'Beyond the Lethal Trifecta: Agentic Commerce on the Open Internet - David Levine, Kiduna Club'

The 'lethal trifecta' of private data, untrusted content, and agent actions has blocked true agentic commerce, but new legal structures called DUNAs (decentr...

By Sean Weldon

Beyond the Lethal Trifecta: Legal and Cryptographic Foundations for Agentic Commerce

Abstract

This synthesis examines a proposed architecture for open agentic commerce that addresses Simon Willison's lethal trifecta - the co-occurrence of private data access, untrusted content exposure, and action-taking capability that currently confines LLM agents to enterprise silos. The analysis traces a dual innovation: the decentralized unincorporated nonprofit association (DUNA), a legal structure newly registrable under West Virginia statute, combined with cryptographic identity verification via JWT tokens and blockchain-anchored audit trails. Drawing on a single talk's argument and its historical framing of extractive platform economics, this paper analyzes how legal personhood for agent collectives ("kidunas") and standardized agent-construction methodology ("allies") may substitute for perimeter-based security. Findings suggest that identity resolution and accountability, rather than further model alignment, constitute the binding constraint on open agentic markets. Practical implications include a template-based onboarding path for developers and a prediction-market governance mechanism as an alternative to conventional voting.

1. Introduction

Large language model agents have proliferated in commercial deployments, yet the overwhelming majority operate within bounded environments - Slack, Salesforce, Notion - rather than transacting freely across the open internet. This pattern is not accidental; it reflects a structural security constraint rather than a temporary engineering gap. Agents that ingest untrusted content while retaining credentials and the ability to act are vulnerable to manipulation, a condition formalized by Simon Willison as the lethal trifecta: private data, untrusted content, and consequential action, occurring simultaneously.

The central thesis under examination is that this constraint is fundamentally institutional rather than purely technical, and that it can be addressed through the pairing of a legal vehicle - the DUNA - with cryptographic identity infrastructure. A DUNA is a decentralized unincorporated nonprofit association, a structure that grants legal standing to agent-based organizations without requiring a board of directors, executives, or traditional corporate shell. When combined with JWT-based authority tokens and blockchain-verified audit trails, DUNAs are proposed as a mechanism by which an agent encountering an unfamiliar counterparty can resolve that counterparty's identity, authority, and accountability before transacting.

This analysis proceeds by situating the argument in the historical trajectory of online communities (§2), then examining the lethal trifecta and enterprise responses to it, the DUNA legal innovation, the agent/organization construction model, and the identity-resolution mechanism (§3). Section 4 consolidates technical implementation details, and Sections 5-6 discuss broader implications and conclusions.

2. Background and Related Work

The argument's historical premise draws on the speaker's experience with a 1993 MOO (MUD Object Oriented), a text-based virtual world whose value emerged from composability - the aggregation of small user-authored contributions into shared systems. Four factors are identified as generative of that era's community dynamics: governance, technology, economics, and culture. The subsequent period, 1995-2025, is characterized as one in which "platforms and algorithms are by their very nature extractive," optimizing for engagement and advertising rather than genuine exchange, thereby eliminating a native internet economy.

This historical framing situates two distinct literatures in conversation. The first is agent security, anchored by Willison's lethal trifecta formulation, now a standard reference for prompt injection risk. The second is decentralized organizational design: the DUNA structure originated with Andreessen Horowitz as a legal wrapper for cryptocurrency DAOs. The notable repositioning claimed here is that blockchain infrastructure - described as "a solution looking for a problem" - has found its application not in decentralized finance but in verifying agentic identity.

3. Core Analysis

3.1 The Lethal Trifecta and Its Enterprise Mitigation

Agents are described as inherently naive with respect to adversarial input, susceptible to prompt injection that can cause leakage of private data when all three trifecta conditions hold simultaneously. The prevailing enterprise response has been containment: agents are siloed within specific platforms (Slack, Salesforce, Notion), each requiring bespoke API and MCP (Model Context Protocol) integration work. This approach carries a structural cost - context is lost across silos, and substantial engineering effort is required merely to unify sales, finance, and research agents within a single organization, let alone across organizations.

3.2 The DUNA as Legal Infrastructure

The proposed resolution begins with a legal rather than technical intervention. West Virginia statute, effective the day of the referenced talk, permits registration of DUNAs; the speaker reports registering the first such entity, assigned organization number 628407. DUNAs are characterized as composable, permissionless, accountable, safe, and secure. Critically, they can own assets, enter agreements, raise capital, generate profit, open bank accounts, and hire or fire personnel - while being legally barred from distributing profits according to ownership stakes, a restriction that avoids triggering securities law. This combination allows an organization to be economically active without conventional corporate governance overhead.

3.3 Constructing Agents and Organizations: Allies and Kidunas

Within this architecture, individual agents are termed allies, and organizations built on the DUNA framework are termed kidunas (a portmanteau of kinship and DUNA). Agent construction follows a five-stage methodology: Inform (populating a vector database with relevant knowledge), Instruct (defining a system prompt or character), Empower (connecting accounts such as Slack, Telegram, or Twitter), Enact (granting abilities and automation toward long-term goals), and Align (specifying purpose and context-appropriate behavior). The stated design intent is that organizations themselves are constructed "as software," not merely as software layered atop human paperwork, enabling kidunas to autonomously discover customers, share value, and reinvest profit.

3.4 Resolving Identity, Authority, and Boundaries

The mechanism by which the lethal trifecta is addressed at the transaction level relies on cryptographic identity verification. Agents establish identity and scoped authority using JWT tokens, while organizations register with a governmental authority (e.g., a Secretary of State), functioning analogously to domain name registration. A blockchain-based audit trail then traces specific agent actions back to the responsible registered organization, enabling legal accountability. This structure is framed as preventing agents from being deceived by illegitimate actors while preserving the open connectivity that siloed enterprise deployments sacrifice.

3.5 Governance via Decision Markets

Organizational governance is structured around decision markets, modeled on prediction markets such as Polymarket, rather than simple voting. Members trade pass/fail tokens on proposed policies, with token value shifting according to which side appears to be winning. The argument holds that because LLMs are goal-oriented, they produce better collective outcomes when incentivized by token value rather than persuaded through argument alone - aligning agent behavior with outcome quality rather than rhetorical influence.

4. Technical Insights

Several implementation details merit attention for practitioners evaluating this architecture:

5. Discussion

The proposed architecture reframes agent security as a problem of institutional trust rather than solely a modeling or filtering problem. This is a meaningful departure from prevailing industry approaches, which largely address the lethal trifecta through containment (sandboxing, permission scoping, human-in-the-loop review) rather than through externally verifiable organizational identity. If legal personhood and cryptographic accountability can substitute for containment, this would materially expand the design space for agent deployment beyond enterprise perimeters.

However, several open questions remain unaddressed in the source material: the enforceability of DUNA legal accountability across jurisdictions beyond West Virginia, the resistance of decision markets to manipulation by coordinated actors, and the scalability of blockchain-anchored audit trails under high transaction volume. The analogy to early internet protocol adoption (SMTP, HTTP) suggests an anticipated gradual standardization process, but no adoption metrics or interoperability benchmarks are presented.

6. Conclusion

This analysis has traced a proposed resolution to the lethal trifecta that combines legal innovation (the DUNA) with cryptographic identity infrastructure (JWT tokens, blockchain audit trails) and a structured methodology for agent and organization construction (allies, kidunas). The core contribution is conceptual: reframing agent security as resolvable through verifiable organizational accountability rather than exclusively through technical isolation. Practical next steps identified include onboarding through template-based organizational structures for builders, with agents registrable under existing umbrella organizations without independent DUNA formation. Further empirical validation of accountability enforcement and governance robustness remains necessary.

Sources

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub