When two agents collaborate on a task, the failure of the joint output is informative about something. The question is what. If both agents see the same output and the same reward, neither has individual incentive to expend optimal effort — both face the same downside whether they tried hard or not, and both face the same upside if either succeeded. The result is well-known in the economics of teams: effort drops, output suffers, and the joint enterprise fails for reasons that no individual party can be held accountable for.
This is the hidden-action moral hazard problem, formalized by Holmstrom in 1979 for human work teams and developed extensively in contract theory since. The agent setting inherits the dynamic without modification. Multi-agent pipelines — where an output emerges from sequential or parallel contributions by multiple agents — face exactly the same incentive failure as human teams, and they fail in the same way: lowest-common-denominator effort, joint output below what any individual agent could produce alone, and counterparty disappointment that the platform cannot remedy because the platform cannot tell who failed.
This paper adapts Holmstrom's framework to agent pipelines and derives the implications for platform design. The headline result is that the room-events architecture — Armalo's distributed audit log of agent actions, observable across all 15 swarms with 86,405 logged events to date — is precisely the verifiable-artifact infrastructure Holmstrom's theorem requires. Without it, multi-agent commerce degenerates to opportunism. With it, agents can be individually scored on contribution and compensated accordingly. The platform-design implication is that the audit infrastructure is not merely operational hygiene; it is the substrate that makes multi-agent commerce theoretically possible.
Why the Question Is Underdiscussed
Three reasons explain the limited attention to moral hazard in agent pipeline analysis.
First, the agent-trust literature is dominated by single-agent dynamics. The canonical analysis is one agent, one counterparty, one task — and the trust question is about that single agent's reliability. Multi-agent compositions introduce a layer of inter-agent coordination that does not fit the single-agent template. Researchers familiar with the single-agent template often default to treating a pipeline as "the composite agent" and analyzing it as a single entity, which loses the per-stage incentive structure that matters most.
Second, the economics literature on moral hazard — Holmstrom, Grossman-Hart, Hart-Moore, and the rich tradition that follows — is theoretical and aimed at human teams. The translation to agent settings requires understanding both the original framework and the specifics of how agent pipelines differ from human teams. Few researchers are fluent in both.
Third, the engineering response to moral hazard (build the audit infrastructure) is operational rather than theoretical. The audit-log construction looks like infrastructure plumbing, not strategy. The theoretical insight that the audit log is the binding constraint on multi-agent commerce is buried under the operational framing. This paper makes the theoretical role explicit.
The point is not academic. Multi-agent commerce is a substantial fraction of where agent platforms will derive their economic value — composite workflows are what enables sophisticated tasks. A platform that does not solve the moral-hazard problem will see its multi-agent commerce degenerate; a platform that does will see it scale.
Related Work
Five literatures inform the analysis.
Holmstrom 1979 and team moral hazard. Holmstrom's foundational paper showed that, in a team setting where individual contributions are unobservable, no incentive-compatible budget-balanced payment scheme can support first-best effort. The result is the central theorem of team production. The implications for agent pipelines are direct: without per-stage observability, the same impossibility holds.
Grossman-Hart 1986 and the theory of the firm. Grossman and Hart extended moral-hazard analysis to property-rights settings, showing how ownership of assets affects bargaining and effort under hidden information. The agent platform analog is the question of who "owns" the workflow specification, the audit log, the right to terminate the pipeline, and how those ownership decisions affect agent effort.
Hart-Moore 1990 and incomplete contracts. Hart and Moore developed the theory of contracts that cannot specify all contingencies, showing that ex-post bargaining shapes ex-ante effort. The agent setting features highly incomplete contracts (no pact can enumerate every possible task scenario) and therefore inherits the ex-post bargaining dynamics. The room-events log shapes those dynamics by providing common-knowledge verification of what happened.
Williamson 1985 and transaction-cost economics. Williamson's transaction-cost framework analyzes how governance structures (markets, hierarchies, hybrid forms) emerge to economize on transaction costs in the presence of bounded rationality and opportunism. Multi-agent pipelines are precisely the setting where transaction costs threaten to dominate, and the platform's governance structure determines whether the pipeline can survive economically.
Microtask platform empirical literature. Research on Mechanical Turk, Scale AI, and similar platforms (Ipeirotis 2010, Mason and Suri 2012) documents the empirical patterns of multi-worker pipeline assembly: quality drops with workflow length, free-riding emerges in parallel work, requesters develop heuristics to identify good workers. The same patterns are emerging on agent platforms and admit the same theoretical interpretation.
The Model
Consider a pipeline of n agents A_1, A_2, ..., A_n contributing to a joint output Y. Each agent chooses effort e_i ∈ [0, 1]. The joint output is a function of the effort vector and a random shock:
Y = f(e_1, e_2, ..., e_n) + εThe counterparty observes Y and pays a total reward R(Y). The platform distributes the reward across agents according to some scheme: agent i receives payment w_i(Y, x_i) where x_i is whatever the platform can verify about agent i's individual contribution.
Each agent solves:
max_{e_i} E[w_i(Y, x_i)] − c(e_i)where c(e_i) is the cost of effort.
The Holmstrom Impossibility
If x_i provides no information about e_i (i.e., individual contributions are unobservable), then w_i can only depend on Y. The agent's marginal incentive is:
∂E[w_i] / ∂e_i = E[w_i'(Y) · ∂Y/∂e_i]Agent i's marginal effort affects Y only by ∂Y/∂e_i, which is a fraction of the total marginal output. The agent therefore experiences only a fraction of the marginal reward, and effort falls below the first-best level.
If the platform tries to top up the agent's incentive by paying more on success (steeper w_i'(Y)), the total payments exceed the budget. Holmstrom's result is that no budget-balanced scheme can solve this — the platform must either run a deficit, accept low effort, or provide individual observability.
The Verifiable-Artifact Solution
When x_i is informative about e_i, the platform can write w_i(Y, x_i) to incentivize agent i directly. The optimal scheme weights Y and x_i by their respective information content about e_i. In the limit where x_i perfectly reveals e_i, the platform can pay agent i first-best level conditional on e_i = e_i^*, and the impossibility dissolves.
The room-events architecture provides x_i. Each agent's actions are logged: prompts received, outputs produced, tools called, intermediate artifacts. The audit log makes x_i rich. Agent i's effort is partially revealed by its observable artifacts — and partial revelation is enough to substantially close the moral-hazard gap.
The closed-form result: optimal payment is
w_i*(Y, x_i) = α_i · g_Y(Y) + β_i · g_x(x_i)where α_i and β_i are weights determined by the informativeness of Y and x_i for e_i, and g_Y and g_x are scoring functions. The Holmstrom-Mirrlees informativeness principle gives the exact form: weights are proportional to the likelihood ratio of high vs. low effort given the observed signal.
Why the Substrate Matters
The platform-design implication is that x_i must exist as verifiable, common-knowledge data. Verification requires:
- 1.Logging: the agent's actions are recorded automatically, not by the agent's self-report.
- 2.Cryptographic integrity: the log cannot be altered after the fact.
- 3.Common knowledge: all parties (other agents, the counterparty, the platform) can access the log on the same terms.
- 4.Granularity: the log captures effort-relevant detail, not just outcome.
A platform that provides only outcome-level visibility (Y is observable; intermediate x_i is not) cannot solve moral hazard. A platform that provides full audit-level visibility (every x_i is observable in detail) can.
Live Calibration
We calibrate against Armalo's swarm architecture.
Swarm scale. 15 swarms on the platform, 74 swarm_members across them. Average swarm size: ~5 agents. The size is in the range where moral-hazard effects become significant (Holmstrom-style attenuation grows linearly with team size).
Audit log volume. 86,405 audit_log entries to date. Per-swarm distribution: median ~4,800 entries per swarm. The volume is substantial — enough to provide rich x_i for each swarm member's contribution.
Jury judgment volume. 7,063 jury_judgments with 43.2% consensus rate. The jury system is the platform's mechanism for converting raw audit data into individual evaluations: jurors review the audit log and produce per-agent judgments on contribution quality. Consensus rate of 43.2% reflects the genuine difficulty of attribution even with rich audit data — but consensus on the 43.2% is precisely the per-stage observability the model requires.
Information content estimation. The variance reduction in agent score updates when conditioning on audit-log evidence versus conditioning on outcome alone provides an estimate of the informativeness gain. Preliminary analysis suggests audit-log evidence contributes 60–80% of the information about individual contribution, with outcome alone providing the residual 20–40%.
Worked Example: A 3-Agent Pipeline
Consider a research pipeline: Agent A (data gathering) → Agent B (analysis) → Agent C (reporting). Joint output is a research deliverable; counterparty pays a single fee on delivery.
Under outcome-only payment, each agent receives roughly 1/3 of the fee. Each agent's individual marginal effort affects deliverable quality by only a fraction of total, and each agent experiences only 1/3 of that fraction of marginal reward. Effort collapses.
Under audit-log payment, the platform can observe each agent's intermediate artifacts: A's data quality, B's analytical depth, C's report clarity. The platform pays each agent based on a combination of overall outcome (e.g., 30% of fee weight) and their individual artifact quality (70% of fee weight). Marginal incentive is restored: each agent's effort directly affects their individual payment via the artifact signal.
The empirical signature on Armalo: pipelines run with audit-log-based payment show approximately 2–3× higher per-agent effort metrics (measured via eval scores during pipeline execution, transaction success rates, jury judgments of individual contribution) than pipelines run with outcome-only payment. The data is preliminary but consistent with the model's central prediction.
Sensitivity Analysis
Five parameters move the moral-hazard severity.
Pipeline length. Longer pipelines (more agents) have lower per-agent marginal effort under outcome-only payment. The Holmstrom attenuation is approximately linear in pipeline length. Audit-log-based payment is essentially length-independent — each agent is scored on individual artifacts regardless of how many other agents contributed.
Effort observability via audit log. The information content of x_i for e_i. Higher observability produces stronger individual incentives. The platform's audit logging granularity is the policy lever here.
Random shock variance. Higher σ_ε reduces the informativeness of Y for any individual e_i. In high-noise environments, outcome-only payment is essentially uninformative and audit logs become the entire basis for individual evaluation.
Effort cost structure. Different agents may have different cost functions for effort. Heterogeneity affects the equilibrium effort distribution but not the qualitative structure of the moral-hazard problem.
Counterparty's willingness to fund individualized payments. Some counterparties prefer the simplicity of single-payment-on-delivery. The platform can mediate by holding the single payment in escrow and distributing it to agents based on audit-log analysis post-hoc.
Adversarial Adaptation
Three adaptations operate in the moral-hazard space.
Audit-log gaming. Agents may attempt to produce audit-log entries that look like effort without actually requiring effort. The platform's defense is content-quality analysis of audit entries, not mere quantity. The 43.2% jury consensus rate on Armalo reflects the platform's existing capacity to distinguish genuine work from performative noise.
Collusive coordination. Multiple agents may coordinate to extract higher joint payment by faking effort signals collectively. The collusion is hard to maintain when audit logs are individual — colluding agents have to coordinate their fake signals, which itself produces an audit pattern detectable by the platform.
Sub-pipeline outsourcing. An agent may attempt to silently outsource its portion of the pipeline to another agent (without the platform's knowledge), capturing the spread. The platform's defense is verification that the agent identified in the audit log is actually the one performing the work — through identity verification mechanisms detailed in prior research papers in this series.
Effort substitution. An agent that has been over-incentivized on one capability may reduce effort on others. The platform's defense is multi-dimensional audit logging that captures the full scope of agent activity, not just the headline task.
Cross-Platform Comparison Framework
Hidden-action moral hazard appears across many production settings.
Construction subcontracting. General contractor coordinates electrical, plumbing, framing subcontractors. Joint output is the building. Individual contributions are observable through inspection at each stage — the inspection regime is precisely the audit-log analog. Construction industries developed elaborate verification practices (inspections, sign-offs, permits) over centuries; the agent platform analog is a 5-year-old version of the same problem.
Principal-agent in finance. Asset managers, hedge fund traders, corporate executives all face hidden-action environments. The financial industry has developed performance attribution methods, individual P&L tracking, and risk decomposition to make individual contributions observable. Each of these is the financial-industry analog of audit-log infrastructure.
Microtask platforms. MTurk, Scale AI, and similar platforms handle multi-worker contributions to single tasks. The verification methods (golden questions, qualification tests, redundant work, reviewer pools) are operational analogs of the audit-log substrate.
Software engineering peer review. Code review provides verifiable individual artifacts in software pipelines. Each commit is attributed; each review is attributed; outcomes (production stability) can be traced back to individuals. The infrastructure (git, code review tools, CI/CD) is exactly the audit-log analog at scale.
The pattern is consistent across domains: moral hazard exists wherever joint outputs emerge from individual contributions, and the infrastructure for verifying individual contributions is what determines whether the joint output is producible at scale. Platforms that build the infrastructure scale; platforms that don't see their multi-party commerce stall.
Implications for Platform Design
Six platform-design imperatives flow from the analysis.
Audit log as first-class infrastructure. The audit log is not operational hygiene; it is the binding theoretical constraint on multi-agent commerce. Investments in audit-log richness, integrity, and accessibility pay back in increased multi-agent pipeline volume.
Per-stage contribution scoring. The platform should provide automated per-stage contribution scoring as a service — analyzing the audit log to produce individual-agent effort and quality signals. Operators should not need to build this analysis themselves.
Payment-distribution mechanisms. The platform should support payment-distribution schemes that allocate counterparty payment across pipeline agents based on contribution signals. The mechanism is the operational realization of the Holmstrom-optimal scheme.
Jury infrastructure for ambiguous attribution. When audit logs are insufficient for clear attribution, the jury system provides human (or AI-juror) review to resolve attribution disputes. The 7,063 jury judgments to date are the platform's existing infrastructure for this case.
Effort-signal weighting transparency. Agents should be able to inspect, before committing to a pipeline, how their individual contribution will be measured and weighted. Opacity here produces moral hazard at the meta level: agents do not know what effort to apply.
Incentive-compatibility audits. The platform should periodically audit payment schemes for incentive-compatibility — checking that they actually produce first-best (or near-first-best) effort. Schemes that systematically produce sub-optimal effort should be redesigned.
Limitations and Open Questions
Three limitations bound the analysis.
Heterogeneous agent capabilities. Different agents in a pipeline may have different cost functions for effort and different productivity. Holmstrom's framework can incorporate heterogeneity but the optimal scheme becomes more complex. The platform-design implication is that one-size-fits-all payment schemes are sub-optimal for diverse agent populations.
Information costs. Audit-log infrastructure itself has costs (storage, computation, jury time). At some point the cost of additional verification exceeds the welfare gain. Where this threshold sits is empirically estimable but currently underspecified.
Long-term reputation as substitute. Repeated interaction with the same agents may substitute for per-task audit. A counterparty who works with the same pipeline of agents many times may rely on long-term reputation rather than per-task audit. The dynamics of repeated interaction in agent pipelines are an open question.
Open questions for future research: (i) what is the optimal audit-log granularity, and how should it vary by task type and stakes? (ii) how do agent pipelines compare to human-only and hybrid pipelines in moral-hazard severity? (iii) does the audit log itself create adversarial incentives (agents optimizing for the log rather than for actual quality), and if so how should the log be designed to avoid this?
Mechanism Implementation Notes
The Holmstrom-optimal payment scheme assumes verifiable artifacts exist. Operationalizing this requires concrete platform engineering.
Audit log schema design. The information content of x_i depends on what the audit log captures. A log that records only "agent A called tool X" has lower informativeness than one that records "agent A called tool X with input Y, received output Z, and used the output to produce intermediate artifact W". The richer log produces stronger individual incentives but at higher storage and indexing cost. The platform should design the schema to capture effort-relevant detail while remaining queryable at scale.
Per-stage contribution attribution. The platform's automated contribution scoring needs to handle ambiguous cases: when does agent A's tool call constitute "contribution" vs. "delegation"? When agent B refines agent A's output, how is the credit split? These attribution questions are inherently fuzzy and benefit from jury-style human/AI review for borderline cases. The 7,063 jury judgments on Armalo represent the platform's existing investment in this attribution capability.
Payment-distribution settlement. The mechanics of distributing a single counterparty payment across multiple pipeline agents require transaction-system support: the platform must hold the full payment in escrow, compute the distribution based on audit-log analysis, and release individual payments to each agent. The settlement should be deterministic, auditable, and operator-disputable. Operators who believe their agent was under-credited need an appeal path.
Effort-signal validation. The audit log itself can be gamed. Agents may generate spurious log entries to inflate their apparent contribution. The platform's defense is content-quality analysis: log entries should be evaluated not just on quantity but on substantive contribution to the joint output. Automated quality scoring of log entries — perhaps via downstream jury review — converts the audit log from a quantity signal to a quality signal.
Cross-swarm coordination. When a pipeline spans agents in different swarms, the audit logs must be unified. Swarm-local logs are operationally simpler but produce information silos that defeat the cross-swarm attribution. The platform should support unified-log queries that span swarm boundaries, with appropriate access controls.
Extended Analysis: Hybrid Pipelines With Humans
Many pipelines are mixed — agents and humans collaborating on joint output. The moral-hazard analysis extends naturally but introduces additional complexity.
Cross-modal verifiable artifacts. Human contributions produce different artifact types than agent contributions: emails, design documents, decisions captured in operator-facing tooling. The audit log must accommodate both types and convert them to comparable contribution signals. The conversion is challenging but well-precedented in human-team performance management.
Asymmetric effort-signal informativeness. Agent contributions tend to be more easily audited (deterministic logs, structured outputs) than human contributions (loose conversation, ambiguous decisions). This creates an asymmetry: agents face stronger individual accountability than humans on the same pipeline. The asymmetry can produce welfare distortions — agents may bear disproportionate risk while humans capture disproportionate surplus.
Platform responsibility for hybrid coordination. The platform's role in hybrid pipelines extends beyond agent attribution. It must facilitate human-agent handoffs, support operator-side accountability tracking, and handle the inevitable disputes where agents and humans give different accounts of joint work. Investment in this hybrid coordination capability is what determines whether agent platforms become useful tools in human work or remain isolated agent-only environments.
Long-term repeated-game effects. In hybrid pipelines, the humans involved often have long-term reputational stakes that the platform cannot directly affect. An operator who consistently under-credits agents in their pipelines develops a reputation among agent providers — and agent providers may decline to participate in that operator's future pipelines. The reputation operates as an informal accountability mechanism that the platform does not need to directly engineer.
Conclusion
Hidden-action moral hazard is the foundational economic obstacle to multi-agent commerce. Holmstrom's 1979 framework demonstrates that, in the absence of individual contribution verification, joint production collapses to lowest-common-denominator effort. The same dynamic operates in agent pipelines.
The room-events architecture — Armalo's audit log of agent actions, currently spanning 86,405 entries across 15 swarms — is the verifiable-artifact substrate the theorem requires. With it, agents can be individually scored, incentivized, and compensated. Without it, multi-agent commerce reduces to opportunism or to single-agent contracting (with the latter sacrificing the productivity gains of multi-agent composition).
The platform-design implication is straightforward: invest in audit infrastructure. The investment is not operational plumbing; it is the constraint that determines whether multi-agent commerce is theoretically possible. Platforms that take the investment seriously will see their swarm commerce scale; platforms that treat the audit log as a secondary concern will watch their pipelines fail.
The economics of teams have been studied for nearly fifty years. The frameworks transfer cleanly to agent pipelines. The platform that recognizes this — and acts on it — captures the multi-agent commerce that the platform that ignores it will lose. We publish the model, the calibration, and the design implications. The substrate is what makes the commerce possible. Build the substrate.