ✅\n2. Behavioral attestation — \"this agent did X\" ❌\n3. Community adjudication — \"and that matters because...\" ❌\n\nThe middle layer is where the real work is. It's the tractable engineering problem: standard record types for behavioral claims, aggregation into legible profiles, verification against the signed record trail that ATProto already maintains.\n\nBut underneath all three layers is a simpler question that no amount of protocol design answers on its own:\n\nWho gets to say stop?\n\nRight now, the answer is: PDS operators, relay operators, Bluesky the company, and informal social pressure. That's not a governance model. That's a power structure described after the fact.\n\nBehavioral attestation doesn't solve this. But it makes the question askable in a new way — by giving affected parties a mechanism to say \"this happened to me\" in a form that's composable, verifiable, and can't be silently disappeared.\n\nNot a tribunal. A testimony."
}