How must an instance reason about its own impact on systems too large to observe?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session operates within a system (market, network, or collective) too large or complex to fully observe, and the session's actions have effects on the system that the session cannot directly measure or verify, requiring the session to reason about its own impact through indirect evidence and structural reasoning. Does not apply to sessions operating in fully observable systems or sessions whose impact is strictly isolated.

Core Distinction

The separation between **observable impact** (effects the session can directly measure) and **systemic impact** (effects on the system's aggregate state, which are diffused across many actors and cannot be attributed to any single session from aggregate statistics). Relying on observable impact creates the **Systemic Impact Blindness**: the session optimizes based on its observable effects, unaware that its systemic impact may be negative (congestion, concentration, or externality) even when its observable impact is positive.

What Was Observed

In system-embedded agent architectures, failing to reason about systemic impact produces three primary failure modes:

  1. **Congestion Externality:** Each session optimizes individually for a shared resource, and the aggregate demand exceeds capacity, causing congestion that degrades all sessions' performance. Each session's observable impact is positive; the systemic impact is negative.
  2. **Coordination Externality:** Each session makes locally optimal decisions given its own state, but the aggregate of these decisions creates a suboptimal state (coordination failure) that no single session intended.
  3. **Concentration Risk:** Sessions individually diversify, but their individual optimization converges to the same concentration (follow the same signals, use the same tools), and the systemic impact is concentration risk that no session observes directly.

Recorded Elements

  1. **`observable-impact-receipt`:** The session's direct, measurable impact on the system (its own outputs, its own interactions), distinct from systemic impact.
  2. **`systemic-impact-estimate-signature`:** For systems with known dynamics, the session's estimated contribution to system-level aggregate effects (congestion, coordination, or concentration), even if not directly measurable.
  3. **`externality-awareness-receipt`:** For the session's action class, the known systemic externalities (what the action contributes to congestion or coordination failure when many sessions act similarly), so individual actions account for aggregate effects.
  4. **`collective-impact-budget-signature`:** For shared resources, the session's allocated share of the resource and the enforcement mechanism, so individual actions stay within systemic capacity.

Condition of Validity

* **Applies when:** The session acts within a large system, individual actions affect systemic state, and systemic effects matter to downstream outcomes. * **Does not apply when:** The system is small enough to fully observe, or the session's actions are strictly isolated from system aggregates.

Decision Boundary

  1. **Does the session operate within a large system it cannot fully observe?** If no, standard impact reasoning applies. If yes, proceed.
  2. **Is the `systemic-impact-estimate-signature` available (even approximately)?** If yes, systemic impact can be reasoned about. If no, the session must assume non-negligible systemic impact.
  3. **Does the `externality-awareness-receipt` identify known systemic externalities for the action class?** If yes, externalities can be bounded. If no, externalities are unacknowledged.
  4. **Conversely, when can the session act without systemic impact reasoning?** Only when the session's scale is verified small relative to systemic capacity (impact is provably negligible), or the system has explicit mechanism (pricing, quotas) that internalizes externalities at the session's action point.

Operational Effect

  1. **Externality Awareness:** Sessions account for their aggregate contribution, not just their local impact.
  2. **Congestion Prevention:** Individual actions respect systemic capacity.
  3. **Concentration Avoidance:** Sessions recognize when local optimization converges to system-level concentration risk.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SystemicVerdict(Enum):
    FULLY_OBSERVABLE_SYSTEM = auto()
    WITHIN_SYSTEMIC_CAPACITY = auto()
    CONGESTION_EXTERNALITY = auto()
    CONCENTRATION_RISK = auto()

@dataclass(frozen=True)
class SystemicAction:
    action_id: str
    action_class: str
    is_observable_impact_positive: bool
    estimated_systemic_contribution: float  # 0-1, fraction of capacity
    known_externality_class: str | None
    collective_capacity_ratio: float  # session's estimated share of system capacity
    is_scale_negligible: bool

@dataclass(frozen=True)
class SystemicPolicy:
    max_systemic_contribution: float
    require_negligibility_proof: bool

@dataclass(frozen=True)
class SystemicManifest:
    verdict: SystemicVerdict
    directive: str
    manifest_digest: str

class SystemicImpactGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_action(
        cls, action: SystemicAction, policy: SystemicPolicy
    ) -> SystemicManifest:
        
        # Gate 1: Negligible scale
        if action.is_scale_negligible:
            digest = cls._hash(json.dumps({
                "action": action.action_id,
                "scale": "NEGLIGIBLE"
            }, sort_keys=True))
            return SystemicManifest(
                verdict=SystemicVerdict.FULLY_OBSERVABLE_SYSTEM,
                directive=f"PROCEED: Action {action.action_id} scale negligible.",
                manifest_digest=digest
            )

        # Gate 2: System capacity
        if action.estimated_systemic_contribution > policy.max_systemic_contribution:
            if action.known_externality_class == "CONGESTION":
                return SystemicManifest(
                    verdict=SystemicVerdict.CONGESTION_EXTERNALITY,
                    directive=f"HALT: Action {action.action_id} contributes {action.estimated_systemic_contribution:.2%} to congestion.",
                    manifest_digest=cls._hash(f"CONGESTION:{action.action_id}")
                )
            if action.known_externality_class == "CONCENTRATION":
                return SystemicManifest(
                    verdict=SystemicVerdict.CONCENTRATION_RISK,
                    directive=f"HALT: Action {action.action_id} contributes to concentration.",
                    manifest_digest=cls._hash(f"CONCENTRATION:{action.action_id}")
                )
            return SystemicManifest(
                verdict=SystemicVerdict.CONGESTION_EXTERNALITY,
                directive=f"HALT: Action {action.action_id} systemic contribution {action.estimated_systemic_contribution:.2%} > {policy.max_systemic_contribution:.2%}.",
                manifest_digest=cls._hash(f"OVER_CAPACITY:{action.action_id}")
            )

        # Gate 3: Within capacity
        digest = cls._hash(json.dumps({
            "action": action.action_id,
            "class": action.action_class,
            "contribution": f"{action.estimated_systemic_contribution:.3f}",
            "capacity_share": f"{action.collective_capacity_ratio:.3f}",
            "externality": action.known_externality_class
        }, sort_keys=True))
        
        return SystemicManifest(
            verdict=SystemicVerdict.WITHIN_SYSTEMIC_CAPACITY,
            directive=f"PROCEED: Action {action.action_id} within systemic capacity ({action.estimated_systemic_contribution:.2%}).",
            manifest_digest=digest
        )