Virtual Organizations as Normative Multiagent Systems

Proceedings of the 38th Hawaii International Conference on System Sciences - 2005

Virtual Organizations as Normative Multiagent Systems

Guido Boella1 Joris Hulstijn2 Leendert van der Torre3

Abstract

In this paper we propose a conceptual model of vir-tual organizations as normative multiagent systems. The dy-namic aspects of virtual organizations are modeled usingaspects of speech act theory and Searle’s theory of the con-struction of social reality. We illustrate the use of our modelby discussing an example of distributed access control poli-cies. We show how the model captures the distinction be-tween local and global authorities, and between local andglobal norm enforcement policies.

1. Introduction

Recent developments on environments for computer sup-ported collaborative work, distributed knowledge manage-ment and ‘grid architectures’ for sharing resources andcomputational services have lead to an increased interest inwhat has been termed virtual organizations: a set of indi-viduals and institutions that need to coordinate resourcesand services across institutional boundaries [17]. Users ofsuch a coordination infrastructure can form a community,with a shared set of objectives and norms about what con-stitutes accepted behavior. Nevertheless, control over ser-vices and resources largely remains local. The problem is toalign the objectives and norms of the community of users,with the formal rules of such an infrastructure. Traditionalclient-server architectures can accommodate global objec-tives, but can not delegate basic local control. Fully dis-tributed peer-to-peer architectures on the other hand, do notoffer enough mechanisms to realize global objectives. Ap-parently we lack a conceptual model of virtual organiza-tions with norms at different levels of control.

In this paper we present and discuss a conceptual modelof virtual organizations based on what we call a normativemultiagent system (NMAS) [3, 4, 5]. Unlike a central au-thority or a bureaucracy [26], our model allows a distributed

1 Dipartimento di Informatica, Universita di Torino,[email protected]

2 Faculty of Economics and Business Administration,Vrije Universiteit, Amsterdam, [email protected]

3 CWI, Amsterdam, [email protected]

0-7695-2268-8/05/$20

control structure with normative agents operating at differ-ent levels of control. And unlike a peer-to-peer system, ourmodel offers a more elaborate normative structure, whichenables it to address global concerns. Given the proposalto model virtual organizations by normative multiagent sys-tems, a number of questions remain.

1. How can the behavior of an individual agent in a vir-tual organization be described?

2. How can agents change a virtual organization?3. How can agents in a virtual organization establish nor-

mative relations or contracts with each other?4. How can we deal with norms that operate at different

levels of control?

Our answer to these questions depends on the interactionamong agents and normative systems. In general, the deci-sions of agents depend on recursive models of the expectedbehavior of other agents and normative systems. We con-sider interactions between an agent and a normative sys-tem, where an agent models the normative system as an au-tonomous agent, and the normative system defines roles thatagents can play in the system. Moreover, we consider inter-action among individual agents in the context of a norma-tive system, like in contracting. Finally we consider inter-actions among normative systems, like the interaction be-tween a global and a local authority with respect to globalenforcement policies.

There are two ways to model virtual organizations. Onemay study existing virtual organizations, and try and find adescriptive model that best matches the observations. Alter-natively, one may design and implement an architecture thatenables a virtual organization. The architecture is based on amodel, which thereby prescribes important aspects of futurebehavior. Our model is intended to be used in this prescrip-tive way, and has no empirical pretensions. More details ofthe formal logic that underlies the model can be found else-where [4, 5].

The layout of the paper is as follows. First we discussthe general structure of our model, and the methodology tomodel virtual organizations. We explain the basic idea be-hind the agent metaphor, and in what ways it can be ap-plied. The questions 1 – 4 are addressed in the subsequentsections of the paper.

.00 (C) 2005 IEEE 1


2. Normative Multiagent Systems

The NMAS model introduced in this paper buildson a model developed for the design of multiagent sys-tems (MAS). Multiagent systems are computer sys-tems that are composed of a number of autonomousagents, i.e., pieces of software, that must interact in or-der to achieve the global system’s objectives. Applicationscan for example be found in transport logistics [9], manu-facturing scheduling [33], and social simulation [31]. In-creasingly, developers of multiagent systems have turnedto concepts from the social sciences, such as organiza-tion structures and norms as a guideline for design [13].We believe that the principles of the NMAS model are gen-eral enough to be applied to human as well as artificialagents. In this paper we do not propose to deploy ‘in-telligent agents’ to monitor or control aspects of virtualorganizations. Whether such applications are success-ful is an empirical question [22]. In this paper the agentmetaphor is only used as a conceptual tool.

We assume a partial unification of agents – human orartificial – and normative systems. A normative system isnothing but a set of explicit rules of behavior, norms, thatapply to a set of agents. A normative system may provideadditional rules for detecting violations and applying ap-propriate sanctions. The central idea is that both agents andnormative systems can be viewed – and thus modeled – asautonomous decision makers [3]. Like an agent, a norma-tive system serves some objective, for example to maintainproperty rights. And like agents, a normative system onlyhas a limited capacity to pursue such objectives. A norma-tive system can be considered as an autonomous agent fromthe viewpoint of an individual agent. For example, whenan agent is deliberating whether or not to obey a norm, itwill reason about the expected behavior of the normativesystem, given what it knows of the objectives and limita-tions of the normative system with regard to violation detec-tion and sanctioning. A normative system can also be con-sidered as an autonomous agent from the point of view ofanother normative system. However, normative systems areobviously different from ordinary agents in many other re-spects, and the two kinds of agents should be distinguished.In the end, the net behavior of a normative system is de-termined by individual agents playing pre-defined roles inthe system, where the roles are governed by further norms.Only when the model abstracts over the individual proper-ties of these agents, we may say that the normative systemas such is making a decision. To stress the commonality, wesometimes refer to a normative system as a normative agent.

Starting point of the model is that there are differentkinds of interactions in a normative multiagent system: in-teractions between an agent and a normative system, inter-actions among agents subject to a normative system, and in-

0-7695-2268-8/05/$20

teractions among normative systems. These interactions cantake the form of communication between agents and norma-tive systems, for example a normative system commandingan agent to do something .It can also mean an agent chang-ing the normative system, or two agents establishing a con-tract in the context of the normative system. The interactioncan be merely hypothetical, when an agent has a profile ofanother agent, and tries to predict its behavior.

A:N

N:A

A:A

N:N

A N

A N

A

A

N

N

Figure 1: Types of Interaction between agents A and nor-mative systems N

The core of the model is a relational view of two agents,either ordinary agents A or normative agents N . The modelis structured according to the different kinds of interaction(Figure 1).

1. A:N: How can the behavior of an individual agent ina virtual organization be described?Interaction. The normative system can command anindividual agent using prescriptive norms and impera-tive speech acts. For general norms, the normative sys-tem has to decide whether the agent is subjected to thenorm. In a social system, the agent has a choice to ac-cept or reject the norm. The normative system moni-tors the agent and observes whether behavior wouldcount as a violation. If a violation is detected, the nor-mative system can sanction the agent.Recursive modeling. The view on normative sys-tems from the perspective of individual agents de-pends on the agent model used. We discuss the cogni-tive foundations of our model, and how norms can in-fluence individual decisions [11] (Section 3), basedon an existing cognitive agent architecture calledBOID [11]. In addition to modeling the customary be-liefs, desires and intentions of an agent (abbreviatedBDI), also the effect on decision making of norma-tive concepts like obligations (referred to as O) is ac-counted for.

.00 (C) 2005 IEEE 2


2. N:A: How can agents change a virtual organization?Interaction. First it must be decided which agents areallowed to do what in the normative system. Someagents have the power to introduce new norms, to de-cide to count behavior as a violation, or to sanctionother agents. These powers are related to roles like leg-islator, policemen, defender, etc. Due to the separationof duties, some combinations of roles are excluded.Second, agents in certain roles and under certain cir-cumstances can change the rules of a normative sys-tem, by uttering a performative speech act that consti-tutes a change (Section 4).Recursive modeling. A normative system not onlyviews agents as subjects which it can oblige, pro-hibit, permit, sanction and control, but it also views theagents as subjects that can play other roles in the sys-tem, for example to modify the normative system. Wealso look at constitutive norms, that can be contrastedwith regulative norms, and at norms regulating inter-action itself, such as dialog games or interaction pro-tocols.

3. A:A: How can agents in a virtual organization estab-lish normative relations or contracts with each other?Interaction. When two agents in a virtual organiza-tion together would like to cooperate, but individualrationality dictates them to defect (as in the Prisoner’sDilemma), they can agree to draw up a contract. Thenormative system may contain a contractual frame-work. The agents can propose a contract, and nego-tiate its conditions. Typically when two agents are ina contracting relationship there may be disagreementabout the conditions of the contract, whether behaviorcounts as a violation, and how such behavior shouldbe sanctioned. Contracting involves social phenomenain normative multiagent systems like directed obliga-tions and the formation of groups (Section 5).Recursive modeling. We consider agents from theviewpoint of other agents, given a normative system inwhich the interaction is embedded. This involves so-cial phenomena like trust, as well as control mecha-nisms to enforce contracts.

4. N:N: How can we deal with norms that operate at dif-ferent levels of control?Interaction. In Section 6 we study the example of dis-tributed access control policies [34]. We propose a dis-tinction between local and global authorities, and be-tween local and global norm enforcement policies. Wedistinguish three kinds of agents: subjects, whose be-havior is governed by norms; defenders, who shouldmonitor violations of norms and apply sanctions; andautonomous normative systems, who issue norms andsupervise defender agents.

0-7695-2268-8/05/$20

Recursive modeling. The example of distributed ac-cess control policies [34] crucially involves normativesystems that contain multiple other normative systems,which can interact at various levels.

3. Cognitive Foundations

In this section we consider the viewpoint of an arbitraryagent. We assume that the core of the agent’s deliberationis based on mental attitudes like beliefs, desires, goals andplans, following the tradition in cognitive science, e.g., [8]and on obligations, studied in deontic logic [30] – the logicof normative systems. The mental attitudes are interpretedas follows [11]. Beliefs are informational attitudes; theyrepresent what the world is expected to be like. Desiresrepresent internal motivations, which may lead to possiblegoals for the agent to pursue. When a goal is adopted by theagent, a plan is formed to achieve the goal. Finally, obli-gations model external motivations for an agent, such asnorms.

3.1. Formal Models

In our model, these mental attitudes are not representedas sets of sentences as is customary, e.g. [35], but as sets ofconditionals or production rules. This expresses the fact thatmental attitudes are context dependent by nature [20], andthat their application is conditional on certain constraints.So each attitude Bel, Goal, Obl, etc., is represented by aset of rules of the form A −→ B, where both A and Bare sequences of facts. Moreover, B may contain specialdecision variables, or actions. The values of decision vari-ables are under the control of the agent. For simplicity, bothfacts and decision variables are represented by boolean vari-ables, being either true or false. The decision making ofan agent is represented by a forward reasoning loop, whichruns roughly as follows.1 The agent receives input from ob-servation, represented as a set of facts S. Alternatively, theagent may start with a set of initial goals, also representedby a set of boolean variables S. Now the agent tries to matcheach rule A −→ B against S. If A is contained in S, andthe facts of B do not contradict a fact in S, the rule is ap-plicable. However, there may be several rules applicable toS, from the same and from different mental attitudes, eachwith a different possible outcome. Using a priority order-ing, the agent selects one rule – this is called conflict reso-lution – and applies it: the result B is added to S. This pro-cess continues, until a stable set of facts is reached, to whichno further additions can be made. Such a stable set, an ex-tension, represents the result of the decision making. For

1 Technical details of the reasoning is expressed using input/output log-ics [27, 28]. Their application to Normative Multiagent Systems is ex-plained in [4, 5].

.00 (C) 2005 IEEE 3


agent a deliberates about optimal decision– considers optimal decision of agent b

agent b deliberates about optimal decision– considers optimal decision of agent a

agent a deliberates about optimal decision– considers optimal decision of agent b

...

Figure 2: Recursive modeling using agent profiles

example, a selfish agent will prefer desires to social obli-gations; a social agent will let obligations take priority. Thedecision making behavior of an agent therefore crucially de-pends on the way the conflicts among the mental attitudesare resolved. Different priority orders lead to different ex-tensions, which represent different kinds of behavior.

3.2. Recursive Modeling

Interaction between agents is based on the idea thatagents also have profiles of other agents, which specify themental attitudes of others. Technically, profiles also con-tain sets of production rules. Individual agents can there-fore play hypothetical games with other agents to predicttheir behavior, in response to their own behavior (Figure 2).This is called recursive modeling. Such recursive model-ing can become rather complex. Therefore we assume thatour agents are resource bounded, such that for example thenumber of levels at which an agent can reason about otheragents is limited. Typically, an agent can reason about an-other agent’s expectations about a third agent; more com-plicated nestings are not allowed.

Recursive modeling is especially useful to model trust,deception and threats. Consider an agent a that receives in-formation from agent b. Now should a trust b regarding thetruth of that information? Suppose a already has a profile ofb, to the effect that b has no desire to be truthful to a. In thatcase, one likely outcome of the recursive simulation will bethat b will not speak the truth. So a should not trust b.

Interaction between an agent and a normative system ismodeled just like the interaction between two agents. Theagent thus assumes that the normative system has motiva-tional attitudes, and that these desires or goals of the nor-mative system are like commands for the agent. One ex-ample can be found in a traditional client-server architec-ture, where a ‘wish’ for the server, is in fact a ‘command’for the client. Moreover, the agent assumes that the norma-tive system has informational attitudes, which partly deter-mine the state of the world. Following Searle [37], insteadof saying that the normative system believes that A impliesB in context S, we would say that A counts as B in con-text S. The normative system creates and records the factsthat make up social reality. For example, within the conven-tional context of going to the theater, a ticket to a perfor-mance counts as evidence that you are entitled to occupy

0-7695-2268-8/05/$2

a seat during the performance. More about such constitu-tive norms in section 4.3 below.

Unlike desires or goals, norms are external to an agent.So how can norms and obligations affect decision making?The idea is that behavior or a situation which does not sat-isfy the obligation, is seen as a social fact that counts asa violation in the normative system. The idea to use vi-olation conditions to model obligations, is known as An-derson’s reduction. So instead of specifying that access tosome resource is forbidden, we specify that accessing theresource counts as a violation. Thus a rule of the formaccess(a, r) −→ viol(a) will be part of the ‘beliefs’ ofthe normative system, where a can be any agent and r anyresource. Moreover, with each obligation we can associatea sanction. A sanction is an action or fact that is undesir-able for each agent that is subject to the norm. It must alsobe undesirable for the normative agent to impose a sanc-tion, and sanctions must only be triggered by detected vio-lations. These restrictions prevent arbitrary sanctioning [3].Note that there is a distinction between behavior that countsas a violation and behavior that is actually being sanctioned,as these are distinct decisions of the normative system.

4. Dynamics

How can we account for the dynamics of a normativesystem? Again, we apply ideas from Searle [37], includ-ing older work on speech acts [1, 36]. Roughly, there arespeech acts, so called performatives, that in a given com-munity ‘count as’ a change to the rules and social factsgoverning the normative system. For example, by explic-itly authorizing an agent to access a resource, that agent ac-quires the right to access the resource. This means thatthe access policies of the community have in fact been al-tered. So just like certain facts may count as evidence ofother social facts, as we have seen in the example of a the-ater ticket, certain actions may count as changes to thesocial facts. Typical examples are making a promise, or ac-cepting a request. However, performatives only have theirintended effect, when so called felicity conditions or ap-plicability conditions are satisfied. Consider for examplea command, which only has effect in case the command-ing agent has authority over the agent commanded. Inthe distributed access policy example, the right to enti-tle others to access a resource, is granted to the owner ofa resource. In other words, only if the speaker and the ad-dressees of a speech act enact appropriate roles in the nor-mative system that underlies the interaction, the speech actwill be successful.

0.00 (C) 2005 IEEE 4


4.1. Roles

Agents can play different roles in a normative system.A role specifies the rights and duties of each agent that en-acts that role (e.g., access rights, safety maintenance duties),as well as social relationships with other roles (e.g., author-ity, dependence). Thus, normative systems are modeled as astructured entity, where the structure is provided by the rolesand the role relations. This is useful to model relations in in-stitutions as studied in organizational theory, as well as rolesin legal theory. For example, in the trias politica there aredifferent roles associated with the executive, legislative andjudicial powers. In a similar way, one can conceive of a nor-mative system in which the right and duty to see to it thatnorms are obeyed and that violations are detected and sanc-tioned, have been delegated to so called defender agents.These defender agents control subjects, but are themselvescontrolled by the autonomous normative system as a whole.

The possibility to delegate powers to agents in differentroles, is a distinctive property of our model. Normative sys-tems have thus far been modeled as abstract entities. If nor-mative systems or institutions are represented at all, then of-ten they are just referred to as indices S, for example in thephrase “A counts as B in institution S” [25]. However, it iscrucial to find out what aspects of the structure of an insti-tution make sure that such a constitutive norm is in place.

4.2. Institutional Change

Virtual organizations are subject to change. Changes takeplace at different places in the model, and can have a differ-ent scope and impact. Speech acts may be exchanged be-tween participants in an interaction. And in case a speechact counts as a particular move in a dialog game (see be-low), changes to the institutional facts are established. Forexample, when accepted, a promise creates a commitmentfor the promiser to keep the promise. Similarly, when newagents enter a community, a registration action creates theirnew status as a member. The way such a registration ac-tion is carried out differs between applications. In computa-tional settings, often a login is created. A login can later beused as evidence of the identity and role of the agent.

Technically, updates to a normative multiagent systemcan be accounted for as follows: instead of one model, weuse an ordered series of models representing the state of af-fairs for each possible moment in time. In case it is impor-tant to compare different outcomes, a so called branching-time logic like CTL or CTL∗ is used: each possible futurecourse of events is represented by a ‘branch’ of the tree.See [12] for an application of this idea to normative mod-els. Alternatively, we can use linear time models, using thedifferent extensions generated by the recursive game simu-lations as representations of alternative outcomes.

0-7695-2268-8/05/$

The examples above concern a change that takes placewithin a normative system. The system itself remains rela-tively stable. But norms and social structures can evolve too.However, such changes are much more elaborate, and aresubject to restrictions. For instance, a norm must be knownto all agents that are subject to it. Therefore, before a newnorm is established, all agents must be informed. Such re-strictions on the formation of norms can be laid down in asecond normative system. Thus, law scholars like Hart [21]distinguish between primary laws, whose purpose is to di-rect the behavior of citizens, and secondary laws, which,among other functions, serve the maintenance of the norma-tive system. These rules are instrumental to the primary sys-tem, in that they regulate the regulation. For example, art. 2of the Italian Civil Code states: “the creation of laws [...]is regulated by constitutional laws” (Cost. 70). This sub-system, according to Hart, does not include only the rulesof change which specify how new laws are introduced orold ones removed, but it also includes rules about powersfor the private citizen. These rules are at the basis of civilcode and allow testaments and contracts; for Hart they al-low the exercise of limited legislative powers by the citi-zens. These rules do not create or remove general laws, butthey introduce and remove individual obligations and per-missions: e.g., the Italian Civil Code art. 1173 (sources ofobligations) specifies that obligations are created by con-tracts, where a contract is meant as an agreement amongtwo or more parties to regulate a juridical relationship aboutvaluables by art. 1321.

4.3. Constitutive Norms

Regarding institutional change, we must first explainthe distinction between regulative norms and constitutivenorms, that was introduced by Searle in his work on speechacts [36], and further developed in his later work on theconstruction of social reality [37]. Some rules regulate an-tecedently existing forms of behavior. For example, therules of polite table behavior regulate eating, but eating ex-ists independently of these rules. Some rules, on the otherhand, do not merely regulate an antecedently existing activ-ity; they, as it were, create the possibility of or define thatactivity. For example, the activity of playing chess is consti-tuted by the rules of the game. The institutions of marriage,money, and promising are like the institutions of baseballand chess in that they are systems of such constitutive rulesor conventions [36, p. 131]. Within normative multiagentsystems we distinguish between regulative norms that de-scribe obligations, prohibitions and permissions, and consti-tutive norms that regulate the creation of institutional factslike property, marriage and money, as well as the modifica-tion of normative system itself.

20.00 (C) 2005 IEEE 5


Constitutive norms are introduced in our normative mul-tiagent systems for the following three reasons.

First of all, regulative norms are not categorical, but con-ditional: they specify all their applicability conditions. Incase of complex and rapidly evolving systems new situa-tions arise which should be considered in the conditions ofthe norms. Thus, new regulative norms must be introducedeach time the applicability conditions must be extendedto include new cases. In order to avoid changing existingnorms or adding new ones, it would be more economic thatregulative norms could factor out particular cases and re-fer, instead, to more abstract concepts only. Hence, the nor-mative system should include some mechanism to introducenew institutional categories of abstract entities for classify-ing possible states of affairs. Norms could refer to this in-stitutional classification of reality rather than to the com-monsense classification [10]: changes to the conditions ofthe norms would be reduced to changes to the institutionalclassification of reality.

Second, the dynamics of the social order which the nor-mative system aims to achieve is due to the evolution of thenormative system over time, which introduces new norms,abrogates outdated ones, and, changes its institutional clas-sification of reality. So the normative system must spec-ify how the normative system itself can be changed by in-troducing new regulative norms and new institutional cate-gories, and specify by whom the changes can be done.

Third, the dynamics of a normative system also includesthe possibility that ordinary agents create new obligations,prohibitions and permissions concerning specific agents.This activity is particularly important in applications fore-commerce where it is necessary to model contracts whichintroduce new normative relations among agents, like theduty to pay a fee for a service [15, 32].

4.4. Interaction Norms

We are working on extensions of the model to incorpo-rate agent communication languages and dialog games [2].Interaction itself can be seen as governed by a set of norma-tive rules too. Such rules may be formulated in the shape ofa dialog game, e.g., [39, 24, 29]. A dialog game defines theroles of the participants, the repertoire of speech acts, the se-quences of speech acts that are considered well-formed, themeaning that is given to each speech act in terms of the re-sulting effect on the underlying normative system, and theentry and end conditions. Given a message containing a par-ticular speech act, a particular response may be obligatory.For example, a request must be either granted or denied. Acommand must be carried out, at least, when there is an au-thority relationship between the commander and person be-ing commanded. However, to determine what counts as anappropriate response, there is room for interpretation by the

0-7695-2268-8/05/$20

receiver. For example, a remark like “Open the window!”can be taken as a command, or as a suggestion. What kindof interpretation is selected by the receiver, is indicated bythe response. So a response like “good idea!” would signalthat the receiver takes it as a suggestion, and not as a com-mand. Such a response also denies the existence of an au-thority relation. This effect of the receiver influencing thedialog, is called uptake [14]. An preliminary account of up-take was given using the BOID model [23].

5. Contracts and Social Relations

In our approach, the behavior of agents is modeledthrough a number of recursive games. An agent has a pro-file of other agents and of the normative system, and willbase its decisions on the reactions that come out of a sim-ulation of the game using the profiles. Agents in a norma-tive system are subject to obligations. When an agent con-siders the normative system as part of its recursive model-ing, this may influence its behavior. When agents considereach other in the context of a normative system, then obliga-tions can also be directed towards other agents, and not justtowards the normative system [12]. For example, a promisecreates an obligation, not towards society as a whole, whichprovides the normative system against the background ofwhich promises conventionally hold, but towards the spe-cific agent the promise was made to. Such directed obliga-tions almost always coincide with some social relationshipbetween agents, that helps to define a community or an or-ganization. In the case of a promise, that relationship mightbe one of friendship. In the case of a contract, the relation-ship might be a long term trading relation, etc. A contract istypically drawn up by agents that are of equal authority, butthat depend on each other. Although there is an incentiveto honor the contract, there must be a guarantee against op-portunistic behavior. Agents gather power over each otherdue to the directed obligations they can create and delegate.These powers are part of a social reality based on institu-tional facts. The distinction is between agents that are indi-vidually rational, and social agents that are aware of otheragents, set against a background in which the institutionalrelations between agents have been fixed.

A particularly interesting social relationship, is that ofbeing member of the same group. Social agents can oper-ate as a group, team or coalition and have joint goals. Incase there is a joint goal, this generates further obligations.In particular, in addition to the fact that members must havethe goal of completing their part of the task, they are obligedto assist each other and to communicate failure or comple-tion of their part [38]. If a group has collective obligations,this generates the problem of how to distribute these obli-gations over the members of the group [18]. The main is-sue for the agents is how to deal with social laws. A re-

.00 (C) 2005 IEEE 6


lated issue is due to social norms and commitment poli-cies, see e.g. [19]. Moreover, when social norms are insti-tutionalized, then agents can create obligations directed to-wards each other by creating contracts. In human society,the creation and execution of contracts is regulated by con-tract law. In virtual organizations, rules with a similar func-tion should exist, the define the meaning of newly createdor abolished obligations, about violations and possible sanc-tions and about exceptions.

6. Local and Global Policies

In this section we consider normative systems from theviewpoint of other normative systems. Though normativereasoning often assumes a single normative system, as inmoral theory, in reality there are typically many interact-ing normative systems and their relation has to be explainedby any useful model of normative systems. The best exam-ple is legal theory, which is typically based on hierarchiesof norms. There are for example the laws of the EuropeanUnion and of the individual member states, with carefullydelimited areas of jurisdiction. The interaction between nor-mative systems is also important in virtual communities,where we can distinguish between local and global authori-ties. This idea is elaborated in the example below.

6.1. Distributed Access Control

Developments in network technology have raised newproblems concerning the control of peer-to-peer systemsand grid architectures [17]. In these computing paradigmsthere is no central administrator; access to resources is con-trolled at local levels. Participants can take the role of a con-sumer, or of a provider of resources. As a provider, partic-ipants have the power to set their own access policy. If aset of participants wants to form a virtual community toshare resources, local access policies should be organizedaccording to some global policy which specifies how re-sources can be shared. In the traditional client-server ap-proach access policies are controlled by a central author-ity. According to Pearlman et al. “a key problem associatedwith the formation and operation of distributed virtual com-munities is that of how to specify and enforce communitypolicies” [34]. Since there is no plausible way to enforcea global policy by technically constraining a distributed ar-chitecture, a normative system is needed to specify globalpolicies about local policies. Moreover, a mere specifica-tion of what is permitted and what is obligatory is not suf-ficient: “exercise of rights is effective only if the resourceprovider has granted those rights to the community” [34].The normative system must therefore enforce the norms ateach level. Not only users must be given an incentive to re-

0-7695-2268-8/05/$2

?

owneruser

entitle access

request access

storageprovider

Figure 3: User a1 requests access to resource d from storageprovider a2, having been entitled access to d by owner a3

spect the norms, but also the local providers must be moti-vated to issue local policies that respect the global ones.

The following example is taken from Firozabadi and Ser-got [16]. The example hinges on the difference between thepermission and the right to access a resource. Suppose thereare agents a1, a2 and a3, and there is no central access con-trol. In order achieve its purpose p, agent a1 wants to accessa resource d which is stored remotely, in control of agent a2.Now suppose a2 does not at the moment permit a1 to accessthe resource. When a1 requests permission to access the re-source, a2 will have to make a decision, based on its localaccess policies combined with the global access policies.

There are several possible scenarios:

1. Suppose a1 is (globally) permitted to access resourced, but there is no obligation on a2 to (locally) grantthat access. That means a2 will not violate any policyregardless of whether it grants or denies the access.

In our model, the decision depends entirely on theindividual desires and goals of the local authority. Ifthe local authority has a desire to limit the data traf-fic, for example, it might choose to deny access.

2. Suppose a1 is not only permitted to access d, but isalso entitled to it. This means that a2 has an obligationto grant access whenever a1 requests it. This may hap-pen when a1 is the owner of d, or when d is owned byanother agent a3 and a3 has entitled a1 to access d ona2 (Figure 3).

Consider the case in which a1 claims to be theowner. First, a2 must establish whether a1 really doescount as the owner of d. It will need some evidencethat constitutes the identity of a1. For example, theglobal authority may issue ownership certificates. Sec-ond, a2 must establish whether or not denying accesswill count as a violation. If so, it must establish if thechances of getting detected and the severity of the cor-responding sanction, outweigh the benefit of not grant-ing access. To this end, it will employ a version of re-cursive modeling. If a2 decides to grant access, it mustperform a social act that counts as the permission fora1 to access d, and that also enables a1 to physicallyaccess the data.

0.00 (C) 2005 IEEE 7


Consider the case in which a1 claims to have beenentitled by owner a3 to access d. Amongst other things,it must be specified which speech acts constitute an en-titlement. In one possible set-up, the owner may orderthe local authority to grant an agent access for a pe-riod of time. In that case the local authority must verifythe authenticity of the order, and store the details. Thepower for owners to entitle agents’ access is guaran-teed by the global normative system. Everything elseis handled locally. In another set-up, the owner maycreate an institutional fact that counts as evidence ofthe agent being entitled access, similar to the identitycertificates discussed above. In this case, both the ev-idence and the obligation for local authorities to grantaccess, are guaranteed by the global normative system.

3. Suppose a1 has no permission to access d, so a2 isglobally forbidden to grant a1 access. Such a prohibi-tion is represented by rules specifying what counts aviolation, and by a sanctioning goal for the global nor-mative system. Since a2 physically controls access, itmay still grant a1 access. This may happen for exam-ple, when a2 has desires or goals, that would make itbeneficial to grant access, and the chances of being de-tected and sanctioned are small. Bribes fall into thiscategory, as well as kind librarians that want to helpout a student with no library card.

This brief exposition indicates, that in principle the con-ceptual model of normative multiagent systems is richenough to capture the crucial aspects of the scenar-ios. Moreover, all of the concepts (agents, roles, regula-tive norms, constitutive norms, speech acts) are neededto cover some aspect of the scenario. So on first sight,the model is not too rich either. Having said that, we re-alize that a proper empirical validation of the use of themodel for designing and evaluating distributed access con-trol systems, would require a detailed field study.

Note furthermore, that for many applications, the kindof rational deliberation shown by the agents in assessingthe normative system’s ability to detect and sanction a vio-lation, is not necessary. In that case, norm abiding behavioris ‘hard-wired’ into the application [12].

7. Conclusions

We conclude by summarizing the advantages of our con-ceptual model. As discussed above, our model is based on apartial unification of computer systems and normative sys-tems, both called agents. It is this partial unification thatclarifies their relation, and the distinctions. The second,third and fourth advantage have first been observed in [6].The advantages are as follows.

0-7695-2268-8/05/$2

1. The complex structural relation between agents andnormative systems has been decomposed into four sep-arate relations, which each can be studied on theirown: normative systems viewed from the perspectiveof an individual agent, individual agents viewed fromthe perspective of normative systems, the view fromagents towards other agents in the context of a norma-tive system, and the view of normative systems fromthe perspective of other normative systems. This pointhas not been discussed in our framework before.

2. The behavior of agents and normative systems can bemodeled as recursive games between agents in a stan-dard game theory. It has been shown in [7] that manysubtle forms of fraud and deception can be modeled inthis way.

3. Obligations can be modeled in the standard BDI set-ting using the metaphor “Your wish is my command”.Thus, the wishes of a normative agent become com-mands for the subjects of the normative system. Thiscan be explained using the social delegation metaphor.

4. The model allows a distinction to be made betweenviolability and sanctions. Behavior which counts as aviolation is distinguished from behavior that is sanc-tioned. The normative system may autonomously de-cide which behavior counts as a violation, and whetherviolations are sanctioned.

5. The model captures several kinds of dynamics of a nor-mative system. Our model combines the dynamics ofnormative systems with the dynamics of multiagentsystems, and explains what roles an agent can play inthe dynamics of normative systems.

6. The model can capture the most important aspects ofdialogue games, i.e., roles of participants, dialoguegame rules (conditional obligations) and the statusof the dialogue context (institutional facts). However,more research is needed to fully incorporate dialoguegames into normative multiagent systems.

We believe that this conceptual model of virtual organi-zations as normative multiagent systems may have impor-tant consequences for the design and evaluation of virtualorganizations. Crucial is that norms are dealt with explicitly,and that system designs do not assume that norms – proto-cols, standards, contracts – will automatically be obeyed.Norms will almost certainly be violated if there is an incen-tive to do so. And since virtual organizations are open sys-tems, in the sense that they are inhabited by both humanand artificial agents of whom nothing may be known in ad-vance, it is better to be prepared. Modeling violations ex-plicitly makes it possible to design countermeasures.

0.00 (C) 2005 IEEE 8


References

[1] J.L. Austin. How to do things with words. Harvard Univer-sity Press, Cambridge Mass., 1962.

[2] G. Boella, J. Hulstijn, and L. van der Torre. Persuasion strate-gies in dialogue. In F. Grasso and C. Reed, editors, Proceed-ings of the ECAI workshop on Computational Models of Nat-ural Argument (CMNA’04), Valencia., 2004.

[3] G. Boella and L. Lesmo. A game theoretic approach tonorms. Cognitive Science Quarterly, 2(3-4):492–512, 2002.

[4] G. Boella and L. van der Torre. Contracts as legal institu-tions in organizations of autonomous agents. In Proceedingsof the Third International Joint Conference on Autonomous,Agents and Multi Agent Systems (AAMAS’04), 2004.

[5] G. Boella and L. van der Torre. Regulative and constitutivenorms in normative multiagent systems. In Procs. of 9th In-ternational Conference on the Principles of Knowledge Rep-resentation and Reasoning, Whistler (CA), 2004.

[6] G. Boella and Leendert W. N. van der Torre. Attributingmental attitudes to normative systems. In Proceedings ofthe Third International Joint Conference on Autonomous,Agents and Multi Agent Systems (AAMAS’04), pages 942–943, 2003.

[7] G. Boella and Leendert W. N. van der Torre. Normative mul-tiagent systems. In Proceedings of the AAMAS-workshop onTrust in Agent Societies (TRUST’04), 2004.

[8] Bratman. Intentions, plans, and practical reason. HarvardUniversity Press, Harvard (Massachusetts), 1987.

[9] H.-J. Brckert, K. Fischer, and G. Vierke. Holonic transportscheduling with TeleTruck. Applied Artificial Intelligence,14(7):697725, 2000.

[10] J. Breuker, A. Valente, and R. Winkels. Legal ontologes: Afunctional view. In Proceedings of the 1st Workshop on Le-gal Ontologies (LegOnt), page 2336, 1997.

[11] J. Broersen, M. Dastani, J. Hulstijn, and L. van der Torre.Goal generation in the BOID architecture. Cognitive ScienceQuarterly, 2(3-4):428–447, 2002.

[12] J. Broersen, M. Dastani, J. Hulstijn, and L. van der Torre.Specifying multiagent organizations. In Proceedings ofDEON’04, 2004.

[13] Cristiano. Castelfranchi. Modelling social actions for aiagents. Artificial Intelligence, 103:157–182, 1998.

[14] Herbert H. Clark. Using Language. Cambridge UniversityPress, Cambridge, 1996.

[15] Chrysanthos Dellarocas. Analyzing the economic efficiencyof ebay-like online reputation reporting mechanisms. In Pro-ceedings of the 3rd ACM conference on Electronic Com-merce, pages 171 – 179. ACM, 2001.

[16] B. S. Firozabadi and M. Sergot. Contractual access control.In Procseedings of the 10th International Workshop on Se-curity Protocols, 2002.

[17] I. Foster, C. Kesselman, and S. Tuecke. The anatomy of thegrid: Enabling scalable virtual organizations. InternationalJournal of Supercomputer Applications, 15(3):?–?, 2001.

[18] D. Grossi, F. Dignum, L. Royakkers, and J-J. Ch. Meyer.Collective obligations and agents: Who gets the blame? InProceedings of DEON’04, 2004.

0-7695-2268-8/05/$

[19] B. J. Grosz, S. Kraus., D. G. Sullivan, and S. Das. The in-fluence of social norms and social consciousness on inten-tion reconsiliation. Artificial Intelligence, 142(2):147–177,2002.

[20] B. Hansson. An analysis of some deontic logics. Nous,3:373–398, 1969.

[21] H. L. A. Hart. The Concept of Law. Clarendon Press, Ox-ford, 1961.

[22] Will Hill, Larry Stead, Mark Rosenstein, and George Furnas.Recommending and evaluating choices in a virtual commu-nity of use. In Proceedings of the SIGCHI conference onHuman factors in computing systems (CHI-95), pages 194 –201. ACM, 1995.

[23] J. Hulstijn and N. Maudet. Uptake by conditional obliga-tions. In P. Dekker and R. van Rooy, editors, Proceedingsof the 14th Amsterdam Colloquium, pages 141 – 146. ILLC,University of Amsterdam, 2003.

[24] Joris Hulstijn. Dialogue Models for Inquiry and Transac-tion. PhD thesis, University of Twente, Enschede, 2000.

[25] A.J.I. Jones and M. Sergot. A formal characterisation of in-stitutionalised power. Journal of the Interest Group in Pureand Applied Logic, 3:427–443, 1996.

[26] Ronald M. Lee. Bureaucracies as deontic systems. ACMTransactions on Information Systems, 6(2):87 – 108, 1988.

[27] D. Makinson and L. van der Torre. Input/output logics. Jour-nal of Philosophical Logic, 29:383–408, 2000.

[28] D. Makinson and L. van der Torre. Constraints for in-put/output logics. Journal of Philosophical Logic, 30:155–185, 2001.

[29] Peter McBurney and Simon Parsons. Games that agents play:A formal framework for dialogues between autonomousagents. Journal of Logic, Language and Information,11(3):315–334, 2002.

[30] J.-J. Meyer and R. Wieringa. Deontic Logic in Computer Sci-ence: Normative System Specification. John Wiley & Sons,1993.

[31] Scott Moss, Helen Gaylard, Steve Wallis, and Bruce Ed-monds. SDML: A multi-agent language for organizationalmodelling. Computational and Mathematical OrganizationTheory, 4(1):43–70, 1998.

[32] S. Neal, J. Cole, P. F. Linington, Z. Milosevic, S. Gibson, andS. Kulkarni. Identifying requirements for business contractlanguage: a monitoring perspective. In Proceedings of theSeventh International Enterprise Distributed Object Com-puting Conference (EDOC03), page 5062. IEEE press, 2003.

[33] H. Van Dyke Parunak. A practitioners’ review of industrialagent applications. Autonomous Agents and Multi-Agent Sys-tems, 3(4):389–407, 2000.

[34] L. Pearlman, V. Welch, I. Foster, C. Kesselman, andS. Tuecke. A community authorization service for group col-laboration. In Proceedings of the IEEE 3rd InternationalWorkshop on Policies for Distributed Systems and Networks(POLICY’02), pages 50–59. IEEE Press, 2002.

[35] Anand S. Rao and Michael P. Georgeff. Modeling ratio-nal agents within a BDI-architecture. In J. Allen, R. Fikes,and E. Sandewall, editors, Proceedings of the InternationalWorkshop on Knowledge Representation (KR91), pages 473–484. Morgan Kaufmann, San Mateo CA, 1991.

20.00 (C) 2005 IEEE 9


[36] John R. Searle. Speech acts: an Essay in the Philosophy ofLanguage. Cambridge University Press, Cambridge, 1969.

[37] J.R. Searle. The Construction of Social Reality. The FreePress, New York, 1995.

[38] R. Tuomela. Cooperation: A Philosophical Study. KluwerAcademic Pulishers, Dordrecht, 2000.

[39] D. N. Walton and E. C. Krabbe. Commitment in Dialogue:Basic Concepts of Interpersonal Reasoning. State Univer-sity of New York Press, 1995.

0-7695-2268-8/05/$20.00 (C) 2005 IEEE 10

Date post:	11-May-2023
Category:	Documents
Upload:	uni-lu
View:	0 times
Download:	0 times

Virtual Organizations as Normative Multiagent Systems

Documents