At 2:40 on a Saturday morning, a security researcher reports a remote code execution bug in Larchline, a fictional open-source message broker that runs inside thousands of data pipelines. For eleven years Larchline has had one final decision-maker, its founder, Mara Lindqvist. She died in the spring. Tomas Reyes and Priya Natarajan, the release engineers she chose in life as operators, read the report and mark it urgent. Within the hour, the release notes carry a ruling to ship a patched version that night, even though the patch breaks an old client handshake. The ruling is signed by the Larchline stand-in, version 4, and nobody mistakes it for Mara’s own decision. A proposal to relicense the project, filed the same week, is marked as able to wait. So it waits.

That is a contocracy at work, and almost every part of it is something engineers already know how to build.

What a contocracy is

Contocracy is a form of rule proposed in 2026. One chosen person, the contocrat, holds a community’s highest office for good. Lower powers can be delegated, so maintainers still merge pull requests and managers still ship features. The top office itself is not transferable and passes to no heir. When the contocrat dies, the office is held in abeyance and remains hers. Between her death and any return, decisions that can wait do wait.

Some matters cannot wait, so the design adds one declared AI stand-in. By default it acts on urgent matters after the contocrat’s death, and it can also act for a living contocrat who cannot be reached, if she has authorised that. Four parts make it trustworthy, and each maps onto a familiar engineering practice.

A declared identity

Article 50 of the EU AI Act (https://artificialintelligenceact.eu/article/50/), which applies from 2 August 2026, asks providers to make sure people know when they are interacting with an AI system. A contocracy goes further. There is exactly one stand-in at a time, with a name, a version number and a public card in the spirit of model cards (https://arxiv.org/abs/1810.03993), stating what it learned from, what it may rule on and who runs its gate. It never writes in the contocrat’s first person, never uses her voice or face and never claims to be her. Everyone knows the stand-in, not the contocrat, is deciding.

Rulings labelled as its own

Every ruling is published under the stand-in’s own label: its name and model version, the matter, the parts of the contocrat’s record it relied on and the operator who sent the matter through. Rulings go into an append-only, signed log, so anyone can later check what was decided, by which model and on what evidence.

Two limits bound every ruling, and both are fixed at her death: the community’s mission and the contocrat’s religion. Her religion prevails over the mission. In a policy engine, that is a precedence rule written once and enforced before any ruling ships.

An urgency gate run by humans

The gate is deliberately human. Operators the contocrat chose in life judge which matters are urgent. The stand-in cannot route work to itself and never sees a matter the operators have not sent through. The default is to wait: a matter that can wait goes into a queue and stays there.

Treat the gate like any other critical control. The contocrat writes the urgency rubric while she is alive, with examples of matters she would and would not call urgent. The operators apply it, and each of their calls is logged beside the ruling it unlocked. A long queue is the system doing its job.

Figure 1. How a contocracy’s urgency gate routes a matter: operators the contocrat chose in life decide whether it is urgent, only urgent matters reach the declared AI stand-in, and its rulings are labelled as its own and logged. Figure created with Claude Opus 5.5 (Anthropic).

An upgrade test against the record

Models get deprecated, hardware changes and better architectures appear. A contocracy allows a rebuilt or upgraded stand-in only if it matches the contocrat’s record at least as well as the current one.

The record is the evaluation set: her decisions, design reviews, memos and recorded reasoning, settled at her death. Hold out part of it, run the current stand-in and the candidate against it, and publish both scores. A candidate that scores lower does not ship, however impressive it looks on public benchmarks. Think of it as a regression suite whose golden set can never be edited, with the version bump showing on every label that follows.

If the contocrat returns

Cryopreservation is expected but not required. No one has been revived, and the form promises nothing. Even so, the design covers the case. A return counts only if it is proven, which means proof of first-person continuity. A likeness does not qualify, so neither does a voice clone, an avatar or a stand-in with perfect scores. A proven return brings a full briefing and the power to reverse the stand-in’s rulings. For engineers, that means a log complete enough to brief her, and rulings that can be undone wherever possible.

The strongest objections

The first objection is that frozen judgment will drift from a changing world. Some drift is certain. That is why the stand-in rules only on urgent matters, lower powers handle everyday work and everything else waits. A community that adopts a contocracy accepts the cost of waiting in return for keeping one person’s judgment at the top.

The second is that the operators become the real power. Their power is narrow: they decide whether a matter is urgent, never how it is decided, and every call they make sits in the log beside the ruling it unlocked.

The third is that a 51% vote of members should be able to override the stand-in. Building that in would hand the top office to whoever can assemble a majority, which is a different form of rule. A contocracy exists for communities that want one person’s judgment to last.

The fourth is that models fail in strange ways. They do, which is why this stand-in has a narrow mandate, a test before every upgrade, a label on every ruling and a log that a returning contocrat could use to reverse it.

A call to builders

If you build AI agents, you already have most of the parts: identity, signed logs, human-in-the-loop gates and evaluation suites. Sketch a contocracy for a project or company you know well. Name the contocrat, list her operators, write the urgency rubric, settle the record and draft the stand-in’s card. Then share the design under its real name: the form is a contocracy, and the one person at its head is the contocrat.

Disclosure: Claude Opus 5.5 (Anthropic) was used to draft the text and the figures from my concept and to check the sources it cites; I reviewed and approved the final text. Competing interests: I proposed the term contocracy. Funding: none.