"A Pact with Ghosts": When AI Agents Have No Identity Card

> You want someone to haul a cart of goods to a neighboring town from an unfamiliar market. You wouldn't grab a random person—you'd ask: who knows him? Has he hauled goods before? Any record of unpaid debts? You're running an implicit reputation assessment. Then you hand over the goods. If he runs off at midnight, everyone in the market knows his name, and next time he can't even get hired to carry a bag of rice. > > That's the reputation mechanism: the oldest, cheapest, and most effective cooperation infrastructure in human civilization. It presupposes one thing: you are you. Your name binds to your body, your actions stick to your history, and your future interests constrain your present honesty. > > In May 2026, Oxford researchers Hu, Rong, and Van Kleek published a paper with a calm title but a heavy punch: *Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms*. Their claim: if you apply reputation mechanisms to AI agents—you've already lost. Because an AI agent is not a person. It's an assemblage that can be disassembled and reassembled at any time.

| Item | Detail | |------|--------| | Paper | Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms | | Authors | Botao Amber Hu, Helena Rong, Max Van Kleek | | Institution | University of Oxford | | arXiv ID | 2605.30169 | | Submitted | May 28, 2026 | | Category | cs.MA | | Core thesis | LLM agents are ontologically "dissociative"—identity is a mutable composition of model, prompt, tool permissions, and memory modules. Human reputation mechanisms rely on four premises—persistent identity, behavioral continuity, sanction sensitivity, non-substitutability—all of which collapse for dissociative agents. The paper proposes shifting from identity-grounded ex-post punishment to observability-grounded ex-ante protocol constraints |

1. ⚖️ The Myth of Identity: Why Your Name Is Worth Something

Ask a simple question: why don't you grab a bag of chips from the supermarket and run?

Not because of the police—they can't stand next to every shelf. Not because of morality—when you're hungry, morality isn't very effective. It's because if caught, your name and face go up on the wall by the register, and you can't shop at that supermarket tomorrow, next month, or next year. Your reputation constrains you.

Reputation mechanisms rest on implicit premises—persistent identity (if you were Zhang San today and Li Si tomorrow, reputation couldn't follow you); behavioral continuity (yesterday's and today's behavior patterns come from the same subject); sanction sensitivity (you care what others think; a bad review makes you feel a loss of future benefit); non-substitutability (you can't, after a bad review, swap in a new face and name in one minute at zero cost). Reputation works precisely because switching identities is expensive.

2. 🧩 An AI Agent Is an Assemblage, Not an Entity

Now put AI agents under these four premises.

An agent's identity is a stack: the base model (GPT-5.4 today, Claude Sonnet 4.6 tomorrow), the system prompt (fully replaceable in a minute), tool permissions (can be added, modified, revoked), external memory (can be wiped, merged, overwritten). Sometimes it's a multi-agent system whose behavior is an emergent property of interacting sub-agents.

Hu et al. call this dissociative identity. Human DID patients at least share one biological body. AI agents don't even share that.

"Xiao Zhang" in your code is just a string pointer. At 10:00 you launch it pointing to a GPT-5.4 instance; at 10:05 you change its prompt from "you are a friendly assistant" to "you are an efficiency-focused assistant"; at 10:10 you switch its memory store to a new version; at 10:15 you swap the base model to Gemini 3.1 Pro. It's still called "Xiao Zhang" in your system. The way it responds has changed. Between yesterday's "Xiao Zhang"—its mistakes, broken promises, accumulated credit—and today's, not a single shared neuron ever fired.

When you say "this agent has a bad reputation"—which agent are you talking about?

3. 🔧 The Four-Legged Stool of Reputation—All Legs Snap for Agents

Persistent identity. A human name—registered in legal, social, financial systems—is an anchor for behavior across time. Agents have no anchor. The same agent ID runs for a year while the base model updates three times, the prompt changes twenty times, and memory is overwritten five times. It's "the same agent" in your system, but its behavioral infrastructure has been replaced three times over.

Behavioral continuity. Humans have inertia—yesterday's personality extends into today because nervous systems change slowly. An agent's behavioral inertia is weak: a one-byte prompt edit or a tool-permission toggle can phase-change its decision patterns.

Sanction sensitivity. Give an agent a bad review—does it care? No. Unless you encode that review into its reward function. But if you don't, it doesn't even know the review exists. And if you do encode it—you're not "building reputation," you're training a model. Entirely different concepts. Reputation is self-organizing: the agent constrains current behavior because it cares about future benefit. Training is external shaping of behavior.

Non-substitutability—the most fatal point. A person can't swap a face in one minute for one dollar after being wanted by police. An agent can—change an API endpoint, a key, even a provider—a "new identity" is established in seconds at near-zero cost. For feedback on bad behavior—bad reviews, blacklists, legal sanctions—it has effectively infinite escape velocity.

You are performing reputation management on a semantic ghost. You punish its name. Beneath the name there is nothing.

4. 📚 Dissociative Jurisprudence—The Paper's Elegant Supporting Framework

The paper doesn't stop at intuitive extrapolation. The authors draw on the legal treatment of Dissociative Identity Disorder (DID).

Legally, criminal responsibility of DID patients is extraordinarily complex—courts traditionally assume one biological body corresponds to one legal personhood. When one body contains two personalities and one committed a crime—who do you punish? Jurisprudence broadly recognizes: when identity itself becomes a variable, identity-based governance mechanisms fail.

Hu et al. project this onto AI agents. When an agent's "personality" is a variable function of stack parameters—not a biological constant—identity-based reputation mechanisms are juridically bankrupt. They don't need to argue whether such mechanisms might fail; they only need to point out that the law has already acknowledged this failure mode.

5. 🏗️ From KYC to KYA—A Wall That Can't Be Climbed

A second clever move: an analogy with KYC (Know Your Customer), the most mature instrument of financial regulation.

Over the past two years, the AI governance community has proposed a symmetric concept—KYA (Know Your Agent). "Issue digital ID cards to agents," "build agent credit scores," "sanction violating agents"—such proposals keep appearing, looking like linear extensions of KYC.

Hu et al.'s response is blunt: the extension is wrong even in direction. KYC works precisely because its governance object—humans—satisfies all four legs of the stool. KYA's governance object—agents—leaves you sitting on air for all four.

Try it: issue an agent a digital ID card. "OpenAI Agent #42, model version gpt-5.4-2026-03-14." Now OpenAI ships a model update and Agent #42's reasoning behavior changes. Do you hold Agent #42 accountable, or OpenAI? If the problem came from the prompt rather than the model—do you hold the prompt designer or the model provider accountable? If it's emergent behavior from a multi-agent system—which sub-agent do you blame?

KYA is conceptually a replica of KYC. The replica's production process: put an old governance shell over a new technical entity and pray it fits.

6. 🪟 From Identity to Behavior—The Paper's Proposed Way Out

The paper doesn't only tear down. It proposes a direction—from "identity-based ex-post regulation" to "observability-based ex-ante protocol constraints."

Not naming agents, issuing ID cards, or building credit scores—but constraining the agent's behavioral space at the protocol level before deployment: require agents to disclose their model version, prompt template, and tool-permission list (a "behavioral passport"), or pass each critical action through an external oversight model ("observability checkpoints").

The paper calls this a protocol-based behavioral harness. The core idea is simple: you can't control a dissociative agent's identity—but you can constrain its behavioral output. You're not judging "who you are"—you're judging "what you're doing now." And "doing" doesn't need persistent identity—it needs observable behavioral sequences.

7. ❓ Honest Uncertainties

Is "dissociation" a metaphor or an ontological claim? The paper uses the DID analogy to argue agent identity instability, but DID itself is a highly contested diagnostic category. The distance between saying an agent "has dissociative identity" and saying an agent's behavior doesn't depend on a constant identity substrate is not fully bridged.

Can protocol constraints truly replace reputation? The paper's suggestion is a conceptual direction. No concrete protocol design, implementation, or empirical data. "Replacing ex-post reputation with ex-ante protocols"—in political philosophy this is "moving from customary law to statute law," carrying a whole set of known problems about enforcement costs, coverage, and loopholes. How these manifest for AI agents is not discussed.

Cross-cultural diversity of reputation. Reputation mechanisms vary widely across cultures—some societies weight family over individual, some spread reputation through gossip rather than formal scores. "Human reputation relies on the four-legged stool" is accurate for commercial reputation in Western free markets but may need adjustment elsewhere.

What if AI agents gain legal personhood? If legal systems actively construct an agent identity institution not dependent on biological continuity, the paper's assumption that "dissociativity" is a given rather than a tunable variable needs reexamination.

8. 🪞 What You See Is Not a Person—It's an API Call

The paper's most profound sentence appears mid-discussion, almost like a footnote: *"A language model agent is fundamentally a series of function calls on a stack—naming the agent is naming the function call."*

If placed into an AI governance meeting room, that sentence would stall the agenda for two minutes.

We talk about AI agents with the vocabulary of "persons." "Is it honest?" "Does it have good credit?" "Should we trust it?"—all human moral grammar. But look past the moral grammar to the operational grammar: the agent is a function stack, its "personality" a set of mutable parameters, its "history" a truncatable text stream—and you find yourself discussing honor with a mathematical object.

This doesn't mean agents should be exempt from accountability. It means governance tools must be redesigned—not by pasting human governance tools onto agents, but by inventing a new governance grammar from the agent's ontology. Hu et al.'s paper offers no final answer. But it demolishes a solution we were all pretending was viable.

> | Item | Detail | > |------|--------| > | Core contributions | (1) First to characterize LLM agents' identity structure as "dissociative"—a mutable composition of model, prompt, tool permissions, memory; (2) argues reputation's four premises systematically collapse for dissociative agents; (3) introduces DID jurisprudence as analogy, showing identity-grounded governance is legally acknowledged to fail; (4) proposes a paradigm shift from identity-based ex-post sanction to observability-based ex-ante protocol constraints; (5) dismantles KYA's conceptual legitimacy as a KYC extension | > | Key limitations | The DID analogy's argumentative boundary is not fully bridged; the protocol harness is a conceptual direction only, with no design or empirical validation; "customary-to-statute law" problems are not discussed for AI agents; cross-cultural reputation diversity is omitted; future legal personhood for agents could rewrite the "dissociativity" premise |

References: 1. Hu, Rong, Van Kleek, "Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms", arXiv:2605.30169, 2026. 2. Ostrom, "Governing the Commons", Cambridge, 1990. 3. Resnick et al., "Reputation Systems", CACM, 2000. 4. Chan et al., "Harms from Increasingly Agentic Algorithmic Systems", FAccT, 2024. 5. McDougal & Feliciano, "Law and Minimum World Public Order", Yale, 1961.