1 Introduction: The Enforcement Problem in the Digital Social Contract↩︎

The proposition that personal data constitutes a fundamental human right, advanced with systematic rigour by Alvarez-Pallete et al. [1], represents a significant philosophical advance over the prevailing regulatory paradigm, which treats data protection as a consumer right to be balanced against commercial interests. By grounding data governance in the Kantian categorical imperative, in Mounier’s personalism, and in the concept of contextual integrity, the digital social contract framework elevates the discussion from regulatory technique to political philosophy: the question is no longer how to constrain data extraction within acceptable limits but whether data extraction as such is compatible with the irreducible dignity of the human person.

Yet the framework, precisely because of its philosophical ambition, generates a tension that its authors do not resolve. The normative content of the contract demands that persons never be treated merely as means to algorithmic ends, that consent be meaningful rather than nominal, that economic value flow back to data subjects, and that governance be participatory rather than delegated. The institutional implementation the contract proposes, however, relies on State regulatory authorities to enforce fiduciary duties, on licensed intermediaries operating within existing legal systems, on multi-stakeholder governance bodies embedded in representative democratic structures, and on courts to provide remedies. The question that this paper takes as its point of departure is whether these institutional forms are adequate to the normative demands they are meant to serve, or whether the very structures the contract relies upon for enforcement are implicated in the violations it seeks to prevent.

The question is not rhetorical. The State that is called upon to enforce data fiduciary duties is the same State whose intelligence agencies conduct mass surveillance, whose patent law enforces the monopolies that concentrate AI infrastructure, whose procurement policies channel public funds toward corporate data centres, and whose export controls weaponize the chip supply chain. The licensed intermediaries that are to serve as data trustees operate within a legal system whose corporate governance norms structurally favour capital over labour and whose fiduciary law has historically served the interests of wealth preservation. The multi-stakeholder governance bodies that are to ensure democratic participation reproduce the same pathologies of captured consultation and manufactured consent that characterize regulatory proceedings in telecommunications, finance, and environmental policy. To note these structural entanglements is not to impugn the motives of the contract’s authors but to observe that the institutional mechanisms they propose operate within, and are shaped by, the very power asymmetries they are designed to correct.

This paper develops an alternative institutional architecture for the digital social contract, one that preserves and indeed strengthens its normative commitments while shifting the locus of enforcement from statist regulation imposed from above to commons-governed, self-organizing institutions whose authority is held horizontally by their participants. The alternative is not a thought experiment but a systematic construction built on actually existing organizational models: cooperative data trusts, commons-governed infrastructure, municipal assemblies, mutual-aid networks, and federated protocols, all of which have demonstrated their operational viability at non-trivial scale. The relation to the State is not antagonistic but subsidiary: the commons governs at the level closest to those affected, and the State, like any other actor, may use the infrastructure and contribute to it without thereby acquiring control over it. The central claim is that the normative content of the digital social contract, specifically the irreducibility of dignity, the requirement of meaningful consent, the prohibition on instrumentalization, and the demand for economic justice, is not merely compatible with commons-based institutional forms but is more faithfully realized by them than by the purely regulatory alternatives the original contract presupposes.

The infrastructure over which this contest is waged has by now acquired a definite shape, and one conceded even by those who profit from it. [2], writing as the chief executive of the industry’s dominant accelerator vendor, describes the contemporary artificial intelligence system as a five-layer stack, rising from energy through chips, infrastructure, and models to the applications in which economic value is realized. We invoke this partition not as an independent analysis of the political economy of computing but as the incumbent’s own self-description of the structure it dominates. Each of these layers is today overwhelmingly the property of a small number of firms: energy and data centres concentrated in the hands of hyperscalers, chips and their software ecosystem controlled by a single dominant vendor, foundation models trained and gated by a handful of laboratories, and applications mediated by the platforms that own the layers beneath them. The digital social contract is, read in this light, a claim about how the five-layer stack ought to be governed, asking that the persons whose data animates the models and applications be treated as ends rather than as raw material and that the value generated at the upper layers flow back to those who make it possible. What the contract does not supply is an account of ownership and control over the stack itself, presupposing instead that a State external to the stack will regulate its private owners. The architecture we develop supplies the missing account. It is a governance overlay deployed over the same five-layer technical substrate, placing each layer under commons-based, horizontal, polycentric control, so that the normative demands of the digital social contract are met not by regulating the owners of the stack from without but by changing the terms on which the stack is governed from within. The overlay does not require expropriating the incumbents who hold the layers today. It specifies instead a structure into which capital, compute, and data may flow from any source, including the hyperscalers, the dominant accelerator vendor, the laboratories, and the States that subsidize them, while the right to set the system’s purposes, norms, and limits remains with its participants on equal terms. The stack so governed is in this sense a shared civic battery rather than a private asset: it can be charged by whoever has the means, while who steers it is held apart from who charges it, to the degree that no single source becomes indispensable. The decoupling of contribution from control, developed formally in Section 10, is the device that makes this combination of open capitalization and horizontal governance coherent rather than contradictory, and we are careful there to mark the conditions under which it holds and those under which it fails. The six layers of the Dignity Stack are therefore not a re-partition of the five technical layers. They track the six normative dimensions of the digital social contract rather than the engineering decomposition of the machine, so that a single governance concern such as economic justice ranges across several technical layers, while a single technical layer such as infrastructure is implicated in several governance concerns.

The argument is structured as follows. Section 2 establishes the philosophical foundations, examining the convergence and divergence between data personalism and the theory of commons-based, polycentric governance on the questions of dignity, autonomy, and subsidiarity, with transparent acknowledgment of which commitments of the cited traditions we draw upon and which we set aside. Section 3 introduces the six-layer Dignity Stack architecture, providing formal definitions for each layer. Sections 4 through 9 develop each layer in detail, specifying the voluntary organizational protocol that implements the corresponding dimension of the digital social contract. Section 10 presents the integrated architecture and analyzes the inter-layer dependencies that ensure systemic coherence. Section 11 addresses eight principal objections, including capture of the commons by its largest funders, data irreversibility in trained models, the tyranny of structurelessness, the tragedy of the anticommons, and the concentration of capital and compute in the lower layers of the AI stack. Section 12 concludes. Figure 1 provides a visual overview.

2 Philosophical Foundations: Data Personalism and the Theory of the Commons↩︎

This section examines the three philosophical pillars on which the digital social contract rests and argues that each generates institutional implications that point beyond the purely statist framework the contract presupposes, toward commons-based, polycentric, and subsidiary alternatives. The argument is not that these implications are uniquely derivable from the cited philosophical traditions, since each tradition admits multiple legitimate readings, but that the commons-based reading we develop is at least as faithful to their core commitments as the purely regulatory reading the contract assumes, and in several respects more so.

A preliminary clarification is essential. We do not claim that Kant, Mounier, or Nissenbaum were anarchists, or that their philosophical frameworks entail anarchism as a matter of strict logical necessity. Kant, in the Metaphysics of Morals [3], explicitly defends the State’s right to coerce as a condition for the external realization of freedom, arguing that “hindering a hindrance to freedom is consistent with freedom according to universal laws” (6:231). Mounier, while deeply critical of the centralized bureaucratic State, explicitly rejected anarchism, holding that the common good requires institutional constraints on individual action [4]. Nissenbaum developed contextual integrity as a framework for regulatory policy, not as an argument against regulation [5]. We acknowledge these positions and do not misrepresent them. What we argue is that the digital social contract selectively mobilizes these traditions, invoking their critiques of instrumentalization, commodification, and contextual boundary violation, while relying on institutional mechanisms that are themselves subject to the same critiques. Our reading is equally selective, but in a direction that resolves this tension rather than reproducing it: we adopt the horizontal, federative, and mutualist organizational forms developed most fully within the cooperative and anarchist traditions, while declining their rejection of the State as such. The commons we describe is not an anti-State project but a State-agnostic one. It neither requires the abolition of public authority nor depends upon it for its internal governance; it can be used and funded by States and firms while remaining governed horizontally by its participants. In this our proposal stands closer to Mounier’s own pluralism, which sought subsidiary institutions mediating between the person and the State, than to the anarchism from which we borrow organizational technique. The label we retain is therefore commons-based and subsidiary rather than anarchist: the architecture is anarchist in its means, the horizontal and voluntary forms of self-organization, but not in its ends, the abolition of the State. This State-agnostic posture occupies a definite position rather than an unstable midpoint. Where a State or firm merely participates in and funds the commons, the commons governs only its own internal affairs and binds only its voluntary participants, which requires no authority over anyone. Where the commons constrains the data practices of a powerful participant, it does so on the strength of that participant’s voluntary accession together with the minimal legal recognition of the right of associations to govern their own affairs, which is Ostrom’s seventh design principle, and not on any claim to coerce the unwilling. We do not claim the commons can govern a State that refuses such recognition; against a State determined to override it the commons is, like every private owner of the same infrastructure, without recourse. The proposal is in this sense a recognized, subsidiary commons rather than either a delegated public regulator or an autonomous counter-power, and we locate it there deliberately rather than leaving it to hover between the two.

The first pillar is the Kantian prohibition on treating persons merely as means. Alvarez-Pallete et al.invoke Kant’s second formulation of the categorical imperative to ground their distinction between DatAism, the paradigm that reduces persons to data points for algorithmic optimization, and HumAism, the counter-paradigm that places human dignity at the centre of data governance [1]. The invocation is philosophically sound: surveillance capitalism, as analyzed by Zuboff [6], systematically treats persons as raw material for prediction markets, violating the categorical imperative at the level of institutional design rather than individual action. The critical word in Kant’s formula is “merely”: persons must be treated “never merely as a means, but always at the same time as an end.” Kant himself held that the State can coerce while treating persons as ends, because coercion in the service of rightful freedom respects rational agency by maintaining the conditions under which all persons can exercise their freedom [3]. A long line of critics, from William Godwin’s Enquiry Concerning Political Justice [7] through Kropotkin’s mutual aid [8], contests this Kantian reconciliation on empirical grounds: whatever the theoretical possibility of a State that coerces only in the service of freedom, actually existing States routinely coerce in the service of corporate interests, class preservation, and self-perpetuation. The question for data governance is not whether an ideal State could enforce dignity, but whether the States that actually exist do so, or whether their structural entanglement with the power asymmetries that generate data extraction makes them unreliable guarantors of the values they proclaim. We do not draw from this the anarchist conclusion that the State must be abolished. We draw the weaker and better-supported claim that an architecture which makes dignity depend on the goodwill of any single authority, whether a public regulator or a private owner of the infrastructure, is more fragile than one in which governance is distributed, consent-based, and structurally hard to capture. The commons is the constructive response to the empirical gap between Kant’s theory of the rightful State and the reality of both State and corporate complicity in data extraction. We grant at once that distributing governance does not by itself defeat the resource asymmetry that drives capture, and that the commons is, as Section 10 concedes, vulnerable to the same asymmetry rather than immune to it. The inference is not that distribution abolishes capture but the narrower one that polycentric, consent-based governance localizes the consequences of any single capture and renders capture detectable and contestable, where a unitary authority both concentrates the stakes of capture and, being the arbiter of its own conduct, obscures it. This lowers the cost of the empirical fact that authorities are captured without pretending to eliminate the fact.

The second pillar is Mounier’s personalism, which the digital social contract mobilizes to argue that data is not a detachable commodity but an expression of irreducible personal identity [4]. Mounier’s contribution is to insist that the person is constituted not in isolation but in relation: the person exists as a being-in-community, and dignity is realized through free engagement with others, not through atomized autonomy. This relational conception of the person is the foundation of data personalism, the thesis that data governance must respect both individual autonomy and the relational context in which data is generated and interpreted. Mounier distinguished the person from the individual, where the individual is the liberal-bourgeois abstraction of the isolated rights-bearer and the person is the concrete being embedded in community, and he argued that both the capitalist market and the centralized bureaucratic State reduce persons to individuals by dissolving the organic communities through which personhood is realized [4]. Mounier did not, however, conclude from this critique that the State should be abolished; he sought a reformed, decentralized, pluralist political order in which subsidiary institutions mediate between the person and the State, and in which the State retains a positive role, protecting and fostering those intermediary bodies rather than dissolving or supplanting them. We do not follow the anarchist communitarians who take the critique further, holding that voluntary communities should replace the State outright. On the governance form our reading is genuinely closer to Mounier’s pluralism than to that anarchism: the commons is the subsidiary institution, governing the stewardship of personal data at the level closest to those whose data it is, neither absorbed into the State nor pitted against it, and compatible with a State that recognizes and protects it in the manner Mounier envisaged. We are careful, however, not to claim Mounier’s endorsement beyond what the texts support, and two qualifications are required. First, Mounier’s subsidiarity assigns the State a protective function over intermediary bodies; our architecture accommodates this through the recognition of the right to organize rather than through opposition to the State, but it does not depend on such protection, and to that extent it asks of subsidiarity slightly less vertical structure than Mounier did. Second, and more substantially, Mounier accepted the market as a legitimate means of meeting material needs, criticizing its dominance rather than its existence, whereas the economic layer we develop in Section 9 adopts a Proudhonian mutualism that withdraws the residual claim of capital. This is our extension, not Mounier’s position, and we mark it as such: the Dignity Stack draws on Mounier’s subsidiary mediation of personhood while going beyond his economics, and our claim of fidelity is to the former and not the latter.

The third pillar is contextual integrity, the principle, developed by Nissenbaum [5] and mobilized in the digital social contract via Cohen and Solove, that the appropriateness of data flows depends on the social context in which data is generated and the norms governing that context. Health data collected for treatment is governed by different norms than commercial data collected for advertising; violations of contextual integrity occur when data flows cross contextual boundaries without respecting the norms of either context. The digital social contract proposes to enforce contextual integrity through regulatory mechanisms: purpose limitation requirements, mandatory impact assessments, and legal remedies for boundary violations. The difficulty is that the State, as a unitary sovereign, is itself a persistent violator of contextual integrity: intelligence agencies routinely access data collected in commercial contexts for surveillance purposes, tax authorities access financial data for enforcement purposes unrelated to the context of its collection, and law enforcement agencies increasingly demand access to health, communications, and location data that persons disclosed in contexts governed by norms of confidentiality. An enforcement mechanism that is also a principal source of the violations it is meant to prevent faces a structural credibility problem. Nissenbaum herself does not draw this conclusion; her framework is designed for regulatory application. We extend her framework by observing that a governance architecture in which no single authority has jurisdiction across all contexts embodies contextual integrity architecturally, making boundary violations structurally difficult rather than merely illegal. This is not a derivation from Nissenbaum but a constructive proposal that takes her normative framework and asks what institutional form would most fully realize it.

These three theses establish the normative foundations from which the Dignity Stack is constructed. They are not axioms in the sense of self-evident truths, nor are they strict derivations from Kant, Mounier, or Nissenbaum. They are substantive philosophical positions, grounded in but extending those traditions, that we defend on the following basis: (i) the non-instrumentalization thesis captures the empirical reality that actually existing States are unreliable guarantors of the dignity they theoretically protect; (ii) the relational personhood thesis extends Mounier’s critique of the centralized State to its logical institutional conclusion; and (iii) the structural contextual integrity thesis takes Nissenbaum’s normative framework and asks what architecture would realize it most fully. Together, they motivate a governance architecture that is voluntary in its constitution, relational in its organizational form, and pluralist in its jurisdictional structure.

The argument is straightforward. A voluntary architecture eliminates the institutional relationships in which persons are subject to authority without ongoing consent, satisfying the non-instrumentalization thesis by construction. It preserves voluntary relational contexts rather than displacing them with bureaucratic intermediation, satisfying the relational personhood thesis. And its polycentric jurisdictional structure makes contextual boundary violations structurally difficult, satisfying the structural contextual integrity thesis. The critical proviso is operational viability: a voluntary architecture that is theoretically preferable but practically impossible would not constitute a more faithful realization. The remainder of this paper is devoted to demonstrating that the Dignity Stack is operationally viable, drawing on actually existing institutional models at each layer. The question is therefore not whether commons-based governance is normatively preferable in the abstract, but whether it can be constructed concretely for the domain of AI data governance.

One limitation of this argument must be conceded at the outset, since it qualifies the force of every claim of more faithful realization that follows. The three theses operationalize the values of the digital social contract, non-instrumentalization, relational personhood, and contextual integrity, in terms that a voluntary, polycentric architecture satisfies comparatively well: the minimization of non-consensual institutional relationships, the preservation of voluntary relational contexts, and the dispersal of jurisdiction. A defender of statist regulation may reasonably contest these operationalizations, holding for instance that the Kantian prohibition on instrumentalization is honored not by minimizing coercive relationships but by subjecting them to public, rule-of-law constraint, which is in fact closer to Kant’s own position at 6:231. We do not claim to have refuted that reading. We claim that our operationalizations are defensible articulations of the same values, at least as faithful to the cited traditions as the statist reading, and that on these articulations the commons architecture scores higher. The comparative is in this sense conditional on the operationalization, and we advance it as a defended position rather than a demonstration. To a reader who rejects the operationalization, the contribution of the paper is the weaker but still substantive one of exhibiting a concrete, commons-based architecture that satisfies the dignity-centred values under a natural reading of them.

3 The Dignity Stack: Architecture and Formal Specification↩︎

The Dignity Stack is a six-layer governance architecture that maps the six dimensions of the digital social contract onto six layers of commons-governed AI infrastructure, assigning to each layer a commons-based organizational protocol that satisfies the normative requirements of the corresponding dimension. The community AI infrastructure so governed is the commons-owned counterpart of the centrally held five-layer technical stack described by [2]; the Dignity Stack is a governance overlay over that substrate rather than a technical stack in its own right, and it determines not how the machine is built but who owns and controls it. Before developing each layer, we establish the formal structure.

A word on the status of this formalism is owed, since it would be a mistake to read the definitions and propositions that follow as theorems in a deductive calculus. The tuple notation regiments three things: the requirements each layer must meet, the protocol proposed to meet them, and the dependency structure that orders the layers. It does not mechanize the verification predicates. Each component \(v_{ij}\) encodes a substantive judgement, that a given commons mechanism meets a given normative requirement, and that judgement is discharged not by computation but by the layer-by-layer arguments of Sections 4 through 9. Those arguments, labelled propositions for reference, are arguments in the ordinary philosophical sense that a protocol satisfies a requirement, and they carry exactly the weight such arguments carry, no more. A Dignity Stack that is normatively compliant in the sense of Definition 5 is what we mean, throughout, by a stack that implements the digital social contract; the phrase has no content beyond the conjunction of the layer verifications and the satisfaction of the dependency relation. The formalism earns its keep by making the requirements, the dependencies, and the points of possible failure explicit and checkable; it does not, and is not meant to, convert contestable normative judgements into derivations. Table 1 summarizes the mapping between the six dimensions of the digital social contract and the six layers of the Dignity Stack, together with the commons-based organizational protocol assigned to each layer.

4pt

The ordering of the layers is not arbitrary. It follows the same bottom-up logic as the Liberation Stack framework: the lower layers provide the material and institutional preconditions for the higher layers, so that D1 (dignity infrastructure) is foundational and D6 (economic justice) presupposes the functioning of all layers beneath it. The inter-layer dependencies specified by \(\Phi\) formalize this ordering.

Figure 2 presents a comprehensive conceptual taxonomy of the Dignity Stack, tracing the flow from philosophical traditions through normative theses and institutional layers to the concrete enforcement mechanisms and their acknowledged limitations. The taxonomy makes explicit three features of the architecture that the layer-by-layer exposition in Sections 4–9 develops in detail: (i) the philosophical traditions are mobilized selectively, with transparent acknowledgment of where we extend them beyond their authors’ own conclusions; (ii) each layer is governed by a specific enforcement mechanism that operates without coercion; and (iii) each mechanism carries a recognized limitation that constrains its effectiveness under specific conditions. The taxonomy thus serves as a map of both the architecture’s strengths and its honest boundaries.

4 D1. Dignity Infrastructure: Convivial Thresholds and Democratic Oversight↩︎

The first dimension of the digital social contract is technological oversight: the requirement that AI systems be designed and deployed in accordance with dignity-by-design principles, including respect for autonomy, transparency, non-manipulation, proportionality, and human oversight [1]. The dignity-by-design checklist proposed by the contract specifies six criteria: genuinely free choice, comprehensible disclosure, data minimization, absence of dark patterns, non-discrimination, and respect for irreducible personhood. The enforcement mechanism proposed is regulatory: designers must document their compliance, and external auditors verify it.

The commons-based alternative begins with a structural observation: a system whose energy and computational scale exceeds the governance capacity of the community it serves cannot satisfy dignity-by-design requirements regardless of how many checklists it passes, because the institutional precondition of meaningful oversight, namely that the community can understand, modify, and if necessary dismantle the system, is absent. This is Illich’s convivial threshold applied to AI governance [9], [10]: beyond a certain scale, the tool dominates the user rather than serving the user, and no amount of procedural compliance can substitute for the structural condition of community control.

The three relations are qualitative thresholds rather than numerical optima, and each is read on a commensurable scale. The energy relation 1 compares power in common units. The knowledge relation 2 is to be read as set inclusion, the competencies required to understand, audit, and modify \(A\) being contained in the competencies the community collectively possesses, rather than as a comparison of scalar quantities. The time relation 3 compares durations. A system satisfies the threshold when all three hold and fails it when any one is violated; the predicate is therefore decidable in principle given an inventory of the community’s energy, competencies, and deliberative cadence, even where exact measurement is impractical. Condition 1 ensures material sovereignty: the community is not dependent on external energy sources whose providers could exercise leverage over the AI system’s operation. Condition 2 ensures epistemic sovereignty: the community can audit the system without relying on external experts whose interests may diverge from its own. Condition 3 ensures political sovereignty: the community can shut down the system faster than it can deliberate about whether to do so, ensuring that the system never outpaces the community’s governance capacity. Together, these three conditions constitute the structural precondition for meaningful technological oversight: a community that can power, understand, and dismantle its AI system has genuine control over it, whereas a community that depends on external energy, external expertise, or external infrastructure for any of these functions has nominal oversight but not real sovereignty.

The organizational protocol for D1 is drawn from the combination of Illich and Bookchin that governs L1 of the Liberation Stack. The community AI system is powered by community-owned renewable energy, governed by a municipal or cooperative assembly, and sized to satisfy the convivial threshold. The dignity-by-design checklist of the digital social contract is not rejected but reconceived: instead of a compliance exercise audited by external regulators, it becomes a set of design constraints enforced by the assembly itself, which has the knowledge and the power to verify compliance directly because the system operates within its epistemic and material sovereignty.

5 D2. Sovereignty: Cooperative Data Trusts as Ostromian Commons↩︎

The second dimension of the digital social contract is data sovereignty: the right of individuals to determine how their data is used, combined with collective sovereignty over data ecosystems, the capacity to withdraw consent, and meaningful choice that transcends the fiction of informed consent through adhesion contracts [1]. The contract proposes data trusts, cooperative governance structures, and interoperability standards as mechanisms for realizing sovereignty. The institutional form it envisions, however, is a licensed intermediary operating within existing legal systems: a data trust chartered under Anglo-American trust law, governed by boards that include data subjects alongside experts and civil society representatives, and regulated by data protection authorities with enforcement powers.

The commons-based alternative retains the data trust as an organizational form but reconceives its institutional character. Instead of a licensed intermediary embedded in State legal systems, the cooperative data trust is a voluntary association constituted by its members, governed as an Ostromian commons, and accountable to its members through exit rights rather than regulatory oversight. The shift is not merely terminological: it transforms the data trust from an institution that governs on behalf of data subjects to one that is governed by them.

The exit function \(E\) is the fundamental institutional innovation that distinguishes the cooperative data trust from its statist counterpart. In a State-chartered data trust, the trustee’s fiduciary duties are enforced by courts; a member who believes the trust has violated its duties must seek legal remedy, a process that is slow, expensive, and structurally favours the trust’s legal resources over the individual’s. In the cooperative data trust, enforcement is achieved through exit: a member who judges the trust to have violated its commitments simply leaves, and the trust loses both the member’s data and the member’s participation. The exit function is not merely a right of withdrawal but a structural mechanism that disciplines the trust’s governance: a trust that systematically violates its commitments will haemorrhage members, losing both its data assets and its collective bargaining power, and will ultimately dissolve. This is the commons-based counterpart to what Hirschman [11] terms the “exit” mechanism: the capacity to leave an institution without permission disciplines the institution more effectively than the capacity to voice dissent within it, precisely because exit imposes immediate material consequences that voice does not.

The governance rules \(R\) are determined by Ostrom’s eight design principles for viable commons [12], adapted to the data trust context. Clearly defined boundaries specify who is a member and what data falls within the trust’s stewardship. Congruence between rules and local conditions ensures that governance rules are adapted to the specific community’s data practices and values. Collective-choice arrangements guarantee that members participate in modifying governance rules. Monitoring ensures that data stewardship protocols are transparently observed. Graduated sanctions provide responses to violations of governance rules that are proportional and escalating. Conflict resolution mechanisms enable disputes to be resolved within the trust without recourse to external authorities. Minimal recognition by external authorities means the trust does not depend on State licensing for its legitimacy. Nested enterprises permit the trust to federate with other trusts for collective bargaining while retaining internal governance autonomy.

Tucker’s critique of monopoly [13] reinforces the sovereignty layer by identifying the structural conditions under which data sovereignty is illusory. Tucker argued that four State-enforced monopolies, patents, land, money, and tariffs, prevent genuine voluntary exchange by creating artificial scarcities that distort bargaining power. Applied to data governance, the relevant monopolies are intellectual property (which locks users into proprietary platforms), infrastructure monopoly (which concentrates data storage in corporate clouds), and monetary monopoly (which denominates data value in State currencies whose supply is controlled by central banks). The sovereignty layer therefore requires that the data trust operate on open protocols, store data on community-governed infrastructure (D1), and transact in mutual credit or cooperative currency (D6). Without these structural conditions, data sovereignty remains nominal: a member who can withdraw their data but has nowhere to take it except another corporate platform has not meaningfully exited.

6 D3. Contextual Integrity: Federated Mutual-Aid Protocols↩︎

The third dimension of the digital social contract addresses social cohesion: the maintenance of digital commons and cultural sustainability, grounded in the principle that data governance must respect the contextual norms governing different social domains [1]. The concept of contextual integrity, as developed by Nissenbaum [5], provides the philosophical foundation: data flows are appropriate when they conform to the informational norms of the context in which they occur, and violations arise when data crosses contextual boundaries without respecting the norms of either the originating or the receiving context.

The digital social contract proposes to enforce contextual integrity through purpose limitation requirements, mandatory impact assessments, and legal remedies for boundary violations. The structural difficulty, as noted in Section 2, is that the sovereign State is itself a persistent violator of contextual integrity, routinely accessing data across contextual boundaries in the name of national security, public order, and fiscal administration. A more fundamental difficulty is that contextual integrity, as a normative principle, requires governance structures that are themselves contextually embedded: a unitary regulator applying uniform rules across all contexts cannot respect contextual variation, because the specificity of context is precisely what a unitary jurisdiction abstracts away.

The commons-based alternative realizes contextual integrity through structural pluralism. Instead of a single regulatory authority applying context-sensitive rules from above, each data trust governs a specific social context and defines the informational norms appropriate to that context. Health data is governed by a health data trust whose members include patients and care providers; educational data is governed by an educational data trust; commercial data by a commercial trust; creative data by a cultural trust. Cross-contextual data sharing is not prohibited but must be negotiated between trusts through federated protocols that require bilateral consent: the originating trust must authorize the release under its own contextual norms, and the receiving trust must agree to handle the data under norms compatible with its own context.

This federated structure realizes contextual integrity not as a regulatory constraint but as an architectural property: the governance system is composed of context-specific trusts, and cross-contextual data flows require bilateral negotiation, making boundary violations structurally difficult rather than merely illegal. The mutual-aid dimension, drawn from Kropotkin [8], enters through the motivation for cross-contextual sharing: trusts share data not for commercial extraction but for mutual benefit, as when a health trust shares anonymized epidemiological data with a public-health trust to enable community health planning, or when an educational trust shares learning analytics with a pedagogical research trust to improve teaching methods. The norm is reciprocity: each trust contributes to and benefits from the federation, and free-riding is constrained by the graduated sanctions specified in each trust’s Ostromian governance rules.

Social cohesion is realized through the network of mutual-aid relationships that federated data sharing creates. Unlike a regulatory framework in which social cohesion is an aspirational goal to be pursued through policy, the federated trust architecture generates cohesion as a byproduct of its operation: trusts that cooperate effectively develop relationships of mutual trust and reciprocity that strengthen the social fabric, while trusts that defect are excluded from the federation, suffering the loss of the benefits that cooperation provides. This is the Kropotkinian insight applied to data governance: cooperation is not an altruistic sacrifice imposed from above but a rational strategy that emerges from the structure of mutual dependence.

7 D4. Fiduciary: Voluntary Commitment and Reputational Accountability↩︎

The fourth dimension of the digital social contract addresses automation limits: the requirement for meaningful human control over algorithmic decision-making, including the right to explanation, the right to contest, and the right to human review of automated decisions [1]. The contract operationalizes these requirements through fiduciary duties: data controllers are to assume duties of care, loyalty, and disclosure toward data subjects, with enforcement through the legal system. The fiduciary standard, as the contract argues, imposes higher obligations than consumer protection law because fiduciary duties cannot be disclaimed through terms of service and are imposed by law rather than negotiated between parties.

The commons-based critique of this arrangement is twofold. First, fiduciary law in its existing form is a product of the same legal system that created the corporate governance norms under which data extraction flourishes. The fiduciary duties of corporate directors run to shareholders, not to data subjects; the extension of fiduciary obligations to data controllers represents a reform within a legal framework whose structural logic favours capital. Second, and more fundamentally, the enforcement of fiduciary duties through the legal system reproduces the coercive dynamic that the non-instrumentalization thesis (Definition 1) identifies as problematic: a data controller who violates fiduciary duties faces fines, injunctions, and ultimately the coercive apparatus of the State, creating an institutional relationship in which compliance is sustained by punishment rather than by the mutual benefit that voluntary commitment generates.

The commons-based alternative does not abolish statutory fiduciary duty but adds to it a voluntary fiduciary commitment enforced by reputational accountability and exit rights, a commitment that binds whether or not the law also binds and that remains effective in the many settings where statutory enforcement is slow, captured, or absent. The conceptual basis is drawn from Errico Malatesta’s pragmatic anarcho-communism [14], which insists that social cooperation requires trust but that trust must be earned through demonstrated conduct rather than imposed by legal compulsion. Malatesta’s key insight is that voluntary agreements, freely entered into and freely terminable, generate more reliable cooperation than coerced compliance, because voluntary agreements are sustained by mutual benefit whereas coerced compliance is sustained by the threat of punishment and dissolves the moment the threat is removed.

The enforcement mechanism operates through three channels. The first is exit: if a service provider violates its fiduciary commitment, the data trust terminates the relationship, and the provider loses access to the trust’s data and the revenue or benefit that access provided. The second is reputation: violations are reported to the federation, and other trusts can condition their own engagement with the provider on its track record. In a federated ecosystem of many trusts, a provider that has violated commitments to one trust will find it difficult to establish relationships with others. The third is substitutability: the open-protocol infrastructure of the Dignity Stack (D1, D2) ensures that providers are substitutable, so that no trust is locked into a relationship with a provider whose fiduciary conduct is inadequate.

The Malatestian insight at work here is that voluntary commitment, reinforced by reputation and exit, generates more reliable compliance than legal compulsion. A data controller whose fiduciary conduct is motivated by the desire to avoid fines will calibrate its compliance to the expected cost of enforcement, investing in compliance only to the point where the marginal cost equals the expected fine discounted by the probability of detection. A service provider whose fiduciary conduct is motivated by the desire to maintain reputation in a federation of trusts faces a different calculus: the cost of violation is not a probabilistic fine but the certain loss of relationships, a consequence that is both more immediate and more proportional to the severity of the violation.

8 D5. Participatory Governance: Nested Assemblies Without a Centre↩︎

The fifth dimension of the digital social contract is political legitimacy: the requirement that data governance rules be determined through democratic processes that include data subjects, with particular attention to the representation of marginalized communities [1]. The contract proposes multi-stakeholder governance bodies including data subjects, civil society, technical experts, and marginalized community representatives, with platform executives excluded for conflicts of interest. The difficulty with this proposal is not its ambition but its institutional form: multi-stakeholder governance bodies, as actually constituted in telecommunications, finance, and environmental regulation, routinely reproduce the power asymmetries they are designed to correct. The selection of “representatives,” the framing of agendas, the production of “consensus” documents, and the translation of recommendations into binding rules are all processes vulnerable to capture by organized interests with greater resources, expertise, and persistence than the diffuse public they claim to represent.

The commons-based alternative draws on Bookchin’s libertarian municipalism [15], [16] and Bakunin’s federalist collectivism [17] to construct a participatory governance architecture that is both radically democratic and scalable. The basic unit is the assembly: the face-to-face deliberative body of a data trust’s members, meeting regularly to decide governance questions by consensus or qualified majority. Assemblies are small enough for genuine deliberation, following Bookchin’s principle that democracy requires the physical co-presence of deliberating citizens and that assemblies exceeding a few hundred members tend toward representative delegation, which is to say, toward the dissolution of direct democracy into its negation.

For governance questions that transcend the individual trust, whether questions of federation policy, cross-contextual data sharing norms, or responses to external threats, assemblies send mandated delegates to a council of the federation. The delegates are mandated, not representative: they carry the specific decisions of their assemblies and have no authority to negotiate or compromise beyond their mandates. If the council confronts a question on which the delegates’ mandates are insufficient, the question is referred back to the assemblies. This is Bakunin’s federalism [17]: authority flows from the base to the federation, never from the federation to the base, and delegates are recallable at any time by the assemblies that sent them.

The political legitimacy of this structure derives not from the State’s endorsement but from the direct participation of every person in the governance decisions that affect them. Where the digital social contract’s multi-stakeholder bodies achieve legitimacy through the inclusion of “representatives” who stand for constituencies they cannot meaningfully consult, the nested assembly achieves legitimacy through direct participation at the local level and mandated delegation at the federation level. The difference is not one of degree but of kind: representation is a mechanism for managing the impossibility of direct participation at scale, while mandated delegation preserves direct participation by refusing to aggregate decisions beyond the scale at which face-to-face deliberation is possible.

9 D6. Economic Justice: Mutualist Exchange and Cooperative Surplus↩︎

The sixth dimension of the digital social contract is economic justice: the requirement that data subjects receive fair compensation for the value their data generates, realized through data dividends, cooperative ownership, reciprocal access rights, and alternative economic models that counteract the extractive logic of platform capitalism [1]. The contract proposes several mechanisms: a data dividend funded by a tax on data-derived profits, cooperative data models in which members collectively own data infrastructure, data trusts with revenue sharing, public data commons, and reciprocal data access.

Proudhon’s mutualism [18], [19] provides the commons-based organizational protocol for this layer. Proudhon’s economic thought centres on two principles: the labour theory of exchange value, according to which the just price of a good or service is determined by the labour required to produce it, and the mutual credit system, which replaces State-issued currency and bank-intermediated credit with a reciprocal credit system in which participants extend credit to one another without interest, eliminating the rent extracted by financial intermediaries. Applied to data economics, mutualism implies that the value of data should flow to the persons whose labour (in the extended sense of lived experience, creative production, and social interaction) generated it, and that the medium of exchange through which data value circulates should be a mutual credit system rather than a State currency whose supply is controlled by central banks and whose distribution is intermediated by profit-seeking financial institutions.

The mutual credit system \(\mu\) is the institutional mechanism that prevents the re-enclosure of data value by financial intermediaries. In the digital social contract’s proposed data dividend model, data-derived value is first captured by corporations as profit, then taxed by the State, and finally distributed to data subjects as a transfer payment. This circuitous route introduces three intermediaries, each of which extracts rent: the corporation retains the majority of the value as profit after tax, the State retains a portion for administrative costs, and the financial system extracts fees for the transfer. The mutualist alternative eliminates all three intermediaries: data trusts transact directly with service providers and with one another through the mutual credit system, and the surplus is distributed to members according to rules they themselves determine.

The surplus distribution function \(\sigma\) is not a data dividend in the sense of a universal payment determined by the State. It is a cooperative surplus determined by each trust’s assembly, which may choose to distribute it equally, to weight it by contribution, to reinvest it in infrastructure, or to direct it toward solidarity funds that support trusts with fewer resources. The key difference from the digital social contract’s proposal is that the distribution is determined democratically by the persons whose data generated the value, not by a State tax-and-transfer mechanism whose rules are set by legislatures subject to corporate lobbying.

10 Integration: The Dignity Stack as a Coherent Architecture↩︎

The six layers of the Dignity Stack are not independent modules but an integrated architecture in which each layer depends on and reinforces the others. This section specifies the inter-layer dependencies and demonstrates systemic coherence.

Each dependency is substantive. D2 requires D1 because a data trust whose infrastructure is hosted on corporate cloud servers is not truly sovereign: the cloud provider can access the data, surveil usage patterns, or terminate service unilaterally. Only community-governed infrastructure guarantees the material independence that sovereignty presupposes. D3 requires D2 because contextual integrity is realized through federation between sovereign trusts; trusts that are not sovereign cannot credibly commit to contextual norms. D4 requires D2 because the exit right that enforces fiduciary commitments is effective only if the exiting member has somewhere to go; without sovereign infrastructure and portable data formats, exit is a formal right without material substance. D5 requires D3 because inter-trust governance coordination is conducted through the federation protocols that D3 establishes. D6 requires both D1 and D5: D1 provides the non-corporate infrastructure on which the mutual credit system operates, and D5 provides the democratic governance through which surplus distribution is determined.

The architecture admits one further question that the layer-by-layer construction does not yet answer and that the objections of Section 11 press hardest. If the commons may be funded by firms and States, what prevents the largest funders from converting their contributions into control, reproducing within the commons the very concentration of power the digital social contract exists to resist? The answer is partly structural and partly empirical, and the boundary between the two must be drawn with care, because it is here that an optimistic reading of the architecture is most tempting and least warranted.

It is necessary first to distinguish two forms of capture, since they require different defences and conflating them is the characteristic error of optimistic commons design. Formal capture is the acquisition of governance entitlements: additional votes, a veto, or a residual claim on the commons’ surplus or direction. Structural capture is the acquisition of leverage without any formal entitlement, through the dependence of the commons on a resource that a contributor remains free to withdraw. The governance rules of the architecture bear directly on the first and only indirectly on the second.

The confinement to formal capture is deliberate, because the channel that the financing of fabrication plants and gigawatt data centres actually opens is structural. A contributor that supplies a majority of the commons’ ongoing operational compute need acquire no vote and demand no surplus to exercise control; it need only retain, as Definition 13 grants every supply contributor, the ability to cease supplying. The threat of withdrawal is a control lever that conditions (i) through (iii) leave untouched, and it is precisely the lever that the historical record of resource-asymmetric cooperatives and foundations shows to be decisive. The backstop on which formal-capture resistance relies, the exit and federation-exclusion mechanisms of D2 and D3, is moreover weakest exactly where structural capture is strongest: a commons whose compute is a single funder’s gigawatt data centre has, by the network-effect and sunk-cost argument we concede in Section 11, nowhere to exit to. The convivial threshold of Definition 6 was the original safeguard against this dependence; the present section does not abolish it but relocates it, as we make explicit both here and in our reply to the material-base objection.

This proposition is bounded by design, and the bound is the honest content of the architecture’s claim about the lower layers. The Dignity Stack does not establish that frontier-scale infrastructure can be funded by a single hyperscaler or State without capture; it establishes the opposite, that single-source funding of essential infrastructure is capture in all but name, and that the commons resists it only insofar as it can multi-source its supply. The material-base concession of earlier framings is therefore displaced rather than dissolved: the lower layers are fundable by firms and States without capture not at arbitrary concentration but only under a polycentric-supply condition that the present structure of the chip and data-centre markets makes demanding to satisfy. Open hardware, pooled and substitutable compute, and a plurality of competing suppliers are not peripheral conveniences but the precondition on which the whole claim rests, and where they are absent the claim fails.

It is in this bounded sense, and only in it, that the Dignity Stack functions as a shared civic battery rather than a private asset. A battery charged from a single source that can be switched off is controlled by that source regardless of who nominally owns it; a battery charged from many substitutable sources is not. The governance rules of Proposition 8 keep capital from buying direction outright, but it is the polycentric-supply condition of Proposition 9 that keeps capital from commanding direction through the threat of withdrawal, and only the two together make the metaphor honest.

We state the residual plainly, because two distinct risks remain even when both propositions are satisfied. The first is that condition (iii) requires an assembly disposed to enforce it, and a sufficiently dependent assembly may not be: capital–governance decoupling is a design commitment, not a law of nature, and the classical thesis of cooperative degeneration records the repeated erosion of exactly such commitments under sustained resource asymmetry, as large contributors convert provisioning into informal influence, staff dependence, and the slow rewriting of rules in their favour. The second is that the polycentric-supply condition may be unattainable at the fabrication layer, where the market is at present close to a monopoly, so that the bounded claim of Proposition 9, though valid, may have no satisfiable instance at that layer for the foreseeable future. We do not argue these risks away. We claim only that locating them precisely, the first at the disposition of the assembly and the second at the concentration of supply, and equipping the commons with one-voice governance, no-rent rules, conditional-acceptance rules, multi-sourcing, and exit, is a stronger and more honest position than either conceding the lower layers to the incumbents outright or pretending that funding at scale carries no risk of capture.

11 Objections and Responses↩︎

The voluntary governance architecture proposed in this paper invites several serious objections. We address eight, including those we consider most damaging, and respond to each with the honesty that rigorous philosophical argument demands.

The first objection is the enforcement problem against powerful adversaries: without the State’s coercive apparatus, what prevents actors with State-level resources, whether multinational corporations with hundred-billion-dollar revenues or national intelligence agencies, from systematically violating the Dignity Stack’s norms? This is the strongest version of the enforcement objection, and we do not underestimate it. The objection has two forms that must be separated. In the first, a powerful actor contributes capital or compute to the commons and seeks to convert its contribution into control; this form is answered by the capital–governance decoupling of Proposition 8, which denies a funder any governance purchase that its capital might otherwise buy. In the second, a powerful actor external to the commons violates its norms by force or fiat; it is this second form that the present objection presses, and we address it directly. Ostrom’s empirical research demonstrates that commons governed by communities can be stable and effectively maintained [12], but Ostrom’s cases, fisheries, forests, and irrigation systems, involve defectors who lack the power to overwhelm the governance structure. A corporation that decides to infiltrate a data trust, or a State agency that demands access to trust data under national security authority, poses a categorically different challenge. Our response is twofold. First, the enforcement mechanisms of the Dignity Stack, which comprise exit, reputation, graduated sanctions, and federation exclusion, do impose real costs on violators and are effective against the range of ordinary violations that constitute the bulk of data governance failures. Second, we acknowledge that the Dignity Stack cannot, by itself, resist an adversary that is willing to use the coercive power of the State to override its governance. This is a genuine limitation, and one the commons shares with every private owner of the same infrastructure, none of whom can resist a determined State either; the commons does not seek to evade the State but to coexist with it. It means that the Dignity Stack operates most effectively either within a legal environment that recognizes the right of voluntary associations to govern their own affairs, which is Ostrom’s seventh design principle (“minimal recognition of rights to organize”), or in domains where State power is practically limited. We do not claim that voluntary governance is sufficient against all adversaries; we claim that it is more effective than regulatory enforcement against the vast majority of data governance violations, while being normatively superior on the dimensions of dignity, consent, and contextual integrity. The statist alternative, for comparison, is also unable to enforce data rights against the State itself: intelligence agencies operate outside civilian data protection regimes by design, and GDPR fines, even the record 1.2 billion imposed on Meta, represent approximately 4% of annual revenue, a cost of doing business rather than a meaningful deterrent.

The second objection is the scalability problem: can voluntary governance scale to the level required for a comprehensive data governance system? The Dignity Stack does not require a single governance unit to scale to millions of members; it requires many small governance units to federate. Federation is a proven scalability mechanism: the Internet itself is a federated architecture in which autonomous systems coordinate through bilateral agreements (BGP peering). The Fediverse (Mastodon, Lemmy, PeerTube) demonstrates that social media can operate on a federated model with millions of users and thousands of independently governed instances. However, intellectual honesty requires acknowledging that the Fediverse also illustrates governance challenges: documented difficulties with cross-instance content moderation, loss of social capital during migration between instances, and undocumented governance norms that create barriers to entry. These are real problems, not fatal ones: they indicate that federated governance requires ongoing institutional learning and adaptation, not that it is infeasible. The cooperative movement, comprising over 3 million cooperatives worldwide with over 1 billion members, demonstrates that voluntary governance at scale is an institutional reality, not a hypothesis.

The third objection is the defection and data irreversibility problem: what prevents individuals or trusts from free-riding on the cooperative system, and what happens when data, once shared, cannot be “returned”? The Ostromian governance framework addresses ordinary defection through clearly defined boundaries, monitoring, graduated sanctions, and federation exclusion. The more serious version of this objection, however, concerns the irreversibility of data in derived artifacts. If a trust uses members’ data to train a machine learning model before a member exits, the exit function (Definition 7), which guarantees withdrawal of raw data with no copy retained, does not address the information that has been incorporated into model weights. Trained models are, in a meaningful sense, copies of their training data. We acknowledge this as a genuine limitation of the exit mechanism as currently defined. The honest response has three parts. First, this problem is not unique to the commons-based framework; it applies with equal force to the GDPR’s right to erasure and to the DSC’s proposed data trusts. No existing governance framework has solved the problem of “unlearning” trained models. Second, emerging technical work on machine unlearning and differential privacy offers partial mitigation, and the Dignity Stack’s open-protocol infrastructure (D1) facilitates the adoption of such techniques. Third, the trust’s governance rules (\(R\)) can specify ex ante constraints on model training, including requirements for differential privacy guarantees, model auditing, and restrictions on the retention of models trained on departed members’ data. The limitation remains, but it is a shared limitation of all data governance frameworks, not a specific weakness of the commons-based alternative.

The fourth objection is the tension between individual sovereignty and collective data governance: if data is an expression of individual personhood (as data personalism claims), how can it be governed collectively through data trusts? The tension is real but is not unique to the commons-based framework; it is inherent in the digital social contract itself, which simultaneously affirms individual data sovereignty and proposes collective governance through data trusts. The commons-based resolution is the exit function: the individual’s sovereignty over their data is realized through the unconditional right to withdraw from the trust with a complete copy of their data, subject to the model-weights limitation acknowledged above. Collective governance is thus conditional on ongoing individual consent, and the individual retains ultimate authority over their data at all times. This is a stronger protection than the statist alternative offers: a citizen cannot withdraw from a State’s data protection regime without physically relocating to another jurisdiction, a vastly more costly and disruptive exit than withdrawing from a data trust.

The fifth objection is the tyranny of structurelessness: Jo Freeman’s influential analysis [20] argues that the absence of formal authority structures does not eliminate power but merely renders it invisible, unaccountable, and concentrated in the hands of informal elites. Applied to data trusts, this objection warns that voluntary governance may produce informal hierarchies that are harder to challenge than formal ones. The objection is well-taken, and the Dignity Stack’s design incorporates Freeman’s own prescriptions: explicit governance rules (\(R\) in Definition 7), transparent decision-making through assemblies, mandated delegation with recall (Definition 10), and the exit function as an individual safeguard against informal capture. The Dignity Stack is not structureless; it is structured through explicit, democratically determined rules rather than through imposed external authority. Freeman’s critique targets groups that claim to have no structure while operating through invisible hierarchies; the Dignity Stack’s formal governance architecture is designed precisely to prevent this pathology.

The sixth objection is the tragedy of the anticommons: Michael Heller [21] argues that excessive fragmentation of governance rights can produce gridlock and underuse, as multiple rights-holders each possess veto power over productive uses of a shared resource. Applied to the Dignity Stack, this objection warns that a proliferation of context-specific data trusts, each with the power to refuse cross-contextual sharing, might prevent beneficial uses of data that require aggregation across contexts, such as public health surveillance, climate modelling, or educational research. The objection identifies a genuine risk. The federated mutual-aid protocol (D3, Definition 8) is designed to mitigate it: trusts share data for mutual benefit through bilateral agreements, and the norm of reciprocity creates incentives for cooperation. The risk of anticommons gridlock is real but must be weighed against the risk of the alternative: a unitary authority with the power to override contextual norms may enable beneficial data aggregation, but it also enables the surveillance, profiling, and contextual boundary violations that the digital social contract exists to prevent. The Dignity Stack accepts slower, negotiated data sharing as the price of structural contextual integrity.

The seventh objection concerns the network effects of exit: Hirschman [11] himself warned that exit alone can destroy institutions, and that effective governance requires both exit and voice. In digital ecosystems, network effects raise the cost of exit: a data trust’s value to its members depends on how many members it has and how much data it aggregates, so that exiting means losing access to collective bargaining power, shared analytical resources, and social connections. We accept this objection as identifying a real constraint on the exit mechanism. The Dignity Stack’s response is structural: by requiring open protocols and community-governed infrastructure (D1, D2), it reduces switching costs relative to the corporate platforms where network effects are most severe. Moreover, the nested assembly governance (D5) provides voice mechanisms, democratic participation, mandated delegation, and recall, alongside exit. The Dignity Stack does not rely on exit alone; it combines exit with robust voice mechanisms. The remaining network-effect costs of exit are a genuine limitation, and we do not claim otherwise.

The eighth objection is the material base problem: even granting that the governance protocols of the Dignity Stack are normatively superior, the lower layers of the very stack this paper invokes resist decentralization for reasons of capital and physics rather than ideology. [2] partitions the contemporary AI system into energy, chips, infrastructure, models, and applications, and the lower three of these layers exhibit economies of scale and lock-in that no voluntary community can plausibly overcome: leading-edge fabrication requires facilities whose cost runs to tens of billions of dollars, frontier training requires data centres drawing power on the order of gigawatts, and the dominant accelerator vendor’s software ecosystem constitutes a moat sustained by millions of developers whose accumulated tooling raises the switching cost of any open alternative. The convivial threshold of Definition 6, which requires that a system’s energy demand not exceed what its community can self-provision and that its workings remain auditable by that community, appears to resolve this problem only by definitional fiat: it restricts the Dignity Stack to AI systems small enough to be community-powered and community-understood, thereby conceding the frontier of capability, precisely the systems that concentrate economic and geopolitical power, to the incumbents the architecture was meant to displace. On this reading the commons would govern the periphery while the commanding heights remained in corporate and State hands.

The objection draws its force from an assumption the commons does not make: that to govern a layer of the stack one must own and operate it oneself, so that a community unable to build a fabrication plant must cede the fabrication layer to whoever can. The battery model of Section 10 rejects exactly this identification of ownership with governance. A community need not fabricate its own silicon, nor raise the tens of billions a leading-edge plant costs, in order to govern its relation to silicon on commons terms. Under capital–governance decoupling (Proposition 8), the capital for fabrication plants, gigawatt data centres, and frontier training runs can come from firms and States, precisely the actors with the means to supply it, while the governance of the resulting capacity, namely who may use it, under what consent and contextual-integrity norms, and how its surplus is distributed, remains with the commons. Capital purchases throughput; it does not purchase direction. The frontier of capability is on this account fundable without being captured, and the commanding heights need not remain in corporate and State hands merely because corporate and State capital built them.

This reframing changes the status of the convivial threshold of Definition 6, and honesty requires distinguishing which of its three conditions the change reaches and which it does not. The epistemic and political conditions, the knowledge relation 2 and the deliberation relation 3 , are met at the level of the federation rather than the single community: a single community cannot by itself audit a frontier model or oversee a hyperscale data centre, but a federation can pool the technical competencies required and exercise mandated, recallable oversight (D5) over a system that exceeds any one of its members. To this extent the threshold is not a ceiling that confines the commons to small systems but a requirement that auditing and oversight capacity scale, at the federation level, with the system governed. The material condition is a different matter. The energy relation 1 demands self-provisioning, and a gigawatt data centre funded and powered by a hyperscaler satisfies it for no community and no federation; such a system has governance sovereignty, in that the federation can audit and in principle decommission it, but not material sovereignty, in the strict sense of Definition 6 and the D1 to D2 dependency of Definition 12, which holds that a provider able to terminate supply unilaterally compromises sovereignty. We therefore do not claim that the lower layers, as funded today, are sovereign in the full sense the convivial threshold defines. We claim the weaker and defensible thing: that governance sovereignty is attainable at federation scale now, and that material sovereignty is recovered only as the polycentric-supply condition of Proposition 9 is approached, through multi-sourced and substitutable provision. Where supply remains single-sourced, the convivial threshold is violated at condition 1 and the sovereignty of that layer is partial, a fact we mark rather than reinterpret away.

Two considerations bound what remains. First, the convivial threshold retains a normative edge independent of capacity: much of the apparent necessity of frontier-scale compute reflects business models built on advertising, surveillance, and centralized capture rather than the intrinsic requirements of the tasks users actually need performed, so that the commons can decline to reproduce that scale where it is an artifact of extraction rather than of need. Second, the claim defended in this paper is falsifiable rather than self-sealing. It would be refuted if capital–governance decoupling could not in fact be sustained at fabrication and data-centre scale, that is, if funders of that magnitude proved able to convert their contributions into control despite the safeguards of Proposition 8, or if commons-governed AI at the upper layers systematically failed to sustain itself where the legal environment permitted it under Ostrom’s seventh design principle of minimal recognition of the right to organize [12]. The honest residual is therefore not that the lower layers are unfundable, which the battery model answers, but that the decoupling on which their funding depends is, as Section 10 concedes, a governed commitment rather than a guarantee. We mark that boundary rather than conceal it.

12 Conclusion↩︎

The digital social contract proposed by Alvarez-Pallete et al.represents a significant philosophical advance: it grounds data governance in human dignity, identifies the categorical imperative and personalism as the relevant normative frameworks, and articulates six dimensions of governance that a dignity-centric digital social contract must address. This paper has argued that the normative content of that contract, while not strictly entailing any single institutional architecture, is more faithfully realized by voluntary, polycentric, commons-governed institutions than by the statist regulatory framework the contract presupposes. The three philosophical theses we have defended, concerning non-instrumentalization, relational personhood, and structural contextual integrity, do not derive mechanically from Kant, Mounier, or Nissenbaum; they draw those traditions in a commons-based and subsidiary direction, motivated by the empirical observation that actually existing States, like the private owners of the stack, are structurally implicated in the data extraction the contract seeks to prevent. In the case of Mounier the affinity is closest on the governance form, the commons supplying the kind of subsidiary mediation between person and State his personalism called for, though our economic layer extends past his acceptance of the market, a divergence we mark rather than elide. The Dignity Stack provides the constructive alternative: a six-layer governance architecture in which each dimension of the digital social contract is implemented by a commons-based organizational protocol drawn from the cooperative, mutualist, and libertarian-municipalist traditions, specified with sufficient precision to evaluate its operational viability.

The argument is not that voluntary governance of AI is easy, desirable because easy, or inevitable. It is that the values the digital social contract proclaims, specifically the irreducibility of human dignity, the requirement of meaningful consent, the prohibition on instrumentalization, the demand for economic justice, and the principle of contextual integrity, are more fully realized in institutions constituted by voluntary association than in institutions constituted by coercion, even when those coercive institutions are designed with the best of intentions. We have been candid about the limitations of the commons-based alternative: it cannot by itself resist adversaries with State-level coercive power, a limitation it shares with the private owners of the same infrastructure; its exit mechanism does not fully address the irreversibility of data in trained models; its federated structure risks anticommons gridlock; and its governance units face the classic challenges of voluntary association, including informal hierarchies and network-effect switching costs. The deepest of these, and the one that replaces the material-base concession of earlier framings, concerns the funding of the capital-intensive lower layers by firms and States. The governance rules of the architecture defeat formal capture, the acquisition of votes or surplus, but not structural capture, the leverage a dominant supplier holds through the threat of withdrawing what it provides; that second form is resisted only to the degree that operational supply is polycentric and substitutable, a condition the present concentration of the chip and data-centre markets makes hard to satisfy and perhaps, at the fabrication layer, for now impossible. Capital–governance decoupling is moreover a governed commitment rather than a guarantee, since it presupposes an assembly disposed to enforce it, and the classical pattern of cooperative degeneration shows such commitments eroding under sustained resource asymmetry. These are the principal risks the architecture must manage, and we neither resolve them here nor conceal them. These limitations are real, and we do not minimize them. But they must be weighed against the limitations of the statist alternative, which include regulatory capture, State complicity in surveillance, the structural power asymmetry between regulators and regulated corporations, and the inherent tension between a coercive enforcement mechanism and the dignity-centred values it is meant to protect.

The practical path from the present institutional landscape to the Dignity Stack is a question that exceeds the scope of this paper. What we have established is that the voluntary governance of AI data is not merely a utopian aspiration but a constructive possibility grounded in actually existing institutional models, from cooperative data trusts through municipal assemblies to federated protocols, and that it constitutes, on the philosophical terms the digital social contract itself articulates, a more faithful realization of the values it proclaims. The community-governed AI system that powers itself, hosts its own data, governs its own norms, chooses its own service providers, deliberates its own governance, and distributes its own surplus is not a utopian fantasy imposed on the digital social contract from outside. It is the digital social contract taken seriously.

References↩︎