Agentic Venice

As it turns out, these are not just medieval curiosities for history nerds. They are the same kind of problems we wrestle with today, except now we're solving them in silico: autonomous software agents in agentic workflows, delegated to act on behalf of humans, at distance, under ambiguity, beyond direct supervision.

Do the eight solutions Venice built offer any insight into today's design requirements for multi-agent AI systems?

The most dangerous architecture is one where a single actor can reason, decide, execute, and verify without external check. Venice learned this through generations of doges who tried to become kings.

The Doge was magnificent and powerless. Over generations, the Republic systematically stripped the office of unilateral authority. By the fourteenth century, the Doge could not open his own mail without witnesses, could not meet foreign diplomats alone, and could not leave the city without permission. The electoral procedure, alternating rounds of lot and vote across multiple stages, was designed to make the outcome impossible to rig. The Doge was a symbol. The system ran the Republic.

For agentic AI: The first instinct in system design is to build a single orchestrator with root access, one model that reasons, delegates, executes, and evaluates. Venice learned that concentrating power in a single node, however capable, creates a single point of capture. The Doge architecture says: make your central coordinator visible, prestigious even, but strip it of unilateral execution rights. No single agent should be able to reason about a problem, decide the solution, execute it, and confirm its own success. That is a prayer, not an architecture.

Every agent should do one thing well and lack the authority to do anything else. Broad mandates create broad failure modes.

Venice governed through dozens of narrow magistracies, each with a specific domain: taxation, grain supply, salt, the regulation of maritime trade, shipbuilding, foreign commerce, market standards, sanitation, canals, customs, public health, espionage, state security. Each magistracy had its own mandate, its own tools, its own permissions, and no authority beyond them. The grain officials could not regulate trade. The customs officers could not set tax policy.

For agentic AI: Specialized agents with scoped permissions outperform general-purpose agents given broad access. This is a competence argument as much as a safety one. A magistrate who spent years understanding the salt trade made better salt decisions than a generalist council ever could. The same holds for agents. An agent with a narrow mandate, a constrained toolset, and deep context on its domain will produce better outputs than an all-access agent trying to reason across everything. Scope the permissions. Scope the tools. Scope the context window. Breadth is the enemy of judgment.

The agent that plans the work should never be the same agent that executes it, and neither should be the agent that evaluates the result.

No single Venetian body served as detective, prosecutor, judge, executioner, and accountant. Proposals moved through distinct phases: investigation, deliberation, authorization, execution, and audit. Different institutions handled each step. The body that identified a problem did not decide the remedy. The body that decided the remedy did not carry it out. And the body that carried it out did not verify the result.

For agentic AI: In most multi-agent systems today, a single model reasons about a task, generates a plan, executes steps, and self-evaluates the output. This is the equivalent of asking a Venetian magistrate to investigate himself, render judgment, carry out the sentence, and then audit his own performance. The Venetian separation maps directly: one agent for analysis and planning, a different agent for execution, a third for evaluation. As Paul Christiano and others working on AI alignment have argued, the ability to verify work must be architecturally independent from the ability to produce it. Otherwise you are building a confident liar.

Institutional knowledge must live in the system, not inside any individual agent. When an agent's context disappears, the system should still remember what was decided and why.

Venetian ambassadors were required to produce relazioni: formal end-of-mission reports documenting everything they had learned about a foreign court. Its rulers, its finances, its military capacity, its internal politics, its vulnerabilities. These reports were filed, indexed, and preserved. When a new ambassador departed for Constantinople, they did not start from zero. They read every relazione their predecessors had written. The institution remembered what individual officers forgot. The archive outlived the officer.

For agentic AI: Most agent architectures treat compute as ephemeral. An agent reasons through a problem, produces an output, and the reasoning vanishes. The next time a similar problem arrives, the system starts from scratch. Venice's relazioni system is the argument for persistent memory: structured, indexed, retrievable, independent of any single agent's context window. Put simply: if your system cannot learn from what it did last Tuesday, it is a series of expensive one-night stands with the same problem.

Telling an agent to care about the right outcome is a suggestion. Designing the system so the agent's success metric is bound to the right outcome is a constraint. Build the constraint.

The Serrata of 1297 restricted membership in the Great Council to a hereditary patriciate, several hundred families who became, in effect, shareholders in the Republic. Undemocratic, certainly. But it solved an alignment problem that democratic and autocratic systems both struggle with: the people writing the rules had their own wealth bound to the system those rules governed. A patrician who passed bad trade regulation would watch his own ventures suffer under it. As Francis Fukuyama argues in The Origins of Political Order, Venice's longevity owed much to this structural alignment between governing class and institutional quality. The incentive was financial, not rhetorical.

For agentic AI: Alignment in AI is usually discussed as a prompt-level or training-level concern: tell the model what to care about and hope it complies. Venice suggests a different approach: structural incentive alignment. Design the system so that an agent's success metric is bound to the outcome it governs. If an agent manages a pipeline, measure it on pipeline health, not task completion. If an agent evaluates code quality, score it on the downstream defect rate, not the number of reviews performed. Rhetoric is a suggestion. Architecture is a constraint. Venice bet on the constraint.

Rules that agents can choose to ignore are suggestions. Rules encoded in the system's permission structure are constraints. Every rule that matters belongs in the second category.

Venetian governance rested on constitutional constraints, on structure rather than trust. The Doge's impotence was structurally enforced: he lacked the tools to act unilaterally even if he wanted to. Magistrates could not exceed their jurisdictions because the system gave them no means to do so. The electoral mechanism was a procedure with physical lottery balls, locked rooms, and witnesses at every stage. Rules lived in process and infrastructure, in stone and procedure.

For agentic AI: A prompt is a suggestion. A system permission is a constraint. When an agent's instructions say "do not access the production database," that is a hope. When the agent's API credentials do not include production database access, that is a guarantee. Venice understood the difference between advisory norms and constitutional constraints. Most agent systems today rely overwhelmingly on advisory norms: system prompts, guidelines, guardrails that exist as text the model can choose to interpret flexibly. The lesson: every rule that matters should be encoded in the system architecture (permissions, tool access, API scoping). Prompts are what you tell an agent to do. Permissions are what you allow an agent to do. Build for the gap between them.

Every system needs oversight agents, and every oversight agent is itself a risk. This recursion never fully resolves. Design for it anyway.

The Council of Ten held extraordinary powers: surveillance, investigation, suspension of officials, emergency action. Venice created it because someone had to watch for systemic threats that no individual magistracy would detect. And yet the Council itself became the most dangerous institution in the Republic. Concentrated supervisory power, the Venetians discovered, is both necessary and inherently risky. The watchers need watchers, and at some point the recursion has to stop.

For agentic AI: Every multi-agent system needs a supervisory layer, something that monitors for cascading failures, detects anomalies, and can intervene. This is the Council of Ten pattern: an agent (or set of agents) with elevated privileges and broad visibility. The danger is identical to Venice's. A supervisory agent with the power to override other agents is also the agent most capable of causing catastrophic damage if it malfunctions or is compromised. Stuart Russell's work on AI safety circles this problem repeatedly: the more capable and autonomous the supervisor, the higher the stakes of supervisory failure. Venice managed it through term limits, mandatory rotation, and overlapping oversight from other bodies. In agent systems, the equivalents are audit logs, time-bounded elevated permissions, and multiple independent supervisory agents that monitor each other. The honest position is that the recursion of "who watches the watcher" eventually bottoms out in a human being who is paying attention. That may be the most Venetian lesson of all.