Pith. sign in

REVIEW 3 major objections 5 minor 36 references

Fluid Structure, Rigid Record: A Layered Organizational Design Framework for Agent-Native Organizations

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that LLM-based agent organizations should be governed by enforced Permission and Privilege leases over a rigid record system, so teams and tools can change fluidly per task while authority boundaries and records stay…

desk verdict A coherent, honest design-science framework for agent-native organizations whose central fail-closed guarantee is plausible but unverified; worth a serious referee, not a desk reject. read the letter →

arxiv 2608.08516 v1 pith:PJXADH7U submitted 2026-08-09 cs.MA

Lucian Zhu This is my paper · ORCID
classification cs.MA
keywords LLMagentsmulti-agentsystemsorganizationdesignpermissionprivilegecoordinationfaulttoleranceAIgovernance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that an LLM-based multi-agent organization should be designed as a layered system in which persistent records and specialization templates stay rigid while task-specific teams, tools, and views are compiled dynamically for each task. It argues that the load-bearing coordination variables are Permission—what an agent may observe and touch—and Privilege—what organizational state changes it may authorize—issued as scoped, expiring leases rather than described in prompts. If the framework is right, agent organizations would gain accountable, recoverable, and safely reconfigurable execution: teams dissolve after work, leases expire, records retain accepted state, and a human Control Plane can stop the system independently of the data plane. The paper is explicit that this is a design-science framework with a prototype and small-sample tests, and it makes no general performance claim yet; the contribution is a falsifiable architecture plus hypotheses for comparative evaluation.

What carries the argument

The central object is the task-bound P&P lease $\gamma^\tau_a = \langle a, \tau, P, Q, b, t_0, t_{\exp}, q\rangle$, issued by the Workflow Protocol, which bundles Permission (the externally enforced boundary of readable documents, tools, channels, and writable regions) with Privilege (the set of organizational state changes an agent may authorize), together with budget, expiry, and a revocation handle. Around it, a four-store record system—Runtime, Log, Artifacts, Knowledge—with asymmetric write rules, and three Role Groups (Operation low/low, Reviewer high on-demand change authority, Supervisor broad observation with limited modification) enforce the rigidity underneath the fluid surface. The validity check $\mathrm{Valid}(e,S_t)=\mathrm{Schema}(e)\land\mathrm{LeaseActive}(e,\Gamma_t)\land\mathrm{Authorized}(e,P_t,Q_t)\land\mathrm{Precondition}(e,S_t)$ is the mechanism that commits accepted events to the append-only log, making authority external rather than prompt-based.

What would settle it

Run a controlled comparison of the full architecture against an ablation in which Permission/Privilege leases are replaced by prompt-level instructions, keeping models, budgets, and tasks matched; if the prompt-only condition does not show higher stale-grant duration, handoff or termination failures, or incident blast radius under injected failures, the central claim that external enforcement rather than prompting carries the safety benefit fails. Equivalently, inspect the append-only log for any material state transition whose event lacks a valid lease and evidence pointer.

Watch

Extended reading notes

Core claim

The paper's central proposition is to drive work with Permissions and Privileges, not prompts: instead of asking a model to behave like a role, the system compiles the world an agent may inhabit and then lets it act freely inside that world. The discovery it offers is that this composition—a persistent specialization pool plus a rigid four-store record system, coupled through Permission/Privilege leases and a non-agent Workflow Protocol to a temporary Task Group—is the central comparative advantage, not any single component. The architecture keeps the execution surface fluid across tasks and events while records, write constraints, authority boundaries, and separation of powers remain persistent. A proposed event changes organizational state only if it passes a validity check covering schema, active lease, authorization, and precondition, and the paper states a fail-closed property: stopping lease issuance and revoking active leases prevents subsequent material state changes, conditional on every material action being mediated by that check.

Load-bearing premise

The load-bearing premise is that every material action an agent can take is mediated by the centralized validity check on proposed events; shared secrets, administrator mistakes, compromised control code, or unobserved side channels that bypass that check void the fail-closed guarantee, as the paper itself concedes.

Editorial extensions

If this is right

  • An agent organization could change its team composition, topology, views, tools, and workflows in real time without changing its authority structure or record integrity.
  • Fail-closed authority becomes a design guarantee rather than a prompt intention: with leases revoked, agents cannot commit further material state changes, provided all actions pass through the harness.
  • Organizational memory survives worker failure, because durable work lives in records with pointers rather than in sessions; a failed agent can be replaced by replay and a clean-context restart.
  • Topology selection conditioned on task dependency and risk would make sequential tasks run as a single chain instead of paying the coordination tax of a multi-agent team.
  • The measurement loop—coordination tax, audit rate, error amplification—gives organizations an operational surface for deciding when dynamic assembly is worth its overhead.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The sharpest test of the thesis is not whether the full architecture beats every baseline, but whether the ablated variants fail in the predicted ways: removing P&P leasing should raise stale-grant duration and blast radius, and removing record handoff should raise handoff and termination failures.
  • To make the fail-closed guarantee credible in practice, every tool invocation and credential use would need to be instrumented and reconciled against the lease registry, since an unobserved side channel voids the property.
  • The P&P-lease idea could transfer beyond LLM organizations to any AI-human workflow where a model proposes actions and an external harness authorizes them, giving auditable, reversible autonomy to non-agent software services as well.
  • The Agent OS analogy points to a natural next step the paper leaves implicit: treating resident specializations as schedulable processes and records as a filesystem could let future work borrow scheduling, isolation, and error-budget theory from operating systems.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a four-layer architecture for LLM-based multi-agent organizations, separating a persistent layer (resident specialization templates and a four-store record system) from a coordination layer (Permission and Privilege leases), a runtime layer (Workflow Protocol, Task Groups, runtime store), and a human-interaction layer (Control Plane and Translation Agent). It introduces three Role Groups with asymmetric permissions and privileges, and claims that the resulting system is fluid at the execution surface while remaining rigid underneath in records, authority boundaries, and separation of powers. The paper presents the framework as a design-science artifact with a prototype and small-sample tests, explicitly deferring large-scale empirical validation to a companion paper, and lists five falsifiable hypotheses (H1-H5) for future testing.

Significance. If the architecture is taken as a design framework, it makes a useful contribution by translating organization-theory mechanisms into machine-enforceable constructs: Permission as the compiled world, Privilege as typed state-change authority, and Role Groups as fixed governance boundaries. The paper is explicit about its assumptions, supplies a detailed specification with equations for leases, validity checks, and recovery, and offers a concrete evaluation agenda with matched baselines and ablations. Its strengths are the clear separation of persistent and transient layers, the design of a fail-closed lease mechanism as a conditional property, and the articulation of testable hypotheses. The absence of empirical data is a significant limitation, but the framework itself is coherent, and the paper does not overclaim: it states at the outset that no general performance claim is made yet.

major comments (3)
  1. [Sec. 7.2 and Eq. (9)] The central distinction between a fluid execution surface and a rigid underlying record rests on Proposition 2, which requires that every material action be mediated by the validity check in Eq. (9). The manuscript concedes in Sec. 7.2 that shared secrets, administrator mistakes, compromised control code, or unobserved side channels invalidate the guarantee, but it provides no evidence that the prototype's non-agent kernel actually achieves such universal mediation for LLM tool calls (subprocesses, network access, filesystem operations, credentials). Without a concrete description of the mediation layer or an explicit downgrade of the 'rigid underneath' claim to a design requirement to be verified, the architecture cannot empirically be distinguished from a conventional prompt-controlled MAS with advisory records. This is load-bearing and should be addressed by adding implementation evidence or by reframing the claim as a conditional design principle rather than an achieved property.
  2. [Sec. 7.1] The paper states that a prototype has been implemented and exercised in small-sample tests, but no data, qualitative results, or code are provided. Since the paper's contribution is an implementable architecture and its falsifiable hypotheses H1-H5 are listed rather than tested, the reader cannot assess whether Eqs. (7)-(12) are actually instantiable. Please add an appendix or repository with at least minimal implementation details (environment, agent types, task cards, P&P enforcement, observed behaviors) or state explicitly that the prototype material is not being shared. This request is essential for evaluating the implementability claim that the paper makes.
  3. [Sec. 3.4, Eq. (13)] The selection objective in Eq. (13) is written as an argmax over task groups and topologies, but the paper does not specify how the Workflow Protocol estimates V_tau, C_model, C_tool, C_coord, C_H, or E[L_risk], nor what search procedure or heuristics are used in practice. If this is a conceptual objective rather than an implemented optimizer, it should be labeled as such; otherwise, the described architecture includes a decision procedure that is not defined. This matters for H2, which predicts that task-conditioned topology improves net utility, because the prediction cannot be tested without an operational selection rule.
minor comments (5)
  1. [Abstract] The abstract contains formatting issues such as missing spaces ('usePermission', 'justifiedbecause', 'changeauthority'); please proofread the text carefully.
  2. [Sec. 2.1, Definition 1] The word 'transferred' in the functional translation criterion appears to mean 'translated'; consider clarifying the terminology and the relationship between translation and reimplementation.
  3. [Sec. 3.2] Equation (9) refers to S_t but the organizational state S_t is not explicitly defined before its use; adding a short definition of S_t as the tuple of store contents and active leases would improve readability.
  4. [Table 4] AutoGen is described under 'conversational roles', but AutoGen supports a broader range of agent patterns than pure conversation; the comparison would benefit from a more nuanced characterization of the cited systems.
  5. [Sec. 6.2] The restart-intensity limit (N,T) is described as a prototype parameter, which is appropriate, but the paper might clarify that N and T are not fitted to data in this paper and that their values are illustrative.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the framework's propositions are analytic conditionals and its predictions are genuinely testable.

full rationale

The paper does not fit any parameter and then relabel it as a prediction; it reports no empirical benchmark and makes no general performance claim. Its two numbered propositions are conditional statements rather than circular reductions. Proposition 2 (fail-closed authority) states that if every material action is mediated by Eq. (9) and expired or revoked leases cannot be forged, then stopping lease issuance and revoking active leases prevents further state changes; this is a valid consequence of the definition of Valid(e,S_t) in Eq. (9), and the paper explicitly flags in Section 7.2 that the mediation assumption can fail through side channels, shared secrets, or compromised control code. Proposition 1 is similarly an explicit modeling assumption: if runtime state is defined as the output of a deterministic projector over the event prefix, replay reconstructs it; the paper states the reachability caveat for artifact bytes. Neither proposition imports its conclusion as an input. The falsifiable hypotheses H1-H5 are forward-looking empirical claims about relative failure rates, net utility, action surface, defect detection, and recovery time; none is a restatement of the framework's definitions. The reference list contains no self-citations, and the AI-assistance disclosure is not used as evidence for any technical claim. The central 'fluid surface, rigid record' claim is a description of the designed layering, not a derived empirical result presented as a test of the framework.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The framework does not fit any constants to data in this paper. The free parameters listed are calibration placeholders that the design expects each deployment to set. The axioms are the background assumptions on which the architecture's safety and recovery claims rest. No new physical or conceptual entities are postulated beyond standard design components.

free parameters (3)
  • N (restart-intensity limit) = 3 (prototype)
    In Section 6.2, N=3 is given as a prototype parameter, not a universal law. It governs when repeated failure escalates; the mechanism is the limit, not the value.
  • f_max (fan-out parameter)
    In Section 3.4, each aggregator has a fan-out parameter f_max because context bandwidth is a designed resource. Its value is not set in the paper and must be calibrated per domain.
  • Risk-class thresholds (Standard, Normal, Major, Emergency)
    Table 5 says thresholds are organization-specific and must be calibrated. No values are given.
assumptions (4)
  • domain assumption Every material action is mediated by the validity check in Equation (9).
    Invoked in Proposition 2 (fail-closed authority). The paper states in Section 7.2 that a side channel, shared credential, or bypassing tool invalidates the property.
  • domain assumption Deterministic replay from a valid event prefix reconstructs runtime state.
    Proposition 1 (scoped runtime recovery) assumes a deterministic projector and reachable artifacts. This is a standard assumption for event-sourced systems, not proven in the paper.
  • domain assumption Separating Operation, Review, and Supervision improves safety without unacceptable coordination cost.
    H4 in Section 7.1 frames this as a falsifiable hypothesis, acknowledging it may reduce net utility on routine work. The architecture is built on this premise.
  • domain assumption LLM agents have limited context and are replaceable; context is a controlled resource.
    This motivates the entire Permission compilation approach in Section 2 and Definition 2. It is supported by cited work, but remains a background assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fluid Structure, Rigid Record: A Layered Organizational Design Framework for Agent-Native Organizations." pith.science (2026). https://pith.science/paper/PJXADH7U

@misc{pith2026260808516,
  author       = {Pith},
  title        = {Pith review of: Fluid Structure, Rigid Record: A Layered Organizational Design Framework for Agent-Native Organizations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PJXADH7U}},
  note         = {Machine review of arXiv:2608.08516}
}
read the original abstract

An agentic organization should not be a set of model instances with corporate titles, despite most MAS still operationalizing organization as a conversational topology, a role prompt, or a fixed workflow. This paper develops an agent-native organizational structure framework that separates the persistent and dynamic layers of operations. The persistent layer consists of a four-store record architecture and a pool of resident specialization agents. A coordination layer defines Permission as the boundary of the operational world available to an agent, and Privilege as the set of organizational state changes that the agent is authorized to initiate. Together, these mechanisms compile task-specific operational worlds. A runtime layer combines an external Workflow Protocol with an isolated runtime store to dynamically assemble Task Groups. A human-interaction layer exposes the organization through a Control Plane mediated by a non-decision-making Translation Agent. Three orthogonal Role Groups further separate Operation, Review, and Supervision. Operators execute within narrowly scoped leases; reviewers receive elevated but demand-activated authority to modify organizational state; supervisors retain broad observational access while holding limited modification authority. The resulting architecture is fluid at the execution surface but structurally rigid underneath: tasks and events may alter team composition, topology, views, tools, and workflows, while records, write constraints, authority boundaries, and separation of powers remain persistent. The architecture has been implemented as a prototype and evaluated in small-sample experiments. Large-scale empirical validation remains incomplete, therefore no general performance claimed is made yet. Instead, the contribution is a coherent and falsifiable framework for designing, governing, recovering, and evaluating agent-native organizations.

Figures

Figures reproduced from arXiv: 2608.08516 by the authors.

Figure 1
Figure 1. The four-layer architecture. Two persistent modules—the Specialization/Role-Group Agent Pool and the rigid record system—are coupled to a temporary Task Group through P&P. The Workflow Protocol compiles the task, topology, working set, and lease. The Control Plane keeps a minimal independent cache so revocation and shutdown do not depend on the record data plane [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Role Group is an asymmetric P&P profile, not a title. Supervisor’s broad observational Permission is paired with low modifying Privilege; FLAG and task HALT are narrow circuit-breaker authorities. Reviewer has high change Privilege but no standing panoramic view: the Workflow Protocol activates a decision-specific read window. Objective handoff.. Where downstream persuasive intent could bias upstream evidence collec… view at source ↗
Figure 3
Figure 3. The governance loop. Prevention constrains reachable states; Supervision detects; isolation contains; record replay and clean context recover; Review converts incidents into versioned proposals. The independent stop path acts on leases rather than negotiating through the failed data plane. compiled view. This does not guarantee correctness, but it makes context selection inspectable, reproducible, and revocable. The… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 18 canonical work pages

  1. [1]

    Adler and Bryan Borys

    Paul S. Adler and Bryan Borys. Two types of bureaucracy: Enabling and coercive.Administrative Science Quarterly, 41(1):61–89, 1996. doi: 10.2307/2393986

    work page doi:10.2307/2393986 1996

  2. [2]

    PhD thesis, Royal Institute of Technology (KTH), Stockholm, 2003

    Joe Armstrong.Making Reliable Distributed Systems in the Presence of Software Errors. PhD thesis, Royal Institute of Technology (KTH), Stockholm, 2003. URL https://erlang.org/download/armstrong_thesis_2003.pdf

    work page 2003

  3. [3]

    O’Reilly Media, Sebastopol, CA, 2016

    Betsy Beyer, Chris Jones, Jennifer Petoff, and Niall Richard Murphy, editors.Site Reliability Engineering: How Google Runs Production Systems. O’Reilly Media, Sebastopol, CA, 2016. URLhttps://sre.google/sre-book/table-of-contents/

    work page 2016

  4. [4]

    Accelerating the adoption of software and artificial intelligence agent identity and authorization

    Harold Booth, William Fisher, Ryan Galluzzo, and Joshua Roberts. Accelerating the adoption of software and artificial intelligence agent identity and authorization. Initial public draft concept paper, National Cybersecurity Center of Excellence, National Institute of Standards and Technology, February 2026. URLhttps: //csrc.nist.gov/pubs/other/2026/02/05/...

    work page 2026

  5. [5]

    Tom Burns and G. M. Stalker.The Management of Innovation. Tavistock Publications, London, 1961

    work page 1961

  6. [6]

    Pan, Shuyi Yang, Lakshya A

    Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. Why do multi-agent LLM systems fail?, 2025. URLhttps://arxiv.org/abs/2503.13657

    arXiv 2025

  7. [7]

    AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents, 2024

    Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramer. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents, 2024. URLhttps://arxiv.org/abs/2406.13352

    arXiv 2024

  8. [8]

    Galbraith

    Jay R. Galbraith. Organization design: An information processing view.Interfaces, 4(3):28–36, 1974. doi: 10.1287/inte.4.3.28

    work page doi:10.1287/inte.4.3.28 1974

Show all 36 references
  1. [9]

    The anatomy of a design theory.Journal of the Association for Information Systems, 8(5):312–335, 2007

    Shirley Gregor and David Jones. The anatomy of a design theory.Journal of the Association for Information Systems, 8(5):312–335, 2007. doi: 10.17705/1jais.00129

    2007 doi

  2. [10]

    Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. InProceedings of the 16th ACM Workshop on Artificial Intelligenc...

    2023

  3. [11]

    Hevner, Salvatore T

    Alan R. Hevner, Salvatore T. March, Jinsoo Park, and Sudha Ram. Design science in information systems research.MIS Quarterly, 28(1):75–105, 2004. doi: 10.2307/25148625

    2004 doi

  4. [12]

    MetaGPT: Meta programming for a multi-agent collaborative framework, 2023

    Sirui Hong, Mingchen Zhuge, Jiaqi Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, 12 Fluid Structure, Rigid Record Independent Draft v2 – August 2026 Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and J"urgen Schmidh...

    2026 arXiv

  5. [13]

    Large language models cannot self-correct reasoning yet, 2024

    Jie Huang, Xinyun Chen, Swaroop Mishra, Huaixiu Steven Zheng, Adams Wei Yu, Xinying Song, and Denny Zhou. Large language models cannot self-correct reasoning yet, 2024. URLhttps://arxiv.org/abs/2310.01798

    2024 arXiv

  6. [14]

    Security and privacy controls for information systems and organizations

    Joint Task Force. Security and privacy controls for information systems and organizations. Technical Report NIST Special Publication 800-53 Revision 5, National Institute of Standards and Technology, 2020. URLhttps://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

    2020

  7. [15]

    When can LLMs actually correct their own mistakes? a critical survey of self-correction of LLMs

    Ryo Kamoi, Yusen Zhang, Nan Zhang, Jiawei Han, and Rui Zhang. When can LLMs actually correct their own mistakes? a critical survey of self-correction of LLMs. Transactions of the Association for Computational Linguistics, 12:1417–1440, 2024. doi: 10.1162/tacl_a_00713

    2024 doi

  8. [16]

    Yubin Kim, Ken Gu, Chanwoo Park, Chunjong Park, Samuel Schmidgall, A. Ali Heydari, Yao Yan, Zhihan Zhang, Yuchen Zhuang, Mark Malhotra, Paul Pu Liang, Hae Won Park, Yuzhe Yang, Xuhai Xu, Yilun Du, Shwetak Patel, Tim Althoff, Daniel McDuff, and Xin Liu. Towards a science of sca...

    2025 arXiv

  9. [17]

    Zhang, Elizabeth Black, Michael Luck, Philip H

    Emanuele La Malfa, Gabriele La Malfa, Samuele Marro, Jie M. Zhang, Elizabeth Black, Michael Luck, Philip H. S. Torr, and Michael Wooldridge. Large language models miss the multi-agent mark, 2025. URLhttps://arxiv.org/abs/2505.21298

    2025

  10. [18]

    Lawrence and Jay W

    Paul R. Lawrence and Jay W. Lorsch.Organization and Environment: Managing Differentiation and Integration. Division of Research, Graduate School of Business Administration, Harvard University, Boston, 1967

    1967

  11. [19]

    CAMEL: Communicative agents for “mind” exploration of large language model society, 2023

    Guohao Li, Hasan Abed Al Kader Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. CAMEL: Communicative agents for “mind” exploration of large language model society, 2023. URLhttps://arxiv.org/abs/2303.17760

    2023 arXiv

  12. [20]

    Malone and Kevin Crowston

    Thomas W. Malone and Kevin Crowston. The interdisciplinary study of coordination.ACM Computing Surveys, 26(1):87–119, 1994. doi: 10.1145/174666.174668

    1994

  13. [21]

    March and Herbert A

    James G. March and Herbert A. Simon.Organizations. Wiley, New York, 1958

    1958

  14. [22]

    Miller.Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control

    Mark S. Miller.Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. PhD thesis, Johns Hopkins University, Baltimore, MD, 2006

    2006

  15. [23]

    Mohan, Don Haderle, Bruce Lindsay, Hamid Pirahesh, and Peter Schwarz

    C. Mohan, Don Haderle, Bruce Lindsay, Hamid Pirahesh, and Peter Schwarz. ARIES: A transaction recovery method supporting fine-granularity locking and partial rollbacks using write-ahead logging.ACM Transactions on Database Systems, 17(1):94–162, 1992. doi: 10.1145/128765.128770

    1992

  16. [24]

    Nygard.Release It! Design and Deploy Production-Ready Software

    Michael T. Nygard.Release It! Design and Deploy Production-Ready Software. Pragmatic Bookshelf, Raleigh, NC, 2007

    2007

  17. [25]

    Patil, Ion Stoica, and Joseph E

    Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. MemGPT: Towards LLMs as operating systems, 2023. URLhttps://arxiv.org/abs/2310.08560

    2023 arXiv

  18. [26]

    Ashgate, Aldershot, 1997

    James Reason.Managing the Risks of Organizational Accidents. Ashgate, Aldershot, 1997

    1997

  19. [27]

    Saltzer, David P

    Jerome H. Saltzer, David P. Reed, and David D. Clark. End-to-end arguments in system design.ACM Transactions on Computer Systems, 2(4):277–288, 1984. doi: 10.1145/357401.357402

    1984

  20. [28]

    Reid G. Smith. The Contract Net protocol: High-level communication and control in a distributed problem solver.IEEE Transactions on Computers, C-29(12): 1104–1113, 1980. doi: 10.1109/TC.1980.1675516

    1980

  21. [29]

    Sumers, Shunyu Yao, Karthik Narasimhan, and Thomas L

    Theodore R. Sumers, Shunyu Yao, Karthik Narasimhan, and Thomas L. Griffiths. Cognitive architectures for language agents, 2023. URLhttps://arxiv.org/abs/ 2309.02427

    2023 arXiv

  22. [30]

    Thompson.Organizations in Action: Social Science Bases of Administrative Theory

    James D. Thompson.Organizations in Action: Social Science Bases of Administrative Theory. McGraw-Hill, New York, 1967

    1967

  23. [31]

    Artificial organisations, 2026

    William Waites. Artificial organisations, 2026. URLhttps://arxiv.org/abs/2602.13275

    2026

  24. [32]

    Wiley, Chichester, 2nd edition, 2009

    Michael Wooldridge.An Introduction to MultiAgent Systems. Wiley, Chichester, 2nd edition, 2009

    2009

  25. [33]

    White,DougBurger,andChiWang

    Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W. White,DougBurger,andChiWang. AutoGen: Enablingnext-genLLMapplicationsviamulti-agentconversation,2023. URL https://arxiv.or...

    2023 arXiv

  26. [34]

    Patrick Xian, Garry A

    R. Patrick Xian, Garry A. Gabison, Ahmed Alaa, Christoph Riedl, and Grigorios G. Chrysos. Reliable agent engineering should integrate machine-compatible organizational principles, 2025. URLhttps://arxiv.org/abs/2512.07665

    2025

  27. [35]

    From skills to talent: Organising heterogeneous agents as a real-world company, 2026

    Zhengxu Yu, Yu Fu, Zhiyuan He, Yuxuan Huang, Ka Yiu Lee, Meng Fang, Weilin Luo, and Jun Wang. From skills to talent: Organising heterogeneous agents as a real-world company, 2026. URLhttps://arxiv.org/abs/2604.22446

    2026 arXiv

  28. [36]

    MultiAgentBench: Evaluating the collaboration and competition of LLM agents, 2025

    Kunlun Zhu, Hongyi Du, Zhaochen Hong, Xiaocheng Yang, Shuyi Guo, Zhe Wang, Zhenhailong Wang, Cheng Qian, Xiangru Tang, Heng Ji, and Jiaxuan You. MultiAgentBench: Evaluating the collaboration and competition of LLM agents, 2025. URLhttps://arxiv.org/abs/2503.01935. 13

    2025 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.