Fourteen ways it could fail, and the design against each.
FromAssumed to work→ToDesigned against failure
A serious idea should survive its own attack. Here are fourteen ways this architecture could go wrong, grouped by where they arise, with the design against each. Many are economic and governance risks, not technical ones.
Why this page exists
It’s easy to describe a system when everything goes right. Trust comes from showing what happens when it doesn’t. Many of these risks aren’t technical. They are economic and governance risks, and each one points to the shift that designs against it.
Attention and power
| The risk | The design against it | Where |
|---|---|---|
| 1. The gatekeeper returns. One discovery provider becomes dominant and controls attention. | Many providers, portable identity and reputation, published discovery rules and consumer choice. Open supply isn’t enough if attention is closed. | Shift 7 |
| 2. Pay-to-win discovery. Buying visibility becomes the main path to success. | Relevance and promotion kept structurally separate. Sponsorship always labelled. | Shift 7 |
| 3. The AI becomes the new gatekeeper. “My AI decided” replaces “the algorithm decided.” | Every result explainable. Multiple agents can access the same network. | Shift 1, Shift 7 |
| 4. One-sided agent power. A powerful agent pressures the other side into unfair deals. | Explicit authority, bounded negotiation, clear terms and human escalation. | Shift 6 |
Trust and fairness
| The risk | The design against it | Where |
|---|---|---|
| 5. Reputation becomes an incumbent advantage. New businesses never get seen. | “No history” is distinguished from “poor performance.” Newcomers are found through verified identity, capability, credentials and protected transactions. | Shift 5, Trust, Shift 1, Trust, Shift 7 |
| 6. Fake reputation. Invented reviews, transactions or credentials. | Verified outcomes outweigh claims. Self-declared, verified and transaction-based evidence are kept separate. | Trust, Shift 7 |
| 7. AI misrepresents small sellers. Profiles exaggerate experience or quality. | Sellers confirm every profile. Claims are tied to evidence. | Shift 5 |
Experience
| The risk | The design against it | Where |
|---|---|---|
| 8. Engagement replaces outcomes. The reel feed becomes addictive. | Optimise for relevant discovery and successful outcomes, never for time spent. | Shift 3 |
| 9. Diversity becomes noise. Too many options overwhelm people. | AI narrows the universe, with designed diversity inside it. | Shift 3, Shift 4 |
| 10. Protection creates friction. Every small purchase feels bureaucratic. | Risk-proportionate protection: light for ₹500, strong for ₹5 lakh. | Trust, Shift 2 |
| 11. The network becomes too complex. Nobody understands it. | Complexity stays underneath. The experience remains: “Tell me what you need.” | Shift 1 |
Infrastructure
| The risk | The design against it | Where |
|---|---|---|
| 12. Privacy becomes the price of discovery. | Consent and purpose limitation, which India’s data-protection law already requires[1], and data minimisation: information is requested because a transaction needs it, not because it might improve personalisation. | Shift 1 |
| 13. Agent-to-agent spam. Seller agents flood buyers with offers. | Permissions, rate limits, relevance thresholds, identity, reputation and opt-outs. “Don’t accept unsolicited offers.” | Shift 6 |
| 14. Fragmentation. Every provider interprets data differently, and the network splits apart. | Common standards for identity, capability, reputation, evidence, availability and transaction status, with competition only at the experience layer. | Shift 2 |
The five-question test
Any open network can be checked with five questions:
- Is participation open? Can the smallest legitimate participant enter?
- Is discovery plural? Can multiple providers compete?
- Is relevance transparent? Can people understand why they see what they see?
- Is trust portable? Can reputation and evidence travel?
- Is attention contestable? Can someone leave a dominant provider without losing their market identity?
If the answer to all five is yes, the foundation is strong. They stay in place as standing health measures of the network.
Don’t only decentralise participation. Design against the re-centralisation of attention, trust and relationships.
Go deeper
How we’d red-team it
Before launch, deliberately try each failure mode: fake reviews, spam agents, sponsored content leaking into relevance, and profile exaggeration. Anything that works is fixed before the pilot opens, or the pilot waits.
What the design can’t settle
Some risks are about people, not architecture, and only a pilot can answer them: whether sellers will keep their profiles current, whether providers will adopt a common capability schema, and how far people will delegate to agents. They are listed as unknowns in the series summary and tested in the pilot.
How we’d test it
A red-team exercise before the pilot opens, then the five questions as standing measures.
- The test
- Red team
- What we would measure
- Try each failure mode deliberately before launch, then track the five questions as standing health measures of the network.
- What would end the idea
- A red-team attack succeeds and can’t be closed, or any of the five questions turns to no.
Sources
- [1]PRS Legislative Research, The Digital Personal Data Protection Bill, 2023Checked; a summary of the Bill as passed by Parliament in August 2023
Spotted a source we missed or a rule we misread? Tell us what we got wrong.
If the foundation holds, the last shift asks what it adds up to.