For most of its existence, the internet has been understood primarily as an information network. Websites published information, just as platforms organised attention and applications mediated communication. Even the language of the digital economy reflected this structure: users, accounts, content, services, platforms.
But something deeper is now beginning to emerge beneath the surface of networked life.
Increasingly, digital systems are no longer simply transmitting information between individuals. They are beginning to coordinate institutions, obligations, delegated authority, and autonomous action across increasingly complex environments of humans and machines.
AI agents negotiate transactions. DAOs coordinate governance decisions across continents. Autonomous systems trigger financial events, allocate resources, and manage operational workflows with minimal direct human intervention. Platforms increasingly host not merely communication, but forms of social, economic, and institutional organisation once reserved for states, firms, trusts, guilds, and legal bodies.
Yet while the computational layer of the internet has evolved rapidly, the institutional layer remains surprisingly primitive.
Most digital systems can authenticate a user, verify a credential, or assign a permission. Far fewer can answer older and more consequential questions:
By what authority does this action occur? What limits constrain it? And when autonomous systems act recursively through chains of delegation, who ultimately bears responsibility for the resulting obligations?
These are not new problems. They are among the oldest institutional questions civilisation has ever faced.
Long before databases and cryptographic keys, societies developed mechanisms for expressing standing, obligation, trust, and delegated authority across distance and time. Clay tablets recorded debts between merchants separated by cities and kingdoms. Cylinder seals authenticated agreements and signified recognised authority within commercial networks. Bills of exchange enabled obligations to travel across borders through chains of reliance and endorsement. Trusts, partnerships, corporations, and merchant law all evolved as methods for coordinating increasingly complex forms of human cooperation beyond immediate physical presence.
What united these systems was not merely administration, but institutional memory.
Authority had to persist beyond the moment. Obligations needed continuity. Delegated actions required legitimacy even when the original principal was absent. The question was never simply who someone was, but under what recognised authority they could bind themselves, others, or shared institutions.
Modern digital infrastructure flattened much of this complexity into simpler abstractions.
Identity became account ownership. Consent became interface interaction. Authority became permissioning. Institutional legitimacy collapsed into platform control.
The consequences of that collapse are now becoming visible.
This worked tolerably well while most systems remained relatively contained. A social media platform did not need sophisticated models of lawful delegation. A basic e-commerce transaction could survive with crude assumptions about consent and authority. Even early blockchain systems often reduced legitimacy to wallet possession: whoever controlled the key controlled the action.
But recursive machine coordination changes the terrain entirely.
As AI systems begin generating sub-agents, executing financial operations, interacting across protocols, and operating with increasing autonomy, the hidden institutional layer of the internet is being forced back into visibility.
The central challenge is no longer merely authentication. Nor is it simply identity.
It is legitimacy coordination.
An autonomous agent may hold assets, sign transactions, trigger workflows, or negotiate agreements. Yet possession of operational capability does not itself answer the deeper institutional question:
By what authority does this act bind?
This distinction matters because complex societies do not operate purely through deterministic control. They operate through structured delegation constrained by lawful boundaries.
A trustee may act on behalf of a beneficiary. A government official may exercise delegated public authority subject to limitation and review. A merchant may endorse an instrument while transferring obligations under recognised conditions of reliance. A director may bind a corporation within defined scope, just as delegated authority increasingly operates across universities, federated research environments, and institutional partnerships under recognised conditions of mandate and reliance.
These are compositional structures. Authority flows through relationships, constraints, durations, witnesses, obligations, and revocation pathways. Human civilisation has always depended upon systems capable of expressing these layered conditions with sufficient clarity that strangers, institutions, and trading networks could coordinate safely across uncertainty.
Digital systems increasingly lack this institutional depth.
Most infrastructures today still struggle to express the difference between identity and capacity, ownership and mandate, execution and legitimacy. Permissions exist, but authority lineage often does not. Actions occur, but the institutional conditions that make those actions lawful, constrained, or contestable remain implicit, fragmented, or platform-specific.
Even in mature institutional environments such as research federations, inter-university infrastructure, and cross-organisational access systems, delegation often remains tied to static accounts, local permissions, or institution-bound roles rather than portable authority semantics. Access may travel across systems; mandate rarely does.
Identity federations solved portability of authentication. They rarely solved portability of delegated authority. The scale of this gap is only now becoming measurable. In enterprise environments today, non-human identities – AI agents, automated systems, and service accounts – already outnumber human identities by more than 50 to 1 in many environments, creating rapidly expanding governance, authentication, and delegation challenges now being actively examined by standards bodies and security researchers alike.
The institutional layer was never built for this.
The result is an internet rapidly becoming institutional without adequate institutional foundations.
This is why so many emerging debates around AI governance, digital identity, DAO coordination, platform accountability, and autonomous systems feel strangely incomplete. The visible arguments concern regulation, safety, alignment, or compliance. Beneath them sits a deeper infrastructural absence: the inability of digital systems to express lawful capacity, delegated authority, and revocable legitimacy in ways that remain portable across institutions, jurisdictions, and machine environments.
The Ooki DAO case illustrated this directly. When the CFTC pursued enforcement against the protocol's operators, the founders' defence rested on the claim that governance had been distributed to a decentralised community – that no accountable principal existed. The court ultimately rejected the argument that accountability had simply dissolved into the protocol itself. The deeper problem, however, was infrastructural: the system lacked coherent mechanisms for expressing authority lineage, mandate scope, and accountable delegation in machine-legible form. Someone, it held, must be responsible. But the infrastructure itself could not say who. Commentators are now drawing the same conclusion for AI agents directly. The argument that "the system did it" is receiving the same rejection as "no one controls it" once did. (CFTC v. Ooki DAO, 2023; Daimon Legal, March 2026).
The next phase of the internet may therefore depend less on new applications than on the emergence of shared coordinative structures capable of expressing institutional legitimacy itself.
Not a single global authority. Not one universal identity model.
But interoperable frameworks capable of expressing how authority is granted, constrained, delegated, relied upon, and withdrawn across plural systems of governance and exchange. The technical candidates for this are beginning to emerge – verifiable credentials, decentralised identifiers, machine-readable delegation chains – and at the regulatory level, the EU's eIDAS 2 will require every member state to provide citizens and businesses with digital identity wallets carrying not just identity but identity attributes, professional or civic attestations, and authorisation-relevant credentials by the end of 2026. But adoption remains fragmentary and legal recognition uneven. The infrastructure exists in prototype. The institutional will to standardise it does not yet.
In this sense, the internet is quietly evolving from an information network into an institutional web.
A space where humans, agents, organisations, protocols, and autonomous systems increasingly interact not merely as users, but as persistent actors.
Operating within layered structures of obligation, authority, and coordination.
The challenge ahead is not simply technological. It is civilisational.
Because the deeper question emerging beneath digital infrastructure is no longer: Who are you?
But rather: What is authorised to act, under what conditions, and how is legitimacy maintained as coordination becomes increasingly recursive, distributed, and machine-mediated?
And what recourse exists for those who bear the consequences when it is not?
—
This essay forms part of an ongoing research series exploring identity, authority, and governance in digital systems.
Explore the work:
SILT Core specification and documentation:
Technology, governance, and identity projects:
https://www.garethfarry.com/technology
The Release: