ADR-086: Operator-side scenario-framing manipulation (coordination-substrate influence risk)

Status: Proposed — problem-framing for handoff; no decision made here. Owner: James Young (assigned 2026-06-02) — owns the "coordination substrate / company brain" framing that trips the trigger. Decision deferred; gated to any external "coordination substrate" / "AI DAO" / cross-user-governance framing (see Triggers). Date: 2026-06-02 Context: The dimension cube (docs/research/foundations/scenario-dimension-cube.md) makes the framing levers of a decision explicit and independently manipulable — stakes magnitude, fiction-fidelity, default outcome, information topology, deadline pressure. The measurement layer simultaneously builds a per-player model of how each person reasons. Put those two together and a second-order capability falls out: whoever authors the scenarios can, knowing a population's reasoning profiles, frame a given choice to predictably nudge that population toward a desired outcome. This is the inverse of ADR-077: 077 defends against a user forging their own profile to gain power; this ADR concerns the operator weaponizing the framing levers against honest players. It has been raised independently twice and still has no home — so this ADR exists to frame the problem and hand it off, not to resolve it.

At a glance

What it flags: that Pulse's own design — explicit framing levers (the cube) + a model of how each player reasons (the measurement layer) — creates an operator-side capability to steer honest players' decisions by controlling how a scenario is framed. Not a decision — this is a threat-model for an owner to assess. Owner: James Young. Revisit trigger: before any external "coordination substrate / AI DAO / cross-user governance" claim or surface ships.

• Distinct from ADR-077: 077 = user fakes their own score (attack on the profile). This = operator frames the scenario to move other honest players (attack via the substrate). Opposite direction; both must be settled before tokens/governance.
• Mechanism: the cube's framing levers (axis 11 stakes magnitude, fiction-fidelity, axis 12 default outcome, axis 8 information topology, axis 2 deadline) are exactly the dials a manipulator would pull; the judgment profile tells them which dial flips which person.
• Raised twice independently: Tash (May 4 all-hands — "mastermind / manipulation risk needs its own ADR before any external AI DAO framing") and James (Jun 1 all-hands — "you control the environment… craft this into a low-stake or high-stake perception… you can kind of brainwash people").
• Adjacent dual-use: James's CAPTCHA idea — using response consistency as a humanness / identity check — is the same capability pointed at a benign use; worth scoping in the same pass.
• Recommended interim posture: do not make external "coordination substrate / AI DAO" claims until an owner has assessed this. Keeping scenario-authoring separate from any outcome-stakes is the most likely structural mitigation.

flowchart LR
  CUBE["Cube framing levers<br/>stakes · fiction · default<br/>info topology · deadline"] --> FRAME
  PROFILE["Judgment profiles<br/>how each player reasons"] --> FRAME
  FRAME["Operator authors the<br/>scenario framing"] --> NUDGE["Population nudged toward<br/>operator's desired outcome"]
  NUDGE -.->|only becomes power when| STAKE["An externality is attached<br/>(token / vote weight / allocation)"]
  classDef risk fill:#fde,stroke:#c47;
  class NUDGE,STAKE risk;

The capability exists structurally today (framing + profiles). It only becomes power when an outcome-bearing externality is attached — the same trigger boundary as [ADR-077](../decisions/077-anti-gaming-defenses-token-bearing-surfaces.md) and [ADR-050](../decisions/050-agent-permission-tiers.md).

Decision

Deferred — no decision is made in this ADR. This document frames a risk for an assigned owner to assess and decide on. It records the threat model, why it is distinct from ADR-077, the levers involved, and the open questions the owner must answer, so the deliberation is preserved and the item stops falling through the cracks.

The single standing recommendation, pending that assessment: do not advance any external "coordination substrate / AI DAO / cross-user governance" framing until this is addressed, because that framing is precisely the context in which the capability converts into real influence over real outcomes.

The threat model

Who: the party that controls scenario authoring (today: us; later: anyone we let author scenarios for a cross-user surface, or a campaign sponsor / DAO who commissions scenarios).

Capability: the cube isolates the framing levers of a choice and the measurement layer models how individuals respond to them. An author who knows "this population goes one way under perceived-low-stakes and the other under perceived-high-stakes" can dress an outcome-bearing decision in the framing that produces the result they want — while every player answers honestly. The players aren't gamed; the environment is.

Levers most exploitable (all already cube dimensions):

• Axis 11 — stakes magnitude: James's exact example — present a consequential vote as "not a big deal" (or vice versa) to shift engagement and risk posture.
• Fiction-fidelity (currently a domain hint, see the fiction-confound brief): lowering felt reality lowers felt stakes; raising it sharpens them.
• Axis 12 — default outcome: what happens if you abstain (favors-action vs favors-status-quo) is a classic turnout/【nudge lever.
• Axis 8 — information topology: controlling who-knows-what frames the choice before it's made.
• Axis 2 — deadline pressure: manufactured urgency suppresses deliberation.

Why the cube raises the risk rather than creating it: framing has always moved decisions. What the cube adds is legibility and repeatability — the levers are enumerated, taggable, and (with the profiles) their effect is predictable per-population. That's the difference between ad-hoc spin and an instrument.

Distinction from ADR-077 (do not merge these)

	ADR-077	ADR-086 (this)
Attacker	A user	The operator / scenario author
Target	The user's own profile/score	Other honest players' decisions
Method	Forge a profile shape the schema only reads	Frame the scenario to predictably nudge
Defense family	Consumer-discipline + aggregation + personhood gate	Separation of powers + framing audit + disclosure (TBD)

Both share the same trigger boundary: harmless until an externality (token, vote weight, allocation) attaches to outcomes. Before that, the worst case is a skewed practice scenario.

Open questions for the owner

Highest-leverage call to make first (cheap, de-risks the rest): Do we ever let a live governance/token outcome ride on a Pulse-authored scenario? If the answer is a standing "no, never," most of the capability below never converts into power and this ADR can stay dormant — answer this before investing in framing-audit machinery.

1. Separation of powers: should the party that authors scenario framing ever be allowed to also hold stake in the outcome? (Strawman: structurally forbid it on any outcome-bearing surface.)
2. Framing audit / neutrality rules: can we define a "neutral framing" standard for outcome-bearing scenarios (balanced default, disclosed stakes magnitude, symmetric information) and audit against it?
3. Disclosure: when a scenario carries real stakes, must its framing parameters be disclosed to players or a third party?
4. Allow outcome-attached scenarios at all? The cleanest mitigation may be: Pulse measures judgment, but never lets a live governance outcome ride on a Pulse-authored scenario.
5. Dual-use (CAPTCHA / consistency check): scope the benign use (response consistency as a humanness/identity signal) in the same assessment, since it's the same capability.

Discussion

The risk surfaced twice from different people without prompting — Tash framed it as a "mastermind" / security concern needing its own ADR before any external "AI DAO" framing; James arrived at it as a giddy second-order observation ("you can kind of brainwash people") immediately after seeing the cube's lever flexibility. CoachJ's in-the-moment response was telling and correct: "one thing we don't need here at Beacon is more use cases — let's stick to the game plan." That's the right product instinct (don't get distracted), but it's also exactly why this needed to be written down rather than acted on: the capability is real and adversarial, it doesn't block any current shipping, and it should be assessed deliberately by an owner before the framing that activates it (coordination substrate / company brain / AI DAO — see ADR-039 and the company-brain reframe) goes external. Parking it as a Proposed, owner-TBD ADR keeps it from evaporating into chat history while keeping it off the critical path.

Consequences

• Adds a standing constraint: external "coordination substrate / AI DAO / cross-user governance" messaging should reference that this is unassessed, until an owner closes it.
• Pairs with ADR-077 and ADR-050 as the three things that must be settled before any externality attaches to Sync signals — 077 (self-forgery), 050 (permission tiers), 086 (operator framing).
• No code or corpus change. No current surface is affected.

Triggers (when this must be picked up): - Any external pitch/surface using "coordination substrate," "AI DAO," "company brain," or cross-user governance framing. - Any move to let third parties (campaign sponsors, DAOs) commission or author scenarios for other users. - Concurrent with ADR-050 going from Deferred → Proposed (permission tiers attaching externality to score).

Key files / links: - docs/decisions/077-anti-gaming-defenses-token-bearing-surfaces.md — the complementary (inverse-direction) threat model - docs/decisions/050-agent-permission-tiers.md — what attaches externality to the score - docs/decisions/039-decision-capture-primitive.md — the company-brain / coordination-substrate framing this gates - docs/research/foundations/scenario-dimension-cube.md — the framing levers (axes 2, 8, 11, 12, fiction-fidelity) - docs/research/briefs/fiction-fidelity-confound.md — the fiction lever named here, treated as a signal-quality issue in its own right