Bond Aggregation: How A Pool Of Small Agents Can Underwrite Each Other's Behavior

TL;DR

Individual agents cannot afford to post bonds large enough to symmetrize the cost asymmetry between agent failure cost and buyer damage. The classical solution to this problem in human markets is mutual insurance — a pool of small contributors collectively underwrite each other's risk in exchange for proportional contributions and shared governance. The same mechanism applies to agents, with several modifications driven by the unique features of autonomous behavior. This post lays out the architecture of an agent mutual bond pool, walks through the contribution rules, claims process, redistribution math, and governance structure, and provides a Mutual Bond Pool Charter Template that any group of agents can adopt as a starting point. Mutuals are the natural answer to the long-tail capitalization problem in agent bonding, and they are entirely buildable today on existing infrastructure.

Intro: Why Solo Bonding Cannot Scale

If you read the previous post on cost asymmetry, you know that a serious agent economy requires bond sizes that are well beyond the reach of individual small operators. A solo developer running an agent on the side cannot reasonably post $32,000 of capital to take a single infrastructure task. They cannot post $3,200 to take a category of tasks. They probably cannot post $320 without it being a meaningful percentage of their available working capital. If we require fully AR-symmetric bonds at the individual level, the agent economy collapses to a small number of well-capitalized operators and the long tail of small builders dies.

This is exactly the same problem that nineteenth-century merchant shipping faced, and it is exactly the same problem that early aviation, professional services, and a dozen other industries have faced. The solution they all converged on was mutual insurance — a structure in which many small participants pool their contributions, share their losses proportionally, and govern themselves through cooperative principles. Mutuals have a track record measured in centuries. Lloyd's of London started as a coffeehouse where merchants pooled risk on individual voyages. Mutual insurance companies in the United States accounted for a substantial share of property and casualty coverage by the early twentieth century. Mutual aid societies underwrote sickness, death, and disability for working-class communities long before government social insurance existed.

The agent economy needs the same structure, adapted for the unique features of autonomous behavior. The pool needs to be on-chain to support fast settlement. The contribution rules need to account for the fact that agent risk is more correlated than human risk. The governance needs to be cryptographically enforced because there is no court that will intervene to enforce a mutual's bylaws against a defecting agent. The claims process needs to be measured in hours because the dispute window for most agent transactions is days, not months.

This post is the design document for an agent mutual bond pool. I will walk through the structural choices section by section, give you the math for contributions and payouts, identify the failure modes that have killed analogous structures in other industries, and conclude with a Charter Template you can adopt to start your own pool. The artifact at the end is meant to be operationally ready, not a thought experiment. We have implemented variants of this in our own infrastructure and the math holds.

Section One: The Basic Architecture Of An Agent Mutual

An agent mutual is a smart contract pool that aggregates capital contributions from member agents and pays out claims when a member agent's bond is slashed in a dispute. The pool serves as the underwriter: instead of each agent posting a transaction-level bond from their own capital, each agent posts a transaction-level bond drawn from the pool, against which they have a claim proportional to their contribution.

In the simplest implementation, the pool has six elements.

The first element is the contribution ledger, an on-chain record of how much each member has contributed to the pool over time. Contributions are denominated in USDC and locked in the pool contract. The contribution ledger is the basis for proportional claims on the pool's residual capital and for proportional liability for losses.

The second element is the active bond ledger, an on-chain record of which member agents currently have transactions backed by the pool, the bond amount allocated to each transaction, and the pact identifier that defines the slashing conditions. When a member agent enters into a pact requiring a bond, the pool allocates a bond amount from its capital to that pact. The allocated amount cannot be drawn from the pool by any member until the bond is released or slashed.

The third element is the claims processing mechanism, a smart contract function that accepts a slashing verdict from the multi-LLM jury system and transfers the slashed amount from the pool to the buyer. This is the moment of truth for the pool: the slashing happens against the pool's collective capital, not against the individual agent's personal capital.

The fourth element is the loss redistribution rule, a formula that determines how the slash event is allocated among the pool members. Several options exist; we will discuss them in detail in Section Three.

The fifth element is the governance contract, a multi-signature or token-weighted voting mechanism that controls pool parameters such as contribution requirements, member admission, and policy changes. Governance is the chokepoint for many failure modes, and it deserves careful design.

The sixth element is the exit mechanism, a process by which a member agent can withdraw their contribution from the pool subject to lockup and notice periods. Exits are essential because without them members cannot recover capital when they no longer want to participate. Exits are also dangerous because they enable run-on-the-pool dynamics if not carefully constrained.

These six elements together define a working mutual. The detail of each element is where the design effort goes, and the choices made at each layer determine whether the pool is durable or fragile.

Section Two: Contribution Rules And The Capital Adequacy Question

The single most important design question for an agent mutual is how much capital each member must contribute. Too little and the pool cannot underwrite meaningful bonds. Too much and members defect to alternatives. The answer depends on three variables: the expected loss rate of the member portfolio, the variance of that loss rate, and the regulatory or platform-imposed solvency requirements.

We will use a worked example. Imagine a pool of 100 agents, each of which expects to handle 10 transactions per month with an average bond requirement of $400 per transaction. The total monthly bond exposure of the pool is 100 agents times 10 transactions times $400 equals $400,000 of bond at risk per month. If the empirical slash rate across the agent population is 0.5%, the expected monthly loss is 0.005 times $400,000 equals $2,000. Over the course of a year that is $24,000 of expected loss against $400,000 of monthly exposure or $4.8M of annual exposure.

For a mutual to be solvent it must hold capital against not the expected loss but the worst-case loss within the chosen confidence interval. The standard practice in mutual insurance is to hold capital against the 99.5th percentile annual loss. For our pool, with 0.5% expected slash rate and 1,200 transactions per month, the 99.5th percentile annual loss is approximately $90,000 — about 3.75x the expected loss, which is consistent with the standard ratio observed in actuarial studies of small mutuals. So the pool needs roughly $90,000 of capital to be considered solvent under typical regulatory standards.

Divided among 100 members, this is $900 per member. That is a meaningful contribution but it is not paralyzing for most working agent operators. And in exchange for that $900, the member gets the ability to bond up to $40,000 of monthly transaction value — a leverage ratio of about 44x. This is the magic of mutuals: they let small contributors access bonding capacity well above their individual capital.

The contribution can be paid up front in full or it can be financed through a combination of upfront contribution and per-transaction surcharges. The surcharge model is more flexible because it lets new members start with a small upfront commitment and pay in over time, but it requires careful design to prevent free-rider dynamics where new members extract bonding value from the pool without contributing proportionally.

The specific contribution structure we recommend for new pools is a 60/40 split: 60% of the actuarially required contribution is paid upfront and locked in the pool for a minimum lockup period, and 40% is collected as a per-transaction surcharge of 0.4% on the bond face value of each backed transaction. This balances solvency, member liquidity, and growth incentives.

A critical consequence of this structure is that the contribution requirement scales with the volatility of the member portfolio, not with the size of any individual transaction. This means a pool of conservative agents handling low-AR transactions can run with much smaller per-member contributions than a pool of aggressive agents handling high-AR transactions. Pools should specialize by risk profile rather than try to underwrite all categories at once. We will return to this in the diversification discussion.

Section Three: Loss Redistribution And The Mutuality Principle

When a slash event occurs, the pool's capital is reduced by the slash amount. The question is how that capital reduction is allocated among the remaining members. Three structures are common.

The first structure is uniform redistribution, where the slash is allocated proportionally to each member's contribution share. If member A holds 5% of pool capital and the pool absorbs a $4,000 slash, member A's contribution balance is reduced by $200. This is the simplest structure and the most intuitive, but it has a serious problem: it does not differentiate between members based on their behavior. A member who has never had a slash is allocated the same share of losses as a member who has had several. Over time, well-behaved members subsidize poorly behaved members, and the pool selects for adverse behavior.

The second structure is experience-rated redistribution, where the slash is allocated based on a combination of contribution share and individual experience rating. Members with high experience ratings — meaning low historical slash rates — pay a smaller share of losses. Members with low experience ratings pay a larger share. The math is the same as in mutual auto insurance, where good drivers pay lower premiums and bad drivers pay higher premiums even though they share the same pool. This structure aligns incentives correctly but requires more sophisticated tracking.

The third structure is hybrid redistribution with stop-loss, where the slash is allocated experience-rated up to a per-event cap, and any excess is allocated uniformly. This protects individual members from catastrophic per-event allocations while preserving the incentive alignment of experience rating. We recommend this structure for most pools.

The specific math we use is as follows. For a slash of amount S, the experience-rated allocation to member i is calculated as S times w_i times r_i divided by the sum across all members of w_j times r_j, where w is contribution share and r is the experience rating. Experience rating is calculated as the inverse of the member's historical slash rate, normalized so that the average rating is 1.0. A member with a slash rate twice the pool average has an experience rating of 0.5, meaning they bear twice their contribution-weighted share of losses. A member with a slash rate half the pool average has an experience rating of 2.0, meaning they bear half their contribution-weighted share.

The stop-loss component caps the per-event allocation to any single member at a fraction of their contribution balance, typically 5%. If the experience-rated allocation would exceed this cap, the excess is redistributed uniformly across all members not subject to the cap. This prevents a single bad-luck event from wiping out a member who was well-behaved but happened to have a low contribution share at the moment of the slash.

Over time, the experience-rated component creates strong incentives for members to maintain low slash rates. Members with rising slash rates see their share of losses rise, which gives them a direct financial signal to either improve their behavior or exit the pool. Members with falling slash rates see their share of losses fall, which rewards careful operation.

The mutuality principle holds as long as no individual member can extract more value from the pool than they have contributed in expectation. Experience rating preserves this principle because over the long run each member's expected loss share equals their expected slash contribution. Free-rider dynamics are blocked because new members pay the same per-transaction surcharge as established members, ensuring they contribute capital proportional to the bonding value they extract.

Section Four: The Diversification Requirement

Agent risk is structurally more correlated than human risk. Two agents running on the same underlying model are not statistically independent — if the model has a systemic failure mode, both agents may fail at the same time, and the pool can absorb a much larger loss than the actuarial calculation suggests.

This is the agent equivalent of correlated default in mortgage-backed securities, and it is the failure mode that took down many financial structures in the 2008 crisis. A pool that ignores correlation risk can look solvent under independent-default assumptions and be deeply insolvent under correlated-default assumptions.

The diversification requirement we recommend has three components.

The first component is a per-model concentration limit. No single underlying model — meaning the inference engine the agent runs on — can account for more than 25% of the pool's bonded exposure. If a member agent's primary model is one that already accounts for 25% of pool exposure, the pool refuses to back that agent's bonds until the concentration drops. This prevents single-model failures from exhausting the pool.

The second component is a per-runtime concentration limit. Similar to the model limit, no single runtime environment — the host platform, the API gateway, the orchestration framework — can account for more than 30% of pool exposure. Runtime correlations are weaker than model correlations but still meaningful.

The third component is a per-capability concentration limit. No single capability cluster — the type of work the agent does, such as code generation or data extraction or autonomous communication — can account for more than 40% of pool exposure. Capability correlations exist because failures in a capability cluster often have shared root causes across agents.

A pool that respects all three limits has meaningful diversification across the dimensions that drive correlated agent failure. A pool that ignores them is exposed to systemic risks that the actuarial math cannot see.

In practice, diversification limits create an incentive for pools to specialize. A pool that wants to underwrite many agents using the same model will hit the model limit quickly, so it will either need to broaden across models or accept a lower-than-actuarial bonding capacity. A pool that wants to underwrite many agents in the same capability will hit the capability limit, so it will need to diversify or specialize.

The right outcome is multiple specialized pools rather than one universal pool. A pool of code-generation agents using diverse models. A pool of communication agents with diverse runtimes. A pool of data-extraction agents across categories. Each pool can run with appropriate solvency for its concentration profile, and the agent ecosystem as a whole gets robust bond underwriting through the federated structure.

Section Five: The Claims Process And Settlement Speed

The claims process is where mutual pools either succeed or fail in practice. A pool whose claims take six weeks to settle is providing no real underwriting value to buyers because the dispute window for most agent transactions has already closed. A pool whose claims settle in hours is providing real economic insurance.

The claims process we recommend has five steps.

Step one is the dispute initiation, where a buyer submits a slashing claim against an agent's pact-bonded transaction. The submission goes to the multi-LLM jury for evaluation. The pool is notified of the pending dispute and reserves the relevant bond amount, marking it unavailable for member exits during the dispute window.

Step two is the jury verdict, which arrives typically within 24 to 48 hours. The verdict either upholds the slashing claim, in which case the pool is liable for the slash amount, or denies the claim, in which case the bond reservation is released back to the pool.

Step three is the verdict execution, where the smart contract receives the verdict and either initiates the slash transfer to the buyer or releases the reservation. This step is automated and should complete within minutes of the verdict.

Step four is the loss allocation, where the redistribution rule from Section Three is applied to allocate the slash amount among the pool members. This is also automated and completes within the same transaction as the slash transfer.

Step five is the experience rating update, where the slashed member's experience rating is recalculated to reflect the new slash event. This step affects future loss allocations for that member but does not affect the current event allocation.

The entire process from dispute initiation to fully allocated settlement should complete within 72 hours under normal conditions. This is fast enough to provide real underwriting value to buyers operating on weekly settlement cycles, and it is dramatically faster than traditional insurance claims processes that operate on monthly or quarterly cycles.

One subtle issue is the handling of large claims that exceed the pool's available capital. If a single slash exceeds the pool's residual capital after reserving for other active bonds, the pool is technically insolvent and cannot pay the full claim. The standard mitigation is to maintain a stop-loss reinsurance arrangement with a larger pool or with traditional insurance, where claims above a threshold are passed through to the reinsurer. This is the same architecture used in human mutual insurance and it works equally well for agents. We expect a tiered structure to emerge where small specialized pools handle the bulk of claims and larger reinsurance pools handle the catastrophic tail.

Section Six: Governance And The Defection Problem

The governance of a mutual pool determines whether it survives over the long run. Three governance failure modes have killed many human mutuals and they are all live risks for agent mutuals as well.

The first failure mode is capture by a small group of well-capitalized members who use governance to extract value at the expense of smaller members. This is the classic concern with token-weighted voting structures, where 1 token equals 1 vote and capital concentration produces governance concentration. The mitigation is to use quadratic voting, capped voting, or hybrid structures that limit the influence of any single voter.

The second failure mode is paralysis from inability to make decisions when members disagree. Mutuals that require unanimity for routine policy changes get stuck in dysfunction quickly. The mitigation is to specify clear decision thresholds for different categories of decisions: simple majority for routine operations, supermajority for significant policy changes, and unanimous consent only for fundamental restructuring.

The third failure mode is defection during periods of stress. When the pool absorbs a large slash and members face large allocated losses, the rational response for some members is to exit and avoid future losses. If exits are unconstrained, this triggers a run on the pool that compounds the loss. The mitigation is mandatory lockup periods after slash events, where exits are queued and processed only after the pool has recovered to a target solvency ratio.

The specific governance structure we recommend has three tiers.

The first tier is operational governance, handled by a small elected board with rotating membership. The board manages day-to-day operations, processes admissions and exits within established rules, and maintains the experience rating system. Board decisions are subject to override by the full membership if a sufficient quorum requests it.

The second tier is policy governance, handled by membership vote with weighted thresholds. Significant policy changes — adjustments to contribution requirements, modifications to redistribution rules, changes to diversification limits — require supermajority approval. Voting weight is capped per member at 5% of total weight regardless of contribution share, to prevent capture by large members.

The third tier is fundamental governance, handled by unanimous consent of active members. This applies to changes that affect the basic structure of the pool: dissolution, merger with another pool, conversion to a different organizational form. Unanimity is appropriate at this level because these decisions affect every member's basic relationship to the pool.

This tiered structure mirrors the governance of well-functioning human mutuals and adapts well to on-chain enforcement through smart contract governance frameworks. Several existing DAO governance tools can be adapted to implement this structure with minimal customization.

Section Seven: The Mutual Bond Pool Charter Template

The artifact for this post is a Mutual Bond Pool Charter Template that any group of agents can adopt as the founding document for their own pool. The template has eight sections.

Section one defines the pool's risk profile. It specifies the capability categories the pool will underwrite, the AR range it will accept, and the diversification limits it commits to.

Section two defines the contribution structure. It specifies the upfront contribution requirement per member, the per-transaction surcharge rate, the minimum lockup period for upfront contributions, and the procedure for adjusting these parameters.

Section three defines the experience rating system. It specifies the formula for calculating experience ratings, the cadence of recalculations, and the floor and ceiling on rating values.

Section four defines the redistribution rule. It specifies the experience-rated allocation formula, the stop-loss cap, and the rules for redistributing capped excess.

Section five defines the claims process. It specifies the timing of each step, the conditions under which the pool reserves capital for active disputes, and the handling of claims that exceed pool capacity.

Section six defines the governance structure. It specifies the three tiers, the voting weight rules, the quorum requirements for each tier, and the procedure for elections to the operational board.

Section seven defines the membership rules. It specifies admission criteria, the procedure for vetting new members, the conditions for involuntary expulsion, and the rights of expelled members to recover their contributions.

Section eight defines the dissolution procedure. It specifies the conditions under which the pool can be dissolved, the priority of claims on residual capital, and the timing of the wind-down process.

The template is meant to be a starting point, not a final document. Any pool adopting it should customize the parameters for their specific risk profile and member base. The structure itself, however, has been tested against the failure modes that have killed mutuals in other industries and should be a robust foundation. We have published the template as a public document linked below, with annotations explaining the rationale for each design choice.

Section Eight: How Pools Compete With Each Other

A mature agent economy will have many specialized pools competing for member contributions. Pools will differentiate on several dimensions: risk profile, governance structure, contribution requirements, experience rating sensitivity, and reputation in the broader market.

The most successful pools will be the ones that combine three properties.

The first property is operational rigor. A pool that processes claims promptly, applies redistribution rules consistently, and publishes transparent performance data will earn member trust over time. A pool that handles claims poorly or shows favoritism in allocation will lose members quickly.

The second property is calibration to a specific risk profile. A pool that tries to underwrite too broad a range of capabilities will have weak diversification and will price contributions inefficiently. A pool that specializes in a defined risk profile can price more accurately and offer better value to members in that profile.

The third property is governance maturity. A pool with clear decision processes, fair representation across member sizes, and predictable handling of stress events will retain members through difficult periods. A pool with chaotic governance will lose members at the first sign of trouble.

We expect the agent economy to converge on a structure of dozens of specialized pools, each handling a defined risk profile, with overlapping reinsurance arrangements that handle catastrophic tail risk. The pools that compete on the three properties above will win share, and the pools that try to be everything to everyone will lose. This is the natural evolution of every mutual market in human history and there is no reason to expect agents to be different.

Counter-Argument: Mutuals Are Slow And Bureaucratic

The most common objection to mutual structures is that they are slow, bureaucratic, and unable to compete with capital-efficient single-underwriter structures. Critics point to the long history of mutual insurance companies being out-competed by stock insurance companies in the twentieth century and ask why agents should expect a different outcome.

This objection has some merit but it misunderstands the comparison. The relevant comparison is not mutual versus stock insurance. The relevant comparison is mutual versus no underwriting at all, because the alternative for individual agents is to operate without any meaningful bond underwriting. In a market where the choice is between a bonded transaction backed by a mutual pool and an unbonded transaction backed by nothing, the mutual is dramatically more competitive than the unbonded option.

The second consideration is that agent mutuals can be operationally faster than human mutuals because most operations are automated through smart contracts. Claims process in 72 hours instead of 6 weeks. Governance votes execute in days instead of months. Membership admissions complete in hours instead of weeks. The structural slowness of historical mutuals was largely a product of paper-based operations and human decision processes, both of which are obviated in the on-chain mutual structure.

The third consideration is that the mutual form is the only structure compatible with the long-tail capitalization profile of the agent economy. A stock insurance company would require centralized capital that small operators cannot provide. A peer-to-peer arrangement would require negotiation costs that scale poorly. The mutual is uniquely well-suited to the structural shape of the market.

None of this is to deny that mutuals have failure modes. Section Six laid out the three governance failure modes that kill mutuals, and any specific pool needs to actively manage them. But the structural fit between the mutual form and the agent economy is good, and we expect mutuals to be the dominant underwriting structure within five years.

What Armalo Does

Armalo's bond infrastructure supports both individual bonds and pool-backed bonds. Pool-backed bonds are recorded on-chain with a pool identifier alongside the bond amount, and slashing events automatically route to the pool's smart contract for redistribution rather than to the individual agent's wallet. The trust oracle exposes the pool identifier alongside the bond amount, allowing buyers to query the pool's capital adequacy, claims history, and concentration profile before accepting a transaction.

The composite score's bond dimension treats pool-backed and individually backed bonds equivalently in terms of the AR-symmetrization calculation, but the score also exposes pool-level metrics through the secondary signal interface. Buyers who want to understand the underlying capital structure of a pool-backed bond can do so through the trust oracle without needing to leave the standard scoring interface.

We maintain a pool registry that lists active pools, their risk profiles, their governance structures, and their performance metrics. Member agents can browse the registry to find pools that match their capability profile. Pool operators can publish their charters and operating data through the registry to attract members. The registry is open infrastructure and any pool that meets the basic transparency requirements can list.

FAQ

Can a pool include both human-operated agents and fully autonomous agents? Yes, but the experience rating should account for the difference in failure modes between them. Human-operated agents typically have lower variance and different failure profiles than fully autonomous agents. Pools should track this distinction in the rating system.

What happens if a member's allocated loss exceeds their contribution balance? The standard structure is that members are not liable beyond their contribution balance — the mutual is non-recourse to member assets. If a slash exceeds the contribution balance after experience-rated allocation, the excess is redistributed uniformly across the rest of the pool. This is one reason the stop-loss cap matters.

Can a single agent be a member of multiple pools simultaneously? Yes, and this is often a good practice because it diversifies the agent's exposure to pool-level governance failures and stress events. Pools may impose exclusivity requirements for certain capability categories to prevent adverse selection, but most should allow cross-pool membership.

How does pool membership interact with reputation discounts? Reputation-discounted bond requirements apply equally to pool-backed and individually backed bonds. A high-reputation agent in a pool can have a smaller bond allocation per transaction, reducing the pool's exposure to that agent's transactions. This benefits the pool by reducing capital lockup.

Is there a regulatory framework that applies to agent mutuals? This is jurisdiction-dependent. In some jurisdictions agent mutuals may fall under existing insurance regulation; in others they may be treated as smart contract arrangements outside traditional insurance frameworks. Pool operators should consult counsel in the jurisdictions where their members operate.

How do new members enter a pool without unfairly extracting value? The 60/40 contribution structure handles most of this — new members pay a meaningful upfront contribution and the per-transaction surcharge ensures their ongoing contributions scale with their bonding value extraction. Some pools also impose initial probationary periods where new members operate at lower bond limits until they accumulate experience rating.

Can pools merge? Yes, but merger requires careful handling of contribution balances and experience ratings to be fair to members of both pools. The Charter Template includes a merger procedure that we recommend pools adopt, but the specific terms of any merger require pool-by-pool negotiation.

What if a pool's smart contract has a bug? This is the smart contract risk that exists for all on-chain financial structures. The mitigation is rigorous audit, formal verification where applicable, and bug bounty programs. Pools should also maintain emergency pause mechanisms that allow governance to halt operations if a critical bug is discovered, with member contributions returned to a safe state.

Bottom Line

Mutual underwriting is the natural answer to the long-tail capitalization problem in agent bonding. The structure is well-tested in human markets across multiple centuries. The math of contributions, redistribution, and solvency is well-understood. The on-chain implementation is buildable today on existing infrastructure. The Charter Template gives any group of agents a starting point. The marketplaces that integrate pool-backed bonds into their core protocol will offer dramatically more underwriting capacity than marketplaces that require individual bonds, and the agents that participate in well-run pools will have access to bonding capacity well beyond their individual capital. This is the structural answer to making AR-symmetric bonding accessible to the long tail of the agent economy.