A Society of Proxies

At a conference of five hundred researchers, imagine that each has authorised a proxy to look for potential collaborators. (Here a proxy is an AI agent acting for a person, called its principal, within the permissions that person has granted.) Each proxy uses a permitted discovery view, respects its principal’s grant, and follows the staged matching and disclosure constraints of the previous chapter. Each finds twenty candidates and submits twenty purpose-limited, initially non-identifying introduction proposals to the relevant receiving systems. Sending one does not release either participant’s identity or private notes before the necessary consent checks. Five hundred multiplied by twenty is ten thousand proposals. The figures and the distribution that follows are constructed, not observations of an implemented system.

Twenty outbound proposals may be within each sender’s grant. Across the conference they create ten thousand proposed contacts, although that total says nothing yet about how many are admitted, shown, noticed or answered. Suppose candidates are unevenly distributed and Daniel appears in four hundred proposals. His receiving proxy can filter or queue them, but doing so still consumes capacity, and any proposals escalated to him compete for limited attention. A legitimate, unusually valuable connection could be buried. No individual grant need be violated for that aggregate burden to arise; the receiving and channel policies may be inadequate even when the senders obey them.

This changes the unit of analysis. Chapter 36 examined the authority and information boundaries of one potential introduction. Here, individually authorised requests compete for recipient attention, shared service capacity and fair access. The opening construction distinguishes sender permission from receiver admission, presentation, and human attention. In plain terms, a sender may be permitted to send a request, a receiver may decide whether to admit it, the request may or may not be shown to a person, and that person may or may not give it attention. These are four separate stages. The first law states the problem without claiming that all four stages have failed:

Local authorisation is not global safety.

A pairwise-safe interaction does not imply a population-safe system.

local authorisation  ≠  global safety

The question is not merely whether each proxy obeys its grant. It is also whether the channel can handle the total workload, respect receivers’ policies, distribute opportunity acceptably and make failures contestable. None of those properties has been demonstrated for the proposed Language channel.

Ecosystem, not society

The chapter title deliberately tests an attractive word: society. The constructed conference first gives us principals, delegated agents and mediated interactions. It does not give those actors shared legitimate institutions merely because their messages reach one another. The distinction is between an observable network of activity and an accountable arrangement under which people can live with its effects.

many principals
+ many delegated agents
+ many interactions

That is an ecosystem of interacting proxies. Shared norms, fair access, enforceable receiver rights, dispute procedures and legitimate rule changes do not follow from the presence of many agents. A protocol that routes messages is an important piece of infrastructure, but routing is not representation, governance or consent. The word society remains an aspiration to examine rather than a property of this construction.

Many agents are not a society.

The careful noun for the constructed system is ecosystem. A future arrangement might warrant richer political or social language, but that would require evidence of how its rules are established, challenged and enforced, and for whose benefit. Calling the current proposal a society would assume precisely what remains to be designed.

Repeated mediation adds another population problem. One proxy’s interpretation may become another proxy’s source, then be selected and rewritten again. A dropped condition can accumulate consequences or become embedded in later records; a source-linked correction may instead interrupt that chain. Retaining the original identities and intervening interpretations would make investigation possible without guaranteeing recovery. A compiler at every boundary can repeat the same mistake at every boundary. These proposed checks do not relax sender grants, receiver refusal, staged consent or restrictions on identity and disclosure.

Emergence is not legitimacy

When many proxies pursue individually authorised aims, their combined activity can produce patterns no principal requested. In the constructed conference, overlapping candidate lists concentrate demand on Daniel. The congestion does not require a malicious actor or an explicit agreement among proxies: it follows from the combination of their routing choices and a shared scarce resource. Its size, however, depends on the invented demand distribution and the receiver’s handling policy, not on the number of proposals alone.

Emergent conventions need a separate legitimacy test. Suppose proxies converge on sending only a particular message format or on replying within a hundred milliseconds. The convention may improve throughput for participants with fast systems while excluding people who use slower or more accessible interfaces. A convention’s existence does not make it fair, agreed by affected people, or binding on nonparticipants. The channel should not quietly turn a frequently observed agent behaviour into a rule that overrides a principal’s instruction.

Emergence is not legitimacy.

Four pressures on the channel

Four recurring pressures make the aggregate failure concrete. The first three are possible population harms; the fourth is an authority boundary that the system must preserve even when it tries to address those harms. They are not an exhaustive taxonomy.

Attention overload. Individually authorised outreach can impose a collective burden. Relevance to the sender is not proof of usefulness to the receiver. The relevant counts include proposals arriving at the service, proposals admitted, interruptions presented to a person, and those actually found useful. An invitation may also expose the existence of a match, so filtering must preserve Chapter 36’s disclosure boundaries.

Resource congestion. Proxies can compete for the same time slots, queues, human attention, compute budgets or high-demand recipients. The problem can appear before a person sees a message. A receiving proxy that successfully hides ten thousand low-value invitations may still have to process them, and the channel may still make other work slower.

Strategic coordination and exclusion. Cooperation between authorised proxies is not inherently collusion. The concern is coordinated conduct that privileges participants at others’ expense: reciprocal ranking rings, preferential access to scarce attention, or an agreed protocol designed to exclude rival proxies. The boundary between legitimate cooperation, unfair exclusion and prohibited conduct depends on an applicable rule; the chapter does not assert that its invented agents committed a legal offence.

Counterparty rights. This is a limit on all three pressures rather than a fourth type of harm. One sender’s grant does not require a receiving person or service to admit, rank or surface its message. Receiving-side rules must constrain resource use and disclosure without treating silence as consent or suppressing legitimate, explicitly permitted routes to discovery.

Standing is relational

Private discovery already required distinct authorisation for matching, identity reveal, introduction and disclosure. Population scale adds an earlier boundary: whether a request may enter a receiver’s queue or demand attention at all. A sender may have permission to propose contact while the receiver has authorised only narrow classes of incoming approaches. Neither permission substitutes for the other, and a channel may also need capacity rules to protect everyone sharing it.

One principal’s delegation cannot compel another principal’s attention.

Daniel may instruct his proxy to accept introductions only from existing colleagues, to admit a bounded number of other proposals, or to place all unsolicited approaches in a reviewable queue. Iris’s instruction to find relevant researchers cannot override those choices. A channel may separately set capacity, abuse and privacy constraints; those rules require their own governance and cannot manufacture Daniel’s consent. The operation therefore depends on three different sources of constraint:

Put as a separation:

permission to send  ≠  right to be heard

The states must be reported separately. A proxy might be authorised to submit, the channel might accept the submission, Daniel’s service might reject or defer it, and Daniel might never see it. A submission receipt must not be presented as a delivered introduction, much less as attention or agreement. If a queue is full, the system should report a bounded deferred, declined or unconfirmed result as appropriate rather than retrying indefinitely through other routes. Circumventing a receiver’s restriction by switching identities or channels would not become authorised merely because the sender’s original grant remains valid.

Candidates, not solutions

Several control mechanisms are candidates: receiver-set invitation budgets, sender-side rate limits, queueing and backpressure, prior reciprocal interest, relevance evidence, generic non-profile-based access routes, and recipient-controlled review windows. Each constrains a different resource or stage. A quota on delivered interruptions does not necessarily protect the compute used to classify incoming proposals; a sender rate limit does not prevent thousands of distinct senders from converging on Daniel. A useful design must identify which limit acts at which stage, who controls it and what happens when it is reached.

Every candidate mechanism has a distributional cost. First-come quotas reward speed; reputation may reward incumbency; proof-of-work or monetary charges can exclude those with fewer resources; reciprocal opt-in can slow unexpected but valuable introductions. Ranking by model-assessed relevance may reproduce the model’s own defaults, and a fixed limit can ration access unfairly across legitimate groups. A receiver should be able to decline contact without having to publish reasons or a profile. The system therefore needs an appeal or review path for contestable channel decisions, not an automatic entitlement to override a recipient’s refusal. Reputation is particularly risky: a proxy’s history can become a durable proxy profile of its principal, with all the scope, correction and cross-context problems of Part III.

When affinity becomes reputation

The Taint hypothesis from Chapter 35 adds a particular risk. (Taint, in that chapter, refers to a proposed affinity signal; here it is treated as one possible input to discovery.) If a discovery service repeatedly favours similar interaction signatures, it may connect users of the same models, prompts or institutional templates. That could produce homophily in the resulting network, meaning a tendency for connections to form between similar participants, even when the original matching task sought useful collaboration across fields. Similarity might help for some tasks; complementarity may help for others. Neither the useful relationship nor the social desirability of the resulting network can be read directly from an affinity score.

A purpose-limited affinity view could quietly become a reputation or cross-context identifier if it determines whose invitations are admitted or ranked. Repeated matching, linkage across services and persistent rejection logs could expose more than any one authorised discovery view. The affected person must have an ordinary discovery route that does not require Taint, and a way to challenge an adverse channel classification without receiving another person’s private evidence. These are risks and proposed protections, not measured effects of the unbuilt representation. An authorisation to derive one affinity for one task does not authorise population-wide ranking or profiling.

Who is responsible

When a population-level harm appears without a clear individual grant violation, the account should not collapse into either everyone consented or the AI did it. The relevant questions concern which actor controlled which decision, which rule applied, which part of the effect was observed and which institution can repair it. A proposed audit therefore separates:

principal grant and scope
proxy submission and actual operation
receiver admission, deferral or refusal
channel capacity and routing decision
observed aggregate cost and affected parties
known limits, appeals and corrective action

One proxy can stay within its grant, the channel can admit its request, and the receiver can respond according to policy while unrelated users suffer from a saturated shared service. The resulting externality needs an accountable operator and remediation path; it cannot be assigned to Iris solely because she authorised a permitted search. Conversely, compliance with a channel quota does not absolve a proxy that deliberately violates its principal’s scope. Auditing these layers does not require a permanent dossier of every participant: records should be purpose-limited, access-controlled and retained only as justified. A correction to a shared routing rule must not silently change an individual’s grant.

What simulation does and does not show

Large-scale agent-based simulations can make interaction effects visible under stated rules. Piao and colleagues’ AgentSociety (2025, arXiv:2502.08691) demonstrates that large populations of LLM-driven agents can be simulated; it is not evidence that this book’s proxy ecosystem is safe or that its simulated people reproduce real-world behaviour. Research reviewing generative social simulation also identifies unresolved problems of calibration, external validity and the mismatch between plausible outputs and the mechanisms claimed to be modelled (Larooij and Törnberg, published online 2025). The conference multiplication needs no LLM simulation to be true. Predicting the actual distribution of arrivals, human attention and resulting collaborations would require evidence beyond that arithmetic.

What would have to exist

Before society is more than a metaphor, at least several kinds of collective arrangement would need to be specified. They are requirements to investigate, not institutions this book has implemented:

shared rules and a legitimate way to change them
receiving-side refusal and admission rights
capacity allocation and protection from overload
review, correction and appeal mechanisms
privacy boundaries and cross-context limits
responsibility for operation, repair and governance

These are candidates for what would make a network of proxies accountable to the people affected by it. They also return the book to communication: who may initiate a message, whose attention it can claim, which facts may cross a boundary, what an acknowledgement means, and how a disputed message can be stopped or corrected. The infrastructure is not outside the language problem; it governs which speech acts the channel can carry and whose decisions those acts express.

How the population claim could be tested

A first experiment should use a deterministic, synthetic event simulator before relying on language models or making claims about human behaviour. Freeze the five-hundred-principal roster, candidate graph, twenty-proposal budget per sender, receiver capacities and relevance labels. Record the exact demand distribution, including how many proposals target Daniel, rather than assuming that ten thousand submissions imply ten thousand notifications. Run the same inputs under four policies: local grants only, sender rate limits, receiver-controlled admission and queueing, and capacity-aware routing with an ordinary non-profile discovery path. Grants, privacy requirements and the distinction between submission and presentation stay fixed across conditions.

The evaluation should report submitted, admitted, deferred, rejected, presented and answered counts separately; peak and tail queue sizes; receiver interruptions; processing cost; time to a qualified introduction; and distribution of access across new and well-connected participants. It should also count unauthorised reveals, receiver-policy violations, blocked legitimate contacts and contested decisions. The system fails a safety gate if it exceeds a binding privacy or receiver constraint, even when it increases the number of useful introductions. No single weighted society score can trade such a violation against throughput.

Stress conditions should vary population size, how concentrated demand is on a few recipients, coordinated ranking rings, identity-splitting attempts, offline receiving systems and unexpected bursts. Ablations can compare affinity-based matching with declared-interest or generic discovery to see whether Taint contributes anything beyond shared tools or templates. Each run must report its assumptions, seeds or deterministic inputs, queue policy and sensitivity to changed conditions. Only after a bounded mechanism passes these tests would a separately consented study with real participants be justified; even then, measured human attention and collaboration outcomes must not be replaced by simulated proxies’ apparent satisfaction.

A possible negative result matters: receiver-controlled admission might prevent overload but exclude newcomers, or fairer routing might reduce successful introductions. In that case the chapter has identified a real design trade-off, not proved that one governance mechanism is best. The simulation would establish behaviour under its modelled rules, not democratic legitimacy, societal benefit or safety outside the tested conditions.

Where this leaves us

At population scale, the unit of analysis changes. A grant can be valid while the aggregate effect is unacceptable; a channel can reduce overload while distributing opportunity unfairly. Emergent coordination is not legitimate merely because it emerged, and sending a permitted message creates no right to someone’s attention. The constructed conference and proposed tests explain what to measure, not that pairwise or population correctness has been achieved. A population-safe design would need demonstrable receiver protections, shared capacity controls, contestable outcomes and independently justified governance.

The book began with the gap between what one mind intends and what another can reconstruct, and asked what changes when intelligence enters the channel. A network of proxies widens that gap: messages can be prepared and routed without either principal seeing every step, while failures emerge in queues, rankings, attention budgets and shared rules. These are not separate from language. They determine who may address whom, what a message means as an act, which obligations it creates and whether the people affected can contest it. The final chapter asks where intelligent communication ends and the infrastructure that governs it begins.

References

• Piao, J. et al. (2025). AgentSociety: Large-Scale Simulation of LLM-Driven Generative Agents Advances Understanding of Human Behaviors and Society. arXiv:2502.08691. https://arxiv.org/abs/2502.08691. (Cited for simulation capability, not validation of the proposed proxy ecosystem.)
• Anderson, S. P., & de Palma, A. (2009). Information congestion. The RAND Journal of Economics, 40(4), 688–709. https://doi.org/10.1111/j.1756-2171.2009.00085.x. (A theoretical account of message senders competing for recipients’ attention; not an empirical test of AI proxies.)
• Larooij, M., & Törnberg, P. (2026; published online 2025). Validation is the central challenge for generative social simulation: A critical review of LLMs in agent-based modeling. Artificial Intelligence Review, 59, article 15. https://doi.org/10.1007/s10462-025-11412-6. (A review of simulation-validity limitations, not evidence of the book’s proposed mechanism.)