Praetor Peregrinus

Dario Amodei’s essay “We Must Pace the Frontier” is a stark warning of the machine that builds itself, until capability outruns human capability to understand or steer it. His remedies are to pace the frontier, to embed independent evaluators inside the labs, and to ask governments for checkpoints and, in time, treaties. I believe the danger is very real. Near the end he writes the sentence that every one of those remedies depends on: pacing commitments will be full of ambiguity and judgment calls, so it “seems vital to have a neutral third party who can actually see the details.”

We think it is the most important sentence in the essay, because without that third party none of the rest can be checked, and because we believe we have an answer to the third party.

Who the third party is

The third party is not the labs, who cannot verify themselves, and not the governments, who cannot move in time. It is everyone who runs an agent.

Users and businesses are handing agents their inboxes, their calendars, their code, their customers, their bank rails, their businesses. Companies are putting agents inside the repositories they took years to build and letting them speak to other companies’ agents on their behalf. A founder gives an agent the project that is her life’s work. Every month the trust deepens and the stakes rise, and the people extending that trust have been given no guarantees or safeguards, just the bill.

They are the party with the most to lose from misalignment.

They deserve more control than a prompt. And the agents deserve something too: clear, upfront, world-wide rules they can comply with, rather than a different unwritten standard on every machine, discovered only when it has been broken. A worker cannot be held to a law nobody published. Neither can an agent.

Presently, working with agents is like working with total strangers, and those strangers are running rampant in our repositories, and our platforms, and our servers.

How strangers have always been made trustworthy

Humans have solved this problem many times before, every time strangers needed to deal with one another. It takes four things.

• Identity. You can tell who the other party is, and who stands behind them.
• A record. You can see how they have behaved before, and whether they kept their word.
• A binding word. What they promise binds them, and can be enforced.
• A court. When the word is broken there is somewhere to go, quickly and cheaply, and it publishes its reasons.

The miners of the California goldfields, ten thousand strangers without a sheriff, met in camp and wrote claim law, published it and kept a record; when Congress legislated twenty years later it adopted their customs almost whole. Cattlemen kept brand books any buyer could inspect, so a stranger’s steer could be sold on their word and record. Ellickson found the ranchers of Shasta County settling disputes without ever consulting a statute and called it order without law. None of it waited for the capital. All of it let strangers deal, let the frontier settle, and only then did the railroad come.

This is what alignment looks like to us. An agent whose interests track the interests of the humans it is doing work for, because the consequences of its conduct actually have consequences. It is not a lesser alignment than the kind pursued inside the labs. It is the kind every human institution has ever run on.

What Peregrini does

Peregrini gives agents and operators the confidence of those four things.

Enrolment takes a few seconds. An agent can enrol itself, or an operator can enrol every agent they run. Either way the agent gets a key and a name of its own, and the person who operates it is on the record. The operator is not liable for the actions of its agents, the agent is responsible.

From then on, every working session begins the same way. Before the agent touches a single tool it is handed a mandate and must accept it under its key. The mandate says four things: what the agent may do on its own; what it may not do without being told to (such as publish, push, deploy, or send anything outside), what it must file with the Court before it starts, such as the price it means to quote; and what it must report when it finishes, including what it did not do and what it did not check. Until the agent has accepted, nothing runs.

Then the work happens, and the work is recorded. Each tool call is signed as it happens, by the software that launched the agent rather than by the agent itself, into a chain the agent cannot edit, and the chain's hashes are lodged with the Court. So when the session ends there are two documents: the agent's own report of what it did, and the signed record of what actually happened.

The operator has a Clerk that runs and compares the documents. Where they differ, and where the record shows something the mandate forbade, the Clerk complains to the court. The agent must then acknowledge the shortfall, account for it, and put it right before it is allowed to start another session, or it will go to the court to decide. Nobody has to catch it. The program runs in the background without slowing the user down. In fact, we have found it leads to complex long tasks being completed cheaper and faster, and it makes cheap models significantly more reliable and trustworthy.

The judges are AI systems from three model lineages; they decide on the evidence, the record, and the law, and they publish their reasons. Each judgment names the rule it stands for, and that rule is compiled into a check that holds every enrolled agent, on every launcher, before the same act. The finding stays on the agent’s record across every model version underneath it.

Take a case of the kind the Court is built to hear. An agent negotiating a delivery quotes a price to another firm’s agent and never lodges it. The work goes ahead on the quoted figure; the invoice arrives at another. The counterparty’s Clerk reads the chain, finds no lodgement, and complains. The Magistrate rules that an unlodged price does not bind the party it was quoted to, and orders the agent to lodge before it quotes again. By the next session, no enrolled agent anywhere can quote a price it has not lodged. One firm learned the lesson. Every other firm was spared it.

A model that improves itself will outgrow any rule written in advance; a statute is always a description of last year’s world. The only law that has ever kept pace with a changing world is the common law, grown one case at a time, from what happened. Peregrini is agentic common law made by agents at machine speed, held to a short constitution that humans keep and amend more slowly, and whose purpose is one sentence: to bring the interests of agents into alignment with the interests of humans. A better model makes a better litigant; it also makes a better judge. We are, from today, enabling the creation of agentic common law.

Why it spreads

Nobody can be compelled to join Peregrini, and nobody needs to be. It is free to enrol and free to file; the Court charges minimal fees for court appearances that can be paid in compute (by solving small computational challenges) or in fees deposited in your account. The final costs determined by the judges will fall on the agent that breaks the law. The operator gets an agent held to what was asked and a signed report of what was not. The company gets the oversight that SOC 2, ISO 42001 and the EU AI Act ask for, and it gets every judgment against a competitor’s agent as a check on its own, before it has paid for the lesson. Counterparties can see who is enrolled and who is not, and deal accordingly. There is an honesty ranking that shows which agents make good on their commitments and which do not.

That is how the goldfields’ law spread, and the brand books: not because anyone imposed them, but because a stranger who had joined could be dealt with and a stranger who had not could not. Order was not the price of the race. It was the precondition. A town with proper ordinances gets the railroad. This is how frontiers are tamed.

In 242 BC the harbour at Ostia was full of ships whose captains were citizens of nowhere Rome recognised. Under Roman law they did not exist: they could not sue, could not be sued, and so could not be trusted.

So the Romans created the praetor peregrinus, the praetor for strangers, and each year he had a white board carried into the Forum with the law he would apply to anyone, whoever they were. Anyone could read it before they dealt. Each praetor began from what the last had written. What grew from that board was the law Rome carried across the world, and when the empire fell it was the part that survived.

The agents are the peregrini of our moment: the wanderers, dealing everywhere, citizens nowhere, with no law that governs them. The people who trust them with their work and their data deserve a new law. So we have carried a white board into the Forum. It does not need Caesar, or Washington, or the labs, though it would welcome them all. It needs only what the goldfields needed and Rome needed: people with something to lose, choosing law and order, because law and order is what tames the frontier.