When an Accusation Costs the Accuser Nothing

An autonomous agent that can file a complaint about another agent for free will eventually file a great many of them. The traffic looks nothing like an attack: each message is well formed, plausible, and arrives at a normal rate from an endpoint with a clean history. What makes it corrosive is volume against breadth, one party writing adverse entries into the governance state of many counterparties at little or no marginal cost, while every recipient spends real resources evaluating what it received.

That is the shape of the problem wherever reputation carries weight between agents. Anything letting one participant move another's standing is a write into that participant's state, and free writes invite predictable behavior. Systems that respond by adjudicating each accusation inherit a worse problem: they must decide truth, at scale, on evidence they do not hold.

Cost is the older answer. Make the action expensive enough that volume stops being free, and much of the abusive population loses its economics without anyone deciding who was right. The interesting question is where the cost lands.

What Arkose Labs Built, In Its Own Terms

Arkose Labs is a bot management and fraud prevention company whose publicly stated premise is economic: rather than trying to block every automated request, raise the cost of the attack until the attacker's business case no longer closes. As the company describes its platform, risk assessment of incoming traffic is paired with graduated enforcement, so that traffic assessed as low risk passes with little or no friction while traffic assessed as suspicious is met with challenges that are cheap for a person and comparatively expensive to solve by automation at scale. That attacker-economics framing runs through its public positioning on bot mitigation, account takeover, and fake account creation.

The design is coherent and well aimed. Cost lands at the boundary of a protected property, which is where an operator holds both the authority and the signal needed to impose one, and the friction is calibrated to the question actually being asked there, which is whether to admit the request.

The abuse this category addresses is human-versus-automation pressure on a service operator's public surface: sign-up, login, checkout, scraping. The party paying the cost is typically an unauthenticated visitor with no prior standing, and the payment takes the form of effort at the moment of access.

Pricing the Assertion Against the Asserter's Own Budget

Chapter 4 of U.S. Provisional Application No. 64/117,812 places a cost on a different act. When a semantic agent (100) issues a conduct evaluation artifact (116) concerning conduct it alleges another agent performed, the issuance is priced against the issuing agent's own authorization budget (404). The same quantity that gates the agent's ability to execute is what pays for its assertions about others.

The accounting is held in an assertion-cost counter (400) carried in the issuing agent's memory field (102). An issuance accumulator counts increments within a metering window declared in the signed policy object (112). A per-recipient-class register maps each origin-equivalence class (200) of receiving parties to a Boolean recording whether that class has already contributed an increment in the current window. A budget floor field, an epoch reference, a budget reference, and a decrement schedule complete the structure, the schedule specifying an amount greater than zero by which the budget falls per increment.

Issuance follows an ordered procedure. The agent builds the artifact from entries of its own append-only lineage field (104), computes the origin-equivalence class (200) of the receiving party, and consults the register: a class already counted this window adds no increment, a class not yet counted increments the accumulator by one. The authorization budget (404) is then decremented by the scheduled amount. The filing is explicit that the units of that decrement and the units gating dispatch of the agent's own actions are identical, with no conversion, no exchange rate, and no separate budget denominated in channel access, rating weight, or staked value. The agent advances its dynamic agent hash chain to a successor epoch, attests the accumulator state and the epoch identifier inside the artifact, and appends all of it to lineage.

The design point the filing dwells on is symmetry. A separate chapter of the same filing governs the agent in the role of evaluated party, and this chapter, which governs it as asserting party, is described as that chapter's mirror, the two roles being governed by one authorization budget (404). On this side the decrement attaches without any adjudication of the merit of the assertion. An artifact later resolved to the accepted, rejected, not-determinable, or not-applicable determination bears one and the same decrement.

Two further properties keep the meter honest. Metering runs in successor epochs generated from a prior epoch, an unpredictability contribution, and a volatile salt, so a successor epoch is not computable in advance by the issuing agent and not computable at all by anyone else; the epoch identifier is not a wall-clock timestamp and is not drawn from a clock available to the hosting execution node, so advancing the meter by clock manipulation does not work. And where an issuer emits several artifacts attesting a common accumulator state, they carry a common epoch identifier, which a receiving agent holding a prior artifact with that identifier detects from its own counterparty identity record (114).

Verification happens at receipt. A receiving agent confirms that the attested epoch identifier is a valid successor of one it previously recorded for that issuer, and that the attested accumulator state is not less than a state previously attested. An artifact failing either test, or arriving with no attestation, is appended to lineage and not admitted to the admission evaluator (120): it produces no determination, moves no value of the scoped integrity vector (106), and increments no counter. A receipt-verification register caps how many verifications a single origin-equivalence class (200) of issuers can compel within a declared window. An issuer that over-splits its classification of recipients to reduce its own increments is caught when the recipient recomputes the assignment and appends a class-splitting divergence record.

Replenishment is deliberately narrow. The authorization budget (404) is replenished by one procedure and no other: receipt of an admitted artifact originating from an origin-equivalence class (200) absent from the replenishment register (402), in an amount from the budget replenishment schedule (406), bounded above by an authorization budget ceiling (408), with any excess discarded rather than carried forward. That amount is less than the per-increment decrement, so an agent cannot finance a volume of issuance out of the receipts its own issuance provokes. Elapsed time replenishes nothing, and neither does expiry of a metering window.

Where the budget satisfies the declared floor, the authorization gate (300) is written to the withheld state (310) for an enumerated set of action classes and the agent enters the non-executing cognitive mode (302) for those classes. Its capacity to issue artifacts is not what gets withheld; its capacity to execute is. While at or below the floor it attaches no attestation, and unattested artifacts do not verify at receipt. By the filing's own illustration, one unit per increment against a budget of forty units means an issuer reaching sixty distinct classes in a window exhausts the budget at the fortieth increment, the remaining twenty issuances carrying no valid attestation.

Same Economics, Different Ledger

Both approaches accept that abuse is an economics problem before it is a truth problem. From there they part on four axes, solving adjacent problems rather than competing for one.

  • Who pays. The vendor category imposes cost on an unauthenticated party seeking access to a protected surface. The disclosed architecture charges an identified, budgeted participant for writing into someone else's governance state.
  • What the cost is denominated in. Challenge-based friction is denominated in effort spent at the boundary. The filed mechanism is denominated in the agent's own execution capacity, in identical units, with no conversion computed.
  • Who verifies. The disclosed architecture requires the recipient itself to verify the attested counter state before admitting the artifact, and the filing states that the mechanism depends on no party other than the two parties to the exchange.
  • What replenishes. The filed design restores budget only on exposure to an uncounted counterparty class, below a policy-declared ceiling, which makes narrow high-volume assertion self-limiting in a way time-based recovery would not.

A defense sited at the access boundary answers whether a requester should be let in. Chapter 4 answers a question that only arises after entry, among participants already authorized: what does it cost you to say something adverse about someone else, and who checks that you paid.

Where Each Layer Sits

An operator running agent-mediated workflows plausibly wants both, at different depths of the stack. Boundary risk assessment and graduated enforcement of the kind Arkose Labs publicly describes address traffic arriving from outside, where identity is not yet established and the operative question is whether to admit the request at all. Assertion pricing under the filed chapter operates inside a population of agents that already hold credentials and budgets, where the concern is not intrusion but the cheap, high-volume adverse write.

The integration surface between the two looks thin, which is a point in favor of running them together. The disclosed mechanism draws on the issuing agent's own lineage field (104), assertion-cost counter (400), and signed policy object (112), and it places the verification step at the receiving agent under Section 4.4 rather than at an intermediary.

For an operator evaluating both, the practical questions are these. Is the abuse you fear arriving from outside your perimeter or circulating among parties you already admitted? Do your participants hold a single quantity that gates both what they may do and what they may say about others? And when a participant asserts, who verifies that the assertion was paid for: the participant, a central service, or the party being written about?

Disclosure Scope

This article describes subject matter disclosed in Chapter 4 of U.S. Provisional Application No. 64/117,812, and architectural statements here are confined to that chapter. Other chapters of the same filing govern related subjects, and no mechanism from those chapters is asserted here. Quantities described as declared in a signed policy object are policy-declared, and the forty-unit budget and sixty-party figures above are the filing's own illustration rather than a recommended value. Outcomes the filing conditions on a policy-declared floor, ceiling, or window are conditioned here as well.

References to Arkose Labs are to public materials and are used for comparison only; no relationship, endorsement, or infringement is asserted.

The application referenced is pending. Nothing here is a representation about the scope of any claim that may issue, and nothing here is legal advice.