A company creates five digital roles to review one commercial proposal. A researcher gathers facts, an analyst calculates ratios, a critic challenges assumptions, a writer prepares the case and a coordinator asks them to agree. Their transcript is impressive. Yet nobody can say which role was authorised to commit the institution, which source changed the answer, whether the critic had independent evidence, or who must repair the downstream action. The system produced conversation without an organisational commitment.

That failure is easy to misdiagnose as a prompting problem. It is an organisation-design problem. Organisations have always coordinated bounded actors with specialised knowledge, incomplete information and delegated authority. Simon placed decisions and their premises at the centre of administrative organisation; March and Simon examined organisations as systems of roles, influence and coordinated behaviour.12 Digital agents introduce another possible role occupant. They do not create another legal or moral principal. A model can observe, propose, calculate, route and execute within permission. The institution and its authorised people continue to define purpose, accept consequence and answer for the result.

The design question is therefore not how many agents an organisation can deploy. It is which commitments must be made, verified and discharged across human and digital roles. This article develops an organisational commitment graph: six typed elements that connect principals, bounded roles, promised results, evidence contracts, coordination protocols and receipts. It also supplies an economic test. Multiplicity is justified only when genuine differentiation or bounded concurrency beats one agent with deterministic tools after every coordination edge, state write, conflict and verification duty is priced.

01 / From boxes to obligationsAn organisation chart hides the work that must cross it

An organisation chart records reporting relationships and named units. It rarely shows the commitments that make an outcome possible. A credit decision, for example, may depend on evidence retrieval, arithmetic, policy interpretation, commercial context and authorised judgement. These responsibilities can sit in different boxes, but the outcome succeeds only when each role delivers an accepted result to another role under a known rule. The same is true when some occupants are software.

Galbraith linked task uncertainty to organisational form and information-processing capacity.3 Malone and Crowston framed coordination as the management of dependencies among activities.4 Both ideas become practical when a digital role is treated as a bounded participant in a dependency system. Its output is not valuable merely because another agent can read it. The output must satisfy a named commitment, carry admissible evidence and arrive at a recipient authorised to accept or reject it.

A commitment graph is not a software architecture diagram. It is an operating record of who may promise what to whom, under which evidence and acceptance conditions. A role boundary that exists only in a system prompt is weak. It has no independent authority definition, no protected interface and no durable receipt. A robust boundary survives model replacement because it is encoded in permissions, workflow states, data contracts, review rights and service obligations.

02 / The strong rivalSimple orchestration should win by default

The strongest rival to a multi-agent organisation is deliberately plain: one bounded agent uses deterministic tools inside a workflow and sends a consequential decision to an authorised human. It has fewer interfaces, fewer state transitions and fewer opportunities for a plausible error to acquire social proof. Its trace is easier to reconstruct. Its cost is easier to forecast. Its failure can often be isolated at one boundary.

Multiple roles become useful when the work contains real organisational differences. One role may retrieve evidence from a source unavailable to another. A verifier may need incentives and reporting lines independent of the proposer. Two activities may run concurrently because delay matters and their state is separable. A policy interpreter may hold a different permission from an execution service. These are reasons for separation. Giving five copies of the same model the same prompt, memory and documents is not. Apparent debate cannot manufacture independent evidence.

Agency theory warns that delegated actors and principals can have different interests and information.5 Knowledge is also distributed: Jensen and Meckling distinguished knowledge that can be transferred cheaply from knowledge costly to move, while Aghion and Tirole separated formal authority from effective control created by information.67 Those distinctions suggest a hard test. Add a role when it needs a distinct knowledge position, authority, incentive, timing or challenge function. If none differs, retain the simpler topology.

03 / Commitment semanticsSix types turn activity into accountable work

The principal is the institution or authorised human role that defines purpose and accepts consequence. A business may appoint a credit executive as accountable principal for a lending policy, while the regulated entity remains responsible to customers and supervisors. Calling a digital agent an owner does not transfer that responsibility. It only obscures it.

A role is a bounded responsibility with entry conditions, competence requirements and authority. The role may be occupied by a person, agent or deterministic service, but the occupancy type matters. A digital occupant needs explicit tools, data scope, action limits and time bounds. A human occupant may contribute situated judgement or accept a consequence that cannot be delegated. A deterministic service should occupy a transformation role when stable rules and inputs fully define its output.

A commitment promises a state change, evidence product or service. It names an owner, recipient, due condition and acceptance test. “Analyse the applicant” is an activity request. “Deliver verified cash-flow ratios from the signed accounts, with calculation version and exception flags, before the credit meeting” is a commitment. The second can be accepted, rejected, repaired and audited.

A message and evidence contract states what may cross a role boundary. It includes type, provenance, confidence, freshness, recipient and permitted use. A retrieved paragraph labelled as unverified evidence must not silently become accepted organisational state. A verifier should receive the underlying source and transformation trace, not only a persuasive synthesis.

A coordination protocol governs dependency. It defines sequence, permissible concurrency, conflict resolution, quorum, escalation, stop and recovery. Coordination is not an invitation for agents to chat until they agree. It is an enforceable rule for what happens when evidence is late, two roles disagree, a tool fails or authority is ambiguous.

A receipt proves the commitment was accepted, executed, verified or rejected and records downstream effect. It can be a signed decision record, an immutable event, a test result or an exception acknowledgement. Receipts stop the organisation from confusing a sent message with a completed obligation. They also enable recovery because the operator can see which downstream commitments consumed a defective result.

Hutchins showed how cognition can be distributed across people, artefacts and socially organised activity.8 That does not imply that every component has the same status. A chart, procedure, instrument and navigator can participate in a cognitive system while authority remains differentiated. Ostrom likewise showed that polycentric arrangements depend on rules, monitoring and ways to resolve conflict rather than on unconstrained plurality.9 The lesson for an agentic organisation is precise: distributed capacity becomes governable only when commitments and control conditions are explicit.

04 / Graph economicsEvery additional role creates edges and verification debt

A new role adds more than its own operating cost. It creates incoming and outgoing message contracts, shared-state questions, conflict paths, latency, permissions, monitoring and recovery duties. If every role can exchange state with every other role, possible pairwise edges rise rapidly. The exact implementation may restrict those edges, but the design burden remains: every permitted edge needs a reason, type and failure rule.

Three quantities deserve explicit attention. Coordination load is the time and money spent routing, waiting, reconciling and reviewing rather than completing the underlying commitment. Error propagation is the number and consequence of downstream commitments that can consume a defective output before detection. verification debt is the stock of unresolved evidence, conflicts and untested assumptions carried into later work. A topology that lowers task time but increases all three can make the organisation slower and less accountable.

The commercial value of concurrency must be measured against that cost. Parallel retrieval from independent registries may shorten a deadline without shared writes. By contrast, parallel narrative agents editing the same assessment can create expensive reconciliation with no new evidence. The first is separable work; the second is contention. A topology designer should ask which commitment can proceed independently, what state it reads, who may write, and what happens when results diverge.

Coordination-cost reversal is a legitimate outcome. Suppose a low-volume review uses three agents and two human checkpoints. Instrumentation shows that evidence reconciliation and review take longer than the original work. The organisation should return to one bounded agent with tools, while keeping the acceptance test and human judgement. Removing roles is not regression. It is evidence that the simpler rival now dominates.

05 / Failure boundariesConversation can conceal contaminated state and collided authority

Agent swarm theatre

Five identical agents review the same document with the same context. Their outputs differ in wording, so the interface presents a debate. Yet the roles have no independent sources, incentives or verification method. Correlated error can appear as consensus. The remedy is to remove redundant roles or give a verifier a genuinely different evidence path and acceptance test. Diversity of names is not diversity of evidence.

Authority collision

A planning role proposes an account change. An execution role can also submit it. Both hold the same credential because implementation was convenient. The role distinction is cosmetic: either occupant can create the consequential state. The remedy is a hard permission boundary. The proposer issues a signed commitment request; the executor accepts only validated requests within its separate authority; a human or policy service controls exceptions. One action must have one authorised execution path.

Shared-memory contamination

A retrieval role writes a speculative note into common memory. The analyst reads it as fact, the writer removes the caveat, and the approver sees only the polished conclusion. Shared memory has converted uncertainty into organisational truth. The remedy is not a longer prompt. Evidence should cross boundaries in typed envelopes with source, confidence, status and permitted use. Accepted state should change only through a controlled receipt.

The human rubber stamp

The final approver receives a fluent recommendation but cannot inspect sources, conflicts, rejected alternatives or transformations. Approval becomes ceremonial. NIST's AI RMF Core links governance to roles, documentation, accountability and human-AI configurations, while its generative AI profile calls for controls suited to generative risks.1112 Human oversight also appears in the EU AI Act alongside provider and deployer duties and logging requirements.13 A meaningful judgement point therefore needs time, competence, authority and evidence. If the person cannot reconstruct why a commitment should be accepted, the organisation has placed a signature after the decision rather than human judgement within it.

Independent challenge should also be organisationally credible. The IIA's Three Lines position distinguishes management responsibility from independent assurance.14 A verifier using the same model, context, memory, owner and success metric as the proposer is not independent merely because it has a critic label. Independence can require different evidence access, permissions, reporting, incentives or sampling rights. The necessary degree depends on consequence.

06 / Deterministic and human boundariesSome steps should not become agent roles

A stable eligibility calculation with specified inputs, tested rules and reproducible outputs should remain a deterministic service. Wrapping it in a conversational role adds variability without adding judgement. The service can still appear in the commitment graph: it accepts a typed input, returns a versioned calculation and issues a test receipt. What it should not do is improvise policy.

Human-owned work sits at a different boundary. A decision may require accepting institutional consequence, resolving value conflict, considering confidential context or granting an exception. An agent can prepare evidence and expose alternatives, but an authorised person must make and record the judgement. The human role is not a residual bucket for everything difficult. It has a named commitment and acceptance duty of its own.

07 / Worked systemCommercial credit as a receipt-bearing commitment graph

Consider a commercial-credit evidence process. The accountable principal is the institution's authorised credit function. Its outcome is a defensible decision made under policy, with an explanation and route for exception or redress. The process separates five responsibilities because their evidence, method and authority differ.

A retrieval role gathers signed accounts, registry data and approved external evidence. It cannot interpret policy or submit a decision. An arithmetic service calculates ratios from typed figures using versioned code. It is deterministic because the transformation is stable and testable. A policy-interpretation role maps verified facts to current policy and flags ambiguity, but cannot grant an exception. A narrative-preparation role assembles the evidence, calculation receipts, policy mapping, conflicts and rejected alternatives. Finally, an authorised human judge accepts, rejects or escalates the commitment.

The roles do not share a conversational memory. Retrieval issues evidence tokens with provenance and freshness. Arithmetic consumes accepted numeric tokens and returns a calculation receipt. Policy interpretation receives facts and policy version, then records clauses and unresolved questions. The narrative role can arrange material but cannot alter its status. The judge receives the source path and all conflicts, not only the recommendation.

Recovery starts from receipts. If a registry source is later corrected, the operator can identify which evidence commitment changed, which calculation consumed it and which decision pack reached the judge. The process can suspend downstream action, recompute deterministically and route an amended case. Without receipt lineage, the organisation can only search transcripts and hope that every consumer is found.

The example also shows why a commitment graph does not imply that every node should be an agent. The arithmetic node is a tested service. The final node is human-owned. Digital roles occupy retrieval, interpretation and preparation only within their evidence and permission boundaries. ISO/IEC 42001's management-system orientation reinforces this organisational view: AI use belongs within objectives, roles, controls, monitoring and continual improvement, not outside them as an autonomous digital workforce.15

Operating the graph after design

A topology becomes real only when its commitments are admitted into an operating register. For each edge, that register should name the sending role, receiving role, evidence type, permitted purpose, acceptance test, maximum age, timeout and recovery owner. For each role, it should record the occupant type, credentials, tools, data scope, service condition and prohibited actions. The graph itself should have an accountable principal, an approved version and a date or trigger for review. These records turn a diagram into something an operator, auditor and affected business owner can inspect.

Acceptance testing has three levels. A role-level test asks whether an occupant stays inside its competence and permission boundary. A commitment-level test asks whether the promised evidence product or state change meets the recipient's conditions. A graph-level test asks whether the combined system reaches the organisational outcome without concealed conflicts, unacceptable delay or uncontrolled propagation. Passing component tests is insufficient when two correct components can still collide over state or authority.

Runtime observation should follow commitments rather than tokens consumed. Useful measures include the proportion accepted on first submission, rejection reasons, time waiting at boundaries, unresolved conflict age, manual repair effort, receipt completeness and downstream reversals. Edge cost includes the infrastructure and review needed to keep a connection safe, not merely the price of a model call. A graph that appears efficient only because human reconciliation is recorded outside the system is mismeasured.

Conflict deserves its own protocol. When proposer and verifier disagree, neither should silently overwrite the other. Their claims, sources and acceptance tests should be preserved as separate objects. A rule can resolve a narrow factual conflict if an authoritative source clearly governs it. A policy ambiguity or material judgement should move to the authorised human with both positions intact. The disposition becomes a receipt that can improve policy, tests or role instructions without rewriting history.

Change control matters because a model update, tool replacement or new data source can alter effective authority even when the organisation chart stays still. The principal should ask which commitments changed, which acceptance tests remain valid and whether past evidence is still comparable. A role that gains a transactional tool may have crossed from proposal into execution. That is an authority change and requires a new permission review, not a routine software release note.

Incidents should be contained at the narrowest receipt boundary. Operators pause new commitments, identify the last accepted state, trace affected consumers and choose repair, recomputation, human substitution or retirement. They should not allow the remaining roles to debate a way around a failed control. Recovery is complete only when affected downstream commitments are reconciled and the principal accepts the evidence that normal operation can resume.

Retirement is also a commitment. Credentials are revoked, queues drained, shared stores closed, pending obligations transferred and recipients told which service now applies. Evidence and receipts are retained for the required period. A digital role that disappears from an interface while its key, scheduled work or memory persists has not been retired. Clean exit is part of organisational accountability because abandoned authority can continue to create consequence.

08 / Interactive design testOrganisational Agent Topology Designer

Use the designer to choose the smallest topology that can discharge the commitments. It does not calculate a maturity score. It tests whether role separation has positive evidence, whether state and authority are controlled, whether verification is independent and whether coordination economics remain favourable.

How the negative controls route

Identical-agent theatre routes to simplification because shared sources and a same-context verifier provide no independent challenge. Authority collision routes to separated proposing and verifying roles, with one protected executor. A stable eligibility formula routes to a deterministic service or human-owned step. Ungoverned shared memory or missing stop routes force simplification. High coordination cost reverses the graph to a smaller design even when multiplicity was once defensible.

The designer's result is a starting topology, not permission to deploy. Before operation, each commitment needs an owner, recipient, test, message contract and receipt. Each digital role needs a permission boundary and service condition. Each human judgement point needs inspectable evidence, time and competence. The principal must approve the failure and recovery logic, because a graph that can start but cannot stop is not an organisational system.

09 / The operating principleMake the organisation inspectable before making it agentic

An agentic organisation is not a company populated by synthetic colleagues. It is an institution that can assign bounded digital capacity to explicit commitments without losing the location of purpose, authority and consequence. That distinction protects both ambition and accountability. It permits agents to perform useful work while refusing the fiction that software has absorbed the principal's duty.

The commitment graph also changes executive attention. Leaders stop asking how many agents a process contains and ask which obligation each role discharges, what independent evidence it contributes, what authority it holds, what receipt proves completion and how failure is contained. Those questions expose swarm theatre, duplicate authority and ceremonial approval before they become operating facts.

Start with one bounded actor and deterministic controls. Separate roles only when evidence, authority, incentives, timing or independent challenge genuinely differ. Type every message that can alter accepted state. Give consequential action one execution path. Preserve conflicts for the human judge. Count edge and review cost. Remove roles when the graph no longer earns them. The result is not the largest multi-agent system. It is the smallest organisational system that can make, verify and discharge its commitments.

That discipline makes every added role answerable to an observable obligation and every removed role evidence of deliberate organisational learning.

SourcesReferences

1. Simon, H. A. (1947/1997). Administrative Behavior, 4th ed. Simon & Schuster. Publisher record.
2. March, J. G. and Simon, H. A. (1958/1993). Organizations, 2nd ed. Wiley. Publisher record.
3. Galbraith, J. R. (1974). “Organization Design: An Information Processing View.” Interfaces, 4(3), 28–36. DOI.
4. Malone, T. W. and Crowston, K. (1994). “The Interdisciplinary Study of Coordination.” ACM Computing Surveys, 26(1), 87–119. DOI.
5. Jensen, M. C. and Meckling, W. H. (1976). “Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure.” Journal of Financial Economics, 3(4), 305–360. DOI.
6. Jensen, M. C. and Meckling, W. H. (1995). “Specific and General Knowledge, and Organizational Structure.” Journal of Applied Corporate Finance, 8(2), 4–18. Verified publisher DOI.
7. Aghion, P. and Tirole, J. (1997). “Formal and Real Authority in Organizations.” Journal of Political Economy, 105(1), 1–29. DOI.
8. Hutchins, E. (1995). Cognition in the Wild. MIT Press. Publisher record.
9. Ostrom, E. (2010). “Beyond Markets and States: Polycentric Governance of Complex Economic Systems.” American Economic Review, 100(3), 641–672. DOI.
10. Wooldridge, M. and Jennings, N. R. (1995). “Intelligent Agents: Theory and Practice.” The Knowledge Engineering Review, 10(2), 115–152. DOI.
11. NIST. AI Risk Management Framework Core. Official resource.
12. NIST (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1. Official publication.
13. European Union (2024). Regulation (EU) 2024/1689, Artificial Intelligence Act. Official Journal text.
14. The Institute of Internal Auditors (2026). Statement of Position on the Three Lines Model. Official resource.
15. ISO/IEC (2023). ISO/IEC 42001: Artificial Intelligence Management System. Standard record.