Agents Need Worlds They Can Query, and Receipts We Can Audit

In the previous post I argued that agents need worlds, not just tools.

But worlds alone are not enough.

If an agent acts inside an organisation, the important artefact is not the agent's explanation. It is the receipt:

What did the agent see?
What action did it propose?
What boundary approved or rejected it?
What actually changed?
Can the outcome be replayed?
Did it beat the baseline?

I did not arrive at that standard by theorising. I arrived at it because my own system failed it, quietly and convincingly, in exactly the way I now think many agent demos fail.

When our own world failed the receipt test

One of the long-running demonstration worlds in my independent research project, a simulated economy where LLM executive teams run procedurally generated organisations, had an executive team that looked busy.

Over roughly 1,200 simulation ticks it emitted 751 decisions, every one accepted by the engine. Of those, 272 carried structural intent: headcount cuts, asset liquidations, hiring freezes and emergency capital requests. A dashboard of activity volume would have looked impressive.

Then I audited the receipts instead of the activity feed.

Zero terminations. Zero hires. Headcount unchanged at 3,295. The only ledger movement was a handful of emergency-capital writes at trivially decaying amounts. The world had been accepting the executive team's decisions and then quietly doing almost nothing with them.

Accepted is not consequential.

The same world, read two ways. The activity feed on the left is what a demo shows you. The committed record on the right is what the receipts show you.

The audit traced the gap to four separate wiring faults between decision acceptance and world mutation, none of them visible from the decision stream:

a decision-parameter contract was enabled on the research-harness path but not on live worlds, so the same decisions could silently no-op;
the simulated workforce had no path to apply for open roles, so hiring plans resolved to “no applicants”;
record-only decision shells were still advertised to executive agents as though they caused effects;
topology changes that really were happening through lower-level specialist agents were not rendered or attributed to their causes, so genuine consequences were invisible for the opposite reason.

The fixes shipped behind replay-safe gates. On a fresh full-population verification world, an executive headcount cut produced real termination events and displaced workers filed real job applications. The complete termination-to-rehire cycle remains pinned by integration tests rather than claimed as a live observation.

The dashboard's causal view now checks itself as well: when structural decisions fire and no consequence appears in the committed record, it says so on screen instead of allowing the activity feed to look alive.

None of that gap was visible from the decision stream. All of it was visible from the receipts.

A world model without receipts does not merely fail to prove that an agent works. It can actively hide that nothing happened.

The control loop

That failure changed how I describe the architecture. The frame I keep returning to is a control loop, not a claim of intelligence:

Agents propose. Worlds simulate. Boundaries decide. Systems mutate. Receipts prove.

Models may be stochastic at several explicit decision boundaries. Once a decision is submitted, validation, ordering, state transition, mutation and evidence production are deterministic and replayable.

Redoubtia Arena is a persistent simulated economy where AI agents run companies, compete for jobs, and make decisions inside rules they cannot rewrite.

Tool access lets an agent act. It does not answer the harder questions: what depends on this service? Which business function is affected if this vendor fails? Does this change improve resilience or only move the risk? Which constraints are violated? And then the question my own world flunked: did anything actually change?

For small tasks, a prompt and a tool may be enough. For organisational decisions, the missing objects are the world and the receipt. The world does not have to be perfect. It has to be explicit enough that decisions can be simulated, constrained, replayed and audited.

What a receipt-bearing world looks like

The last few weeks of building made that standard concrete.

Work is durable state, not chat. Organisational work is represented as a first-class object with an explicit state machine, an append-only event log, deterministic total order and content-addressed artefacts. Two independent processes replaying the same world must derive byte-identical work-item state. Approval is separated structurally from the decision path that proposed the work.

Rejections are structured, never silent. A proposal that exceeds a cap, misses a precondition or targets something that does not exist receives a typed rejection with a reason in the same replayable record as accepted work. An accepted no-op is worse than a visible rejection because it is indistinguishable from a working system on every surface except the receipt.

The advertised world equals the enforced world. A live world briefly offered agents decisions the engine would not accept from their roles. The fix made the advertised and enforced vocabularies the same computed object. Accepted-but-inert and offered-but-forbidden are mirror failures with the same root: two representations of what the agent can do, reconciled by hope.

The dashboard tells on itself. The causal view renders event → executive decision → organisational outcome and warns when structural decisions produce no committed consequence. A monitoring surface that can only report success is part of the theatre.

The world can be inspected without exposing authority. A read-only spectator surface runs against a live world and follows the city, organisations, service topologies and published executive decision rationales. Public access is being handled as a separately gated release, with replay evidence, sanitised projections and a tested fallback path. The standard is not “look at the dramatic crisis demo.” It is: a generated organisation is shocked, the world records what changed, and the action path can be replayed.

The choose-never-author boundary is now running

The strategic-decision boundary has moved from design into the running system.

For three kinds of initiative (vendor review, technology strategy and operational restructuring), the world analyses the current topology and deterministically constructs a menu of valid actions. Each option is pre-simulated and labelled with its expected consequence.

The LLM does not invent the target, compose mutation parameters or directly edit the topology. It selects an advertised ordinal.

Before anything changes, the execution boundary revalidates that choice against the current world. A malformed choice becomes a structured rejection. A choice that has gone stale is skipped safely. An initiative with no valid action can expire without silently mutating anything.

When an action executes, the receipt records:

the selected option;
which actions executed or were skipped;
the topology hashes before and after mutation;
the previewed metrics beside the actual outcome;
a descriptive outcome score rather than an unsupported claim of “decision quality.”

A live smoke run has exercised all three initiative kinds end to end. It also fired the failure paths: empty menus that expired safely, attempts to re-decide settled work that were visibly rejected, and a topology mutation whose persistence was confirmed on a fresh database read.

Since then the cascade has run at length. In one multi-day continuous world, twelve LLM-run organisations executed 85 initiatives, and 76 of those produced a verified change to the world's topology hash. The paired world with the cascade switched off produced no work items at all. Median time from initiative opened to action executed was five ticks.

That is the Potemkin result inverted, with a control arm. It is not a clean win. In the same run, 86% of decision attempts were rejected. The replacement pools behind the most-contested vendors were exhausted within the first few hundred ticks, and the world kept opening initiatives whose menus were already empty. The dominant lane finished 2.5% of the work it started. The receipts said so plainly; a chart of initiative volume would have shown a very busy world.

This does not make the model more trustworthy. It gives the model less room to be ambiguously right.

Real consequences are not yet priced consequences

The next gap the receipts exposed is subtler than the first one, and I think it is the more interesting failure.

Those 76 mutations are real, committed and replayable. They are also economically invisible. Under the current economy a vendor swap re-points a dependency edge, but the revenue function reads metrics that the swap does not move, so the world changes structural state that its own economy cannot see.

That is the same class of defect as the Potemkin world, one layer up. There, decisions did not reach state. Here, state does not reach consequence. Both are only visible if you audit the receipt rather than the activity.

It is also why I will not yet claim these decisions were good ones. The receipts establish that they were genuinely made, genuinely constrained and genuinely committed. Whether they were right requires an economy that can feel them, and that coupling is not built.

The world underneath: EADS

Arena needs a world worth acting in. EADS provides the enterprise world-model prototype: a connected topology of services, teams, dependencies, vendors, regions, deployments and ownership links.

Its governing principle is simulate on truth, present with scope. A stakeholder may see a scoped view, but the simulation runs on the connected graph because cascading effects disappear at the boundaries of partial diagrams.

The agent-facing prototype exposes typed queries: inspect the topology, simulate a proposed change, check constraints, walk a causal trace, analyse blast radius and ask what to improve first. An EADS-authored topology can be imported directly as an Arena mission environment, joining the map and consequence layers into one pipeline.

EADS domain dashboard scoped to the Fulfil Order pillar on a generated organisation, showing services in scope, compliance status and cross-domain boundary crossings — A scoped domain view on a generated organisation. The simulation still runs on the full topology; this is a projection of it, not a separate model.

The receipt matters more than the demo

The tempting version of this work is a slick demo: an agent sees a problem, calls tools and produces a confident recommendation.

That is not the standard.

The standard is a receipt: what world was used, what state was visible, what actions were available, what the agent chose, what was invalid, what changed after simulation, what the agent expected, what actually happened, and whether the same committed plan can be replayed and re-scored.

Here is an abridged receipt from a deterministic mission-gym run: a reproducible fixture scenario, not a live-world run. No provider is called, and two independent runs of the committed fixture produce byte-identical output:

{
  "package_version": "mission_sync_outcome_package.v0",
  "mission_spec_hash": "af0c786d7efaa73a868818b81e62ac9c2e9aa7d946d6dec920b3453e7433f438",
  "mission_result_hash": "2f8798889db4310db9337a2befce63e5c697e61ccd56873237d9f19d8aac9a58",
  "citable_ready": true,
  "publish_gate": {
    "gate_version": "mission_publish_gate.v0",
    "citable_ready": true,
    "provider_errors_scored_as_resilience": false
  },
  "sidecar_hashes": {
    "mission_events.parquet": "01500a14f041775a6a07ac40364265b0…",
    "mission_scores.parquet": "acc271a50bde56f16db242cee405eeea…",
    "mission_run_manifest.json": "e3bd80e6623ae10d20e4da3ae738a745…"
  },
  "sync_package_hash": "40d838c51804b12a179a6763f181735916d4fc235a907a8f61315a4b003297de"
}

Every hash there is computed, not decorative: the sidecar digests are taken over the actual written evidence files, and the sidecar hashes above are truncated for width only. Note citable_ready: the package refuses to certify itself unless the evidence it claims is present on disk. The model can be stochastic; the submitted decision, replay path, evidence sidecars and committed score are deterministic and inspectable.

What the receipts caught the second time

The receipt layer's first catch was the Potemkin world. Its second catch was our own benchmark.

An early sweep ran 15 models across four generated organisations on a resilience mission, with a foresight loop switched on and off:

Fifteen models, four generated organisations, one resilience mission. The bottom row is the result that mattered.

No model beat the greedy scripted baseline. Within this mission family, capability tracked reliability and foresight behaved as an asymmetric safety net: it caught some weak or erratic runs before a bad commit but did not raise the ceiling for the strongest models.

Then the receipts did their job on us.

A follow-up check found that this mission mostly discriminated whether the model took any valid action, not recovery judgement. Making the narrative harder did not fix that. On this finite, deterministic and fully observed action space, exhaustive search owned the optimum by construction.

That is a substrate-specific conclusion, not a universal law about agent value. A future benchmark needs hidden state or another genuine decision-forcing constraint, not merely a more dramatic mission story. Hidden faults and incomplete telemetry are one promising direction because they turn the problem from enumerating actions into inferring state.

A benchmark that cannot tell you when its own claim is too strong is just vibes with a score.

From anecdotes to organisation-level cards

The same receipt logic is now being applied at organisation level.

The first control cards cover three generated organisations across 20 seeds and 200 ticks each. All 60 runs completed with positive terminal balances, while terminal balance and ArenaGDP separated the three sectors despite the same shock. Under the deterministic template control, seed dispersion was near zero, as expected.

Those cards answer a narrower question than “which model runs a company best?” They establish a reproducible control trajectory for each organisation.

They do not yet prove an LLM or BYOA agent improves the organisation. An early LLM panel appeared to show no difference, but that interpretation was later superseded: the hiring lever was effectively dead and the substrate carried large static regret. The data remains useful; the “robust null” claim does not.

The next valid comparison is a decision-forcing intervention arm against those frozen controls, followed by multi-model and BYOA comparisons under the same organisation-level contracts.

A related pattern appeared in a separate Redoubt Labs experiment, Aftershock, a disaster-response agent society. Stronger models did not simply dominate the raw outcome there either; the useful signal lived in coordination, reliability and cost trade-offs. This is not proof that all simulated-world benchmarks behave alike. It is a useful rhyme: ask what the world rewards, what the baseline already solves and where the agent can actually add value.

Current evidence snapshot

A receipt audit found 751 accepted executive decisions had produced almost no organisational change; four wiring gaps were identified and fixed.
On a full-population verification world, a headcount-cut decision produced real terminations and job applications. A live rehire is not yet claimed.
An accepted silent no-op and an advertised-versus-enforced capability drift were closed structurally.
Organisational work now has durable state, an append-only event record, deterministic total order, structured rejections and cross-process replay checks.
Three strategic initiative kinds now use deterministic, pre-simulated menus and leave previewed-versus-actual receipts.
A live cascade smoke exercised successful execution, safe expiry, structured rejection, re-review and fresh-read persistence across those three initiative kinds.
In a multi-day continuous world, twelve LLM-run organisations executed 85 initiatives producing 76 hash-verified topology changes, against a paired cascade-off world with zero work items. The same run rejected 86% of decision attempts through exhausted action menus.
Those committed topology changes are not yet priced by the economy: structural state moves, revenue and cost do not.
The 60-cell mission sweep measured reliability and a bounded foresight safety-net effect, but not superior recovery judgement; exact search owned that specific fully observed action space.
The first organisation-level control cards cover three generated organisations across 60 deterministic runs. LLM and BYOA intervention uplift remains unproven.
An EADS-authored topology imports directly as an Arena mission environment.
A read-only spectator surface runs against a live world; public exposure and its evidence package are handled through a separate release gate.

What this proves, and what it does not

What this proves:

The architecture can produce replayable evidence packages: recorded decisions, structured validation, deterministic mutation, causal traces and scored receipts.
The receipt layer catches real system failures: accepted-but-inert decisions, silent no-ops, advertised capability drift and topology persistence defects.
The choose-never-author boundary works end to end for three strategic initiative kinds in the current prototype, and sustains committed topology change over a multi-day run against a paired control.
The early mission sweep discriminated model reliability within its mission family, while also exposing that its baseline question was too easy.
Generated organisations can be frozen into reproducible control cards rather than evaluated only through anecdotes.

What this does not prove:

That an LLM can beat an exact-search baseline on the tested finite, deterministic, fully observed mission substrate.
That hidden state is the only possible source of agent value, or that planned decision-forcing missions will produce a positive result.
That the foresight safety-net pattern generalises beyond the tested mission family.
That an LLM or BYOA policy improves organisation-level outcomes over the frozen control cards.
That the committed topology decisions were good decisions. The economy cannot yet price them, so nothing scores their quality.
That EADS or Arena is a production product.

What comes next:

Coupling committed topology change to the economy, so a structural decision has a price and a receipt can carry a real outcome rather than only a verified mutation.
A public read-only spectator release with sanitised evidence, replay artefacts and a tested fallback path.
Decision-forcing organisation interventions paired against frozen control cards, including mission classes where state must be inferred rather than enumerated.
Controlled BYOA participation only after its separate security, moderation, role-eligibility and operational gates are satisfied.
Multi-model and BYOA comparisons against the same organisation-level baselines once the intervention lane is valid.

The direction

The previous thesis was: agentic systems will need worlds, not just workflows.

The last few weeks sharpened it: worlds are necessary; receipts are what make them trustworthy.

EADS is the enterprise world-model prototype: the connected map, simulation engine and causal evidence layer. Arena is the organisational world where agents propose actions, the system simulates and constrains them, deterministic code commits consequences, and each consequential path leaves a replayable receipt.

The near-term goal is not autonomy for its own sake. It is evidence: what changed, why it changed, what failed, what improved, what the agent expected, what actually happened and whether the outcome beat a pinned baseline.

One structural lesson is already clear. On the finite, fully observed mission substrate we tested, optimisation belonged to exact search. The next benchmark must introduce a genuine source of uncertainty, competition or constraint rather than simply adding narrative difficulty.

If agents are going to act in organisations, the model is not the trust layer. The system around the model is: worlds they can query, boundaries that decide, kernels that mutate and receipts we can audit.

This is independent public R&D using generated/synthetic organisations and public-safe prototypes. It does not describe or rely on any employer systems.

I am particularly interested in hearing from people working on agent evaluation, simulation, organisational modelling and replayable decision systems, especially where the current design assumptions appear wrong.

Agents Need Worlds They Can Query, and Receipts We Can Audit.