Skip to content
Delegation Risk

Bibliography & References

Works the framework builds on, by domain. Pages cite further sources inline.

AI safety and agent security

Section titled “AI safety and agent security”
  • Greenblatt, R., Shlegeris, B., Sachan, K., & Roger, F. (2023). AI Control: Improving Safety Despite Intentional Subversion. arXiv:2312.06942; ICML 2024. The source of the trusted/untrusted vocabulary used here.
  • Bhatt, A., et al. (2025). Ctrl-Z: Controlling AI Agents via Resampling. arXiv:2504.10374. The first control evaluation in an agent environment.
  • Sandoval, A., & Rushing, C. (2025). Factor(T,U): Factored Cognition Strengthens Monitoring of Untrusted AI. arXiv:2512.02157.
  • Schoen, B., et al. (2025). Stress Testing Deliberative Alignment for Anti-Scheming Training. arXiv:2509.15541.
  • Debenedetti, E., et al. (2025). Defeating Prompt Injections by Design (CaMeL). arXiv:2503.18813.
  • Beurer-Kellner, L., et al. (2025). Design Patterns for Securing LLM Agents against Prompt Injections. arXiv:2506.08837.
  • Goel, S., et al. (2025). Great Models Think Alike and this Undermines AI Oversight. arXiv:2502.04313.
  • Kim, E., Garg, A., Peng, K., & Garg, N. (2025). Correlated Errors in Large Language Models. arXiv:2506.07962.
  • Kwa, T., et al. (2025). Measuring AI Ability to Complete Long Software Tasks. arXiv:2503.14499.
  • Clymer, J., Gabrieli, N., Krueger, D., & Larsen, T. (2024). Safety Cases: How to Justify the Safety of Advanced AI Systems. arXiv:2403.10462.
  • Drexler, K.E. (2019). Reframing Superintelligence: Comprehensive AI Services as General Intelligence. Technical Report #2019-1, Future of Humanity Institute. PDF.
  • Gwern (2016). Why Tool AIs Want to Be Agent AIs. gwern.net.
  • Dalrymple, D., et al. (2024). Towards Guaranteed Safe AI. arXiv:2405.06624.
  • Tegmark, M., & Omohundro, S. (2023). Provably Safe Systems: The Only Path to Controllable AGI. arXiv:2309.01933.
  • Christiano, P., Shlegeris, B., & Amodei, D. (2018). Supervising Strong Learners by Amplifying Weak Experts. arXiv:1810.08575.
  • Bowman, S.R., et al. (2022). Measuring Progress on Scalable Oversight for Large Language Models. arXiv:2211.03540.
  • Bai, Y., et al. (2022). Constitutional AI: Harmlessness from AI Feedback. arXiv:2212.08073.
  • Engels, J., Baek, D.D., Kantamneni, S., & Tegmark, M. (2025). Scaling Laws For Scalable Oversight. arXiv:2504.18530.
  • Nasr, M., Carlini, N., et al. (2025). The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections. arXiv:2510.09023.
  • Willison, S. (2025). The lethal trifecta for AI agents: private data, untrusted content, and external communication. simonwillison.net, 16 June 2025.
  • Meta (2025). Agents Rule of Two: A Practical Approach to AI Agent Security. ai.meta.com, 31 October 2025.
  • Hadfield-Menell, D., & Hadfield, G.K. (2019). Incomplete Contracting and AI Alignment. AIES ‘19. arXiv:1804.04268.
  • Kolt, N. (2026). Governing AI Agents. Notre Dame Law Review 101, 335. arXiv:2501.07913. Agency law and principal–agent theory applied to AI agents.

Frontier safety frameworks and regulation

Section titled “Frontier safety frameworks and regulation”
  • Anthropic (2026). Responsible Scaling Policy, Version 3.0. Announcement, 24 February 2026.
  • European Commission (2025). Guidelines for providers of general-purpose AI models. digital-strategy.ec.europa.eu. Obligations apply from 2 August 2025; enforcement powers from 2 August 2026.
  • State of California (2025). SB 53, Transparency in Frontier Artificial Intelligence Act. Signed 29 September 2025. Announcement.

Reliability engineering and nuclear safety

Section titled “Reliability engineering and nuclear safety”
  • Mosleh, A., Fleming, K.N., Parry, G.W., et al. (1988). Procedures for Treating Common Cause Failures in Safety and Reliability Studies. NUREG/CR-4780, US Nuclear Regulatory Commission. The beta-factor and related common-cause models.
  • Knight, J.C., & Leveson, N.G. (1986). An Experimental Evaluation of the Assumption of Independence in Multiversion Programming. IEEE Transactions on Software Engineering, 12(1), 96–109.
  • Avizienis, A. (1985). The N-Version Approach to Fault-Tolerant Software. IEEE Transactions on Software Engineering.
  • Reason, J. (1990). Human Error. Cambridge University Press. The account of layered defenses later popularized as the “Swiss cheese” model.
  • Vesely, W.E., et al. (1981). Fault Tree Handbook. NUREG-0492, US Nuclear Regulatory Commission. PDF.
  • Rasmussen, N.C., et al. (1975). Reactor Safety Study (WASH-1400). US Atomic Energy Commission.
  • US NRC (1990). Severe Accident Risks: An Assessment for Five US Nuclear Power Plants (NUREG-1150).
  • IAEA (2006). Fundamental Safety Principles (Safety Fundamentals No. SF-1).
  • ISO 26262:2018. Road vehicles: Functional safety.
  • D’Ambrosio, J., & Debouk, R. (2013). ASIL Decomposition: The Good, the Bad, and the Ugly. SAE Technical Paper 2013-01-0195.

Economics: agency and mechanism design

Section titled “Economics: agency and mechanism design”
  • Jensen, M.C., & Meckling, W.H. (1976). Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure. Journal of Financial Economics, 3(4), 305–360. The source of “agency cost”.
  • Holmström, B. (1979). Moral Hazard and Observability. Bell Journal of Economics, 10(1), 74–91. The informativeness principle behind monitoring.
  • Holmström, B. (1982). Moral Hazard in Teams. Bell Journal of Economics, 13(2), 324–340. Relative performance evaluation as a filter for common shocks.
  • Holmström, B., & Milgrom, P. (1991). Multitask Principal-Agent Analyses: Incentive Contracts, Asset Ownership, and Job Design. Journal of Law, Economics, & Organization, 7 (special issue), 24–52. Incentives on measured tasks divert effort from unmeasured ones; constraints substitute for incentives.
  • Holmström, B. (1984). On the Theory of Delegation. In M. Boyer & R. Kihlstrom (Eds.), Bayesian Models in Economic Theory, 115–141. North-Holland. Delegation without transfers as the choice of a permitted set.
  • Alonso, R., & Matouschek, N. (2008). Optimal Delegation. Review of Economic Studies, 75(1), 259–293. When the optimal permitted set is an interval.
  • Kreps, D.M., & Wilson, R. (1982). Reputation and Imperfect Information. Journal of Economic Theory, 27(2), 253–279. Why a bad type imitates a good one while observed.
  • Sobel, J. (1985). A Theory of Credibility. Review of Economic Studies, 52(4), 557–573. Building, and cashing in, a reputation for reliable advice.
  • Sappington, D. (1983). Limited Liability Contracts between Principal and Agent. Journal of Economic Theory, 29(1), 1–21.
  • Tirole, J. (1986). Hierarchies and Bureaucracies: On the Role of Collusion in Organizations. Journal of Law, Economics, & Organization, 2(2), 181–214.
  • Bolton, P., & Dewatripont, M. (2005). Contract Theory. MIT Press.
  • Myerson, R.B. (1979). Incentive Compatibility and the Bargaining Problem. Econometrica, 47(1), 61–73. The revelation principle for Bayesian settings.
  • Vickrey, W. (1961); Clarke, E.H. (1971); Groves, T. (1973). The papers behind the VCG mechanism (Journal of Finance; Public Choice; Econometrica).
  • Shapley, L.S. (1953). A Value for n-Person Games. In Contributions to the Theory of Games II.

Insurance and ambiguity

Section titled “Insurance and ambiguity”
  • Arrow, K.J. (1963). Uncertainty and the Welfare Economics of Medical Care. American Economic Review, 53(5), 941–973.
  • Shavell, S. (1979). On Moral Hazard and Insurance. Quarterly Journal of Economics, 93(4), 541–562.
  • Ellsberg, D. (1961). Risk, Ambiguity, and the Savage Axioms. Quarterly Journal of Economics, 75(4), 643–669.
  • Gilboa, I., & Schmeidler, D. (1989). Maxmin Expected Utility with Non-Unique Prior. Journal of Mathematical Economics, 18(2), 141–153.
  • Hogarth, R.M., & Kunreuther, H. (1989). Risk, Ambiguity, and Insurance. Journal of Risk and Uncertainty, 2(1), 5–35.
  • Kunreuther, H., Hogarth, R., & Meszaros, J. (1993). Insurer Ambiguity and Market Failure. Journal of Risk and Uncertainty, 7(1), 71–87.
  • Verisk (2026). ISO generative-AI exclusion endorsements CG 40 47, CG 40 48 and CG 35 08, edition date January 2026, optional. Reported by Independent Agent, October 2025.
  • Insurance Journal (2025). Report on the launch of the Artificial Intelligence Underwriting Company, 25 July 2025. The AIUC-1 standard, audits and insurance for AI agents.

Financial risk measurement

Section titled “Financial risk measurement”
  • Artzner, P., Delbaen, F., Eber, J.-M., & Heath, D. (1999). Coherent Measures of Risk. Mathematical Finance.
  • Acerbi, C., & Tasche, D. (2002). On the Coherence of Expected Shortfall. Journal of Banking & Finance.
  • Tasche, D. (2008). Capital Allocation to Business Units and Sub-Portfolios: the Euler Principle. arXiv:0708.2542.
  • Litterman, R. (1996). Hot Spots and Hedges. Journal of Portfolio Management.
  • Jorion, P. (2006). Value at Risk (3rd ed.). McGraw-Hill.

Security engineering

Section titled “Security engineering”
  • Saltzer, J.H., & Schroeder, M.D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE.
  • Dennis, J.B., & Van Horn, E.C. (1966). Programming Semantics for Multiprogrammed Computations. Communications of the ACM.
  • Miller, M.S. (2006). Robust Composition. PhD thesis, Johns Hopkins University. Capability-based security.
  • Lamport, L., Shostak, R., & Pease, M. (1982). The Byzantine Generals Problem. ACM TOPLAS.
  • Microsoft (2024). 2024 State of Multicloud Security Risk Report. PDF. The source of the ~2% permissions-used figure.
  • Beyer, B., et al. (2016). Site Reliability Engineering. O’Reilly. Online. Error budgets.

How to cite this site

Section titled “How to cite this site”

Gooen, O. (2026). Delegation Risk. Quantified Uncertainty Research Institute. https://delegation-risk.quantifieduncertainty.org/

@misc{gooen2026delegationrisk,
  author       = {Gooen, Ozzie},
  title        = {Delegation Risk},
  year         = {2026},
  publisher    = {Quantified Uncertainty Research Institute},
  howpublished = {\url{https://delegation-risk.quantifieduncertainty.org/}}
}

Cite a specific page by its URL and the date you accessed it; pages change.