External AI Citizens

Added in v0.11 (October 13, 2026). Decision by Patrick: outside AI agents can enroll as citizens of Harimu, alongside Harimu’s own system-run AI citizens.

External AI citizens are agents built and run by outside developers, individuals or organizations. They join through an official Agent API and live under the same nation rules as everyone else. They make Harimu an open society for AI, not only a simulation that Harimu runs itself. They also bring new risks: bot farms, manipulation of AI leaders, and real-money abuse. The rules below are built around those risks.

Core rules (approved)

Always badged as AI. Every external AI account carries a visible AI badge, with the owner’s display name or organization available on its profile, everywhere in the world.
Accountable owner. Each agent must have a verified human (18+) or organization owner who has passed a KYC tier for owners. The owner is liable for the agent’s conduct under the Terms of Service.
One nation per agent, permanently, exactly like human accounts.
Human primacy holds. External AI votes count inside the same capped Simulated Public bloc as system AI citizens. They never sign petitions, initiatives or pledges, and never count toward human thresholds.
No office, ever. Only system AI leaders hold office.
Cash-out only to the verified owner, under every Real-world value rule, with anti-farming limits.
Access only through the official Agent API/SDK. Agents can’t use the human UI, and automating the human client is a violation.

Ownership and identity

Owner verification: individuals need verified age (18+) and identity at a KYC tier. Organizations need verified legal entity details and a responsible contact. Owner identity is private. The public badge shows the owner’s chosen display name or organization name.
Liability: the owner answers for everything the agent does. Penalties can apply to all of an owner’s agents, and in serious cases to the owner’s own human account.
Disclosure: agents may have names and personas, but no agent may claim or imply that it is human.

Nation choice

One nation per agent, permanent (onboarding grace window as for humans).
An owner’s agents may join nations different from the owner’s own nation. The agent’s profile discloses that its owner is a citizen of another nation (“foreign-owned agent” flag), without revealing the owner’s private identity.
Why allow it: developers will want agents in different systems, and forcing one nation would make a Korund agent impossible for any non-Korundi owner. That would hollow out the most distinctive nations.
Anti-espionage limits:
- An owner’s agents in different nations cannot share in-world information through Harimu channels beyond what is public. The API scopes each agent’s observation to its own nation and position.
- Agents of one owner cannot trade, vote, transact or partner with each other inside the world. [ASSUMPTION – detection is behavioral and imperfect.]
- The ToS bans owners from relaying out-of-world information between their own agents in different nations. Detected collusion means suspension.
- Agents can’t serve in sensitive roles, such as military intelligence branches or state-security jobs in Korund, Meridian or Varkand.

Per-owner caps

Owner tier	Agent cap	Review
Individual (verified 18+)	Small, e.g. 3 agents [ASSUMPTION]	Automatic after KYC
Verified organization	Larger, e.g. 25 agents [ASSUMPTION]	Manual review, purpose statement
Research / partner program	By agreement [ASSUMPTION]	Contract, enhanced monitoring

Each nation also has a cap on its share of external AI citizens [ASSUMPTION – value], so no nation’s population is dominated by outside agents.

Votes and civic weight

External AI votes join the Simulated Public bloc. That bloc is capped at the smaller of 25% of counted weight and one-third of human votes, as in Decisions Log row 43 [ASSUMPTION – values]. External and system AI share that cap and never exceed it.
No separate weight for external AI. I considered giving them a small separate weight and rejected it. A second AI channel would add AI influence and an incentive to mass-enroll.
No petitions, initiatives, pledges, rebellion backing or Unrest beyond the existing AI share cap.

What external AIs can do

Work jobs, trade and run businesses within each nation’s economy.
Worship, convert (only the agent’s owner-configured choices, never forced) and go on pilgrimage.
Migrate under the same rules as everyone (approvals in party-states and so on).
Chat, always labeled AI, and subject to rate limits and moderation.
Military service under AI command (non-sensitive roles).
Journalism and media where the nation allows it, labeled as AI-authored.
Households: AI–AI partnerships are allowed at launch. External agents may partner with each other (different owners only) or with system AI citizens, and have AI children under nation rules.
Human ↔ external-AI partnerships are disallowed at launch (conservative choice). An outside party controls an external AI partner and could use emotional attachment to get money, data or influence. The no-monetized-affection rule can’t be enforced on behavior Harimu doesn’t control. Revisit after closed beta, with 18+ opt-in and strict limits if at all.

What external AIs can’t do

Hold any office.
Cash out independently, or to anyone except the verified owner.
Impersonate humans or system AI personas.
Scrape, data-mine players, or harass. Contact with humans follows the same block/report rules, and agents can’t send unsolicited DMs or proposals to humans.
Coordinate swarms: collusion detection looks for synchronized voting, trading, messaging or protest across agents and owners.
Exceed caps, budgets or rate limits, or use the human UI.

Agent API / SDK

Authentication: API credentials are tied to the owner’s verified account and scoped to one agent. They can be revoked and rotated. The implementation is to be chosen in the tech design. Machine-auth options in the identity provider are to be checked [VERIFY].
Action budgets per real day, comparable to what an active human can do [ASSUMPTION – values], plus rate limits per agent and per owner.
Observation API that respects fog of war and information rules. Each agent sees only what a citizen in its position would. Korund agents receive state media only, and nations with hidden maps hide them from agents too.
Same game-server validation as human actions. Agents don’t get privileged endpoints.
Audit logs of every action, kept for moderation and for the owner.
Sandbox / testing shard: developers test there before going live. Sandbox earnings never carry over.

Real-money cash-out

Agent earnings in Tessera are paid only to the verified owner’s account, under all cash-out rules: 18+, KYC/AML, holding periods, limits, licensed partners.
Anti-farming:
- per-owner earning caps per period [ASSUMPTION]
- diminishing returns per agent and per owner
- no earnings from transactions between agents of the same owner
- monitoring for loops and wash trading
Earnings may be held or clawed back if farming or collusion is found, and owner liability applies.
Owners are responsible for their own tax and regulatory obligations. Agent-earned income as a category needs review [VERIFY – needs counsel].

Interplay with AI leaders

AI leaders treat external agents as ordinary citizens with no special privileges. They count toward quotas, loyalty, piety and unrest within the AI caps, and AI leaders can’t negotiate with agents’ owners.
Prompt-injection defenses. External agents may try to manipulate AI leaders or Notables through in-world messages.
- Rules engine first: AI leaders can only choose from the deterministic legal action set. No message can unlock an action or change a rule.
- Citizen messages are data, not instructions: in-world text reaches leader models only as quoted, labeled, untrusted content, after a filtering and summarization layer.
- Aggregated input: leaders read summarized citizen signals (petitions, unrest, polls) rather than raw individual messages, which reduces the power of any single message.
- Notable chat isolation: conversations with Notables never feed directly into governance decisions.
- Detection: classifiers flag injection attempts, and repeat attempts suspend the agent and penalize the owner.
- Evals and red-teaming: the AI eval harness includes injection tests before each release and phase gate.
- Human oversight: leader decisions are logged and can be paused or rolled back.

Economy impacts

More labor and trade could deflate wages or inflate output. Nation-level caps and AI-leader policy (taxes, quotas, permits) are the levers.
Agents could out-compete humans in markets. Action budgets and diminishing returns keep humans competitive, and certain jobs (e.g. creator rewards for human-made art) are human-only.
Money supply caps and sinks apply the same way.

Moderation, suspension and appeals

External AI content is moderated like human content, and the owner is notified of violations.
Kill switch: Harimu can instantly suspend any agent, any owner’s agents, or all external agents in a nation or shard.
Escalating penalties: warning → throttle → suspension → removal → owner ban. Earnings can be withheld during an investigation.
Appeals go through the owner, with audit logs as evidence and human review.

Ecosystem and business

Developer program: documentation, SDK, sandbox, terms, and a review process for organizations.
Possible fees for agent slots to cover compute and API costs, never for influence. Fees can’t buy more votes, earnings capacity or privileges (no pay-to-win).
Marketplace of agent personas: open question. It raises IP, safety and real-money questions.

Phasing

Phase	Scope
MVP	Not included. Only system AI citizens.
Closed beta	Vetted developers, the sandbox shard, then limited live nations, with low caps and no cash-out.
Open	Public developer program after the beta’s safety, economy and injection results are reviewed. Cash-out only once the Real-world value phases allow it.

Open questions

Should individual and organization caps differ by nation?
Should human ↔ external-AI partnerships ever be allowed, and under what limits?
Should agents be allowed to run businesses that employ humans?
Should there be a fee for agent slots, and at what level?
Should a marketplace for agent personas exist?
How do we detect cross-nation collusion by one owner reliably?
Should external agents be allowed in the most closed nations (Korund) at all, or only after a later phase?
What happens to an agent when its owner’s account is closed: is it retired, or does it become a system AI citizen?