High above the Vispa valley in the Swiss canton of Valais sits Törbel, a village of sun-browned wooden chalets and about six hundred people. Its parish records run back to 1224. In 1483, its families signed a charter establishing an association to govern the things no family could own alone: the alpine meadows, the forests, the irrigation channels that carried glacier water to the fields. The charter’s most famous rule fits in a sentence: no citizen may send more cows to the summer alp than he can feed through the winter.
Think about what that rule is doing. It ties a person’s claim on the common pasture to work the whole village can verify, because every neighbor knows how much hay you cut; they watched you cut it. It makes overreach visible, cheap to catch, and embarrassing. And it has kept the alp green for five hundred and forty years.
When the anthropologist Robert Netting arrived in 1970 to study the village, colleagues asked why an Africanist was going to Switzerland. His answer became Balancing on an Alp (1981), a portrait of a community that had managed a fragile shared resource, without a landlord and without a state, for half a millennium. And Netting’s work caught the attention of a political scientist named Elinor Ostrom, who was assembling something unusual: an empirical catalog of commons that had not ended in tragedy.
The third option
The standard story was set in 1968, when Garrett Hardin published “The Tragedy of the Commons.” Every herdsman on a shared pasture, Hardin argued, captures the full gain of adding one more animal while the cost of overgrazing is spread across everyone. So each adds another, and another, and the pasture dies. The failure he described is real, and no one watching an unmanaged commons today needs convincing. But his prescription hardened into policy orthodoxy for a generation: a commons must be either privatized or nationalized, because the people who use it cannot be trusted to govern it. Törbel’s meadow has never been privatized, has never been nationalized, and has never collapsed.
Ostrom’s response was to go look. Törbel’s meadows. The mountain commons of Hirano and Nagaike in Japan. The huerta irrigation communities of Valencia, whose water court has convened at the cathedral’s Apostles’ Gate every Thursday at noon for roughly a thousand years, and is often called the oldest functioning court on earth. Fisheries, forests, groundwater basins. Again and again she found the third option Hardin’s model said couldn’t exist: communities governing shared resources themselves, with no owner and no ministry, for centuries at a stretch. Governing the Commons (1990) distilled what the survivors had in common, and in 2009 the work won the Nobel Memorial Prize in economics.
Her famous distillation is eight design principles. Compressed brutally: boundaries: it is clear who is a member of the community and what the resource is; fit: rules match local conditions rather than a template; collective choice: the people affected by the rules can change them; monitoring: done by community members accountable to the community, not by outsiders; graduated sanctions: a first violation draws a warning, not exile; conflict resolution: cheap, fast, and local; the right to organize: outside authorities let the arrangement stand; and nesting: small units federate into larger ones rather than dissolving into them.
Note what the principles are made of. Not incentives, exactly, and not technology at all. They are answers to four questions any shared resource forces: who is inside, who watches, what watching costs, and what happens when someone takes too much. Answer them well and you have the third option. Leave them unanswered and you have Hardin’s pasture.
The pasture made of trust
Here is the claim this essay exists to make: a community’s reputation is a common-pool resource, and it behaves exactly the way Ostrom said such resources behave.
A common-pool resource has two defining properties. It is hard to fence: many people can draw on it. And it is subtractable: what one person takes is genuinely gone, at least for a while. A community’s collective credibility fits both. When any member vouches, endorses, certifies, or signs, they are drawing on a shared stock of believability that the whole community built. And every hollow claim grazes it down. The pasture doesn’t die when one cow overgrazes; it dies when overgrazing becomes free.
Once you see reputation this way, the last fifteen years of internet reputation systems reorganize themselves into a set of commons failures so clean they could be teaching cases.
LinkedIn endorsements are the overgrazed meadow. In 2012 LinkedIn shipped the exact concept, peers attesting each other’s skills, atop the largest professional network on earth. But endorsing cost one click and nothing else, and the algorithm actively prompted it. Reciprocity spam followed within months: strangers endorsing strangers for skills no one had witnessed. Recruiters learned to ignore the feature within about a year, and it has been decorative ever since. Free grazing; dead pasture. The written recommendation, costly and specific and signed in full sentences, still carries modest weight on the very same platform, which tells you the failure was never the idea. It was the price.
Grade inflation is the same failure inside the university. An A is a claim drawn on the institution’s collective credibility. When professors stopped paying any reputational cost for granting them, the A’s multiplied and the transcript quietly died as a signal. Meanwhile the admissions gate, which stayed ruthlessly guarded, kept the brand alive. One commons inside the institution was governed; the other was grazed to mud.
And Klout was the enclosure movement. From 2008 to 2018, Klout computed a 0-to-100 influence score for hundreds of millions of people, most of whom never asked. It extracted reputation from every context at once and fused it into a single portable number, and it earned gaming, mockery, and a resentment deep enough to become its obituary. The sharpest post-mortem said, in essence, that reputation is the residue of action and belongs to the context where the action happened; strip it out of that context and it means nothing. Ostrom’s first principle, the boundary, said the same thing decades earlier from the other direction. A commons is governable because it has an inside.
Different platforms, different decades, one diagnosis. These systems didn’t fail for lack of users, capital, or cryptographic sophistication. They failed because nobody governed the pasture.
The natural experiment
Then, starting around 2016, the internet ran the largest commons-governance experiment since Hardin’s essay. Thousands of them, in public, at speed, with real money.
Decentralized autonomous organizations deserve a more honest telling than they usually get. Strip away the coin-press cynicism that attached to the era and the ambition was almost precisely Ostrom’s question: can a community govern a shared resource (a treasury, a protocol, a collective project) without a corporation above it or a state behind it? Tens of thousands of people joined in good faith. Real treasuries, in aggregate worth billions, were placed under genuinely collective control. Some jurisdictions even created new legal forms to let these communities hold property and sign contracts; a real institutional innovation, and worth keeping.
But the first generation built its governance from the design vocabulary it had inherited, which came from corporate finance: shares and votes. And measured against the eight principles, the standard design was not a partial violation. It was a near-perfect inversion.
Influence was linearly purchasable. One token, one vote, means the price of a governance outcome is quoted on an exchange. This is not a bug that crept in; it is the first-order property of the design.
There was no boundary. Anyone holding the token was a “member,” anonymously, instantly, with no distinction between a founder of five years and an arbitrageur of five minutes. Ostrom’s first principle, the one Törbel wrote down in 1483, was absent by construction. No inside means no context, nothing at stake, and no way to tell a neighbor from an opportunist.
Voting was costless, so almost nobody voted. Studies of the era’s governance found turnout on most proposals running in the low single digits; even flagship protocols struggled to bring a tenth of their tokens to a vote. The vacuum filled with delegation to whoever asked: governance capture without governance activity. Monitoring by accountable community members, Ostrom’s fourth principle, requires monitors who exist.
And there was no wall between reputation and speculation. When the governance instrument is also a tradable asset, every vote is also a position. A community cannot deliberate about its long-term good in an instrument its members are simultaneously day-trading.
The failure modes were structural, not cultural, which is why they arrived on schedule regardless of how idealistic any particular community was.
The cleanest demonstration took thirteen seconds.
On April 17, 2022, a lending protocol called Beanstalk was governed by token vote, with an emergency mechanism allowing a two-thirds supermajority to execute a proposal instantly. An attacker had submitted two proposals the day before: one, prominently, a $250,000 donation to Ukraine relief; the other containing the code that mattered. Then he borrowed roughly a billion dollars through a flash loan, a DeFi instrument in which the loan is taken and repaid inside a single transaction. For the length of that transaction, about one Ethereum block, roughly thirteen seconds, he held a supermajority of Beanstalk’s governance. He voted, passed his own proposal, transferred $182 million out of the protocol, repaid the loan, and kept about $80 million, before most members knew a vote had occurred.
Resist the urge to file this under crime. The contract executed exactly as written. The vote was legitimate under the constitution the community had adopted. Beanstalk’s members were not fools, and their loss deserves sympathy, not a smirk; many were volunteers who believed in the project and were left holding a collapsed token. What failed them was a governance design under which a thirteen-second member, with no name, no history, and no work witnessed by anyone, could hold more standing than everyone who had built the thing combined. Hardin’s herdsman needed a season to ruin the pasture. Composable finance got it down to one block.
Ostrom’s principles, violated wholesale, at speed, in public.
What the survivors would build
The temptation after Beanstalk is to conclude that online communities can’t govern shared value at all: Hardin’s conclusion, freshly reheated. That reading gets the evidence exactly backwards. Törbel is five hundred years of counterexample; the huertas are a thousand. The first generation of internet commons didn’t disprove Ostrom. It replicated, at unprecedented cost and documentation quality, her account of what happens when the principles are ignored. Which means the design brief for a second generation is not mysterious. It is sitting in a book from 1990, and each violation has an answer.
Earned influence. The answer to purchasable influence is not to banish money. Ostrom never pretended markets away, and neither should we; her communities traded constantly (hay, water turns, labor) while keeping governance anchored in membership and contribution. The design translation: money can participate, but it cannot dominate. Recent mechanism-design work has made this precise. Puja Ohlhaver’s research on community currencies, itself built consciously on Ostrom, shows how influence can grow sublinearly with committed stake: the tenth unit buys far less voice than the first, so concentrated capital flattens into diminishing returns. Add commitments that are permanent and non-transferable, stakes a member locks for good as a lasting bond to one community, and you get something capital cannot retroactively acquire: time. A patient contributor’s years of standing become a governance position a wealthy newcomer can approach only slowly, on the community’s terms. Purchased influence can exist in such a system; it simply arrives bounded, dampened, and subordinate to the earned kind.
The boundary. The boundary is the collateral. A community with a real membrane, legible membership, doors the community itself controls, recovers everything Beanstalk lacked: context, stakes, and the ability to tell a member from a visitor. And standing earned inside a boundary should stay scoped to it, because that is where the witnesses are. This is Klout’s lesson read forward: portability of reputation, where it ever comes, will arrive the way it always has, through federations of communities that trust each other’s rules (Ostrom’s nested enterprises), not through a universal number.
Witnessed weight. Make voting weight something that had to be earned by doing witnessed work, and the electorate changes: the votes are cast by the people who did the work, each with standing to lose. This is also where Ostrom’s monitors reappear in modern dress. Peer attestation, members vouching for specific work they saw, is monitoring by accountable community members almost word for word. It is worth being precise about what makes the monitors accountable, because there is no automated punishment waiting behind them, and there shouldn’t be. The accountability is the membrane’s own economics. Every signature is visible inside the boundary, so a hollow one is a public act among the people best positioned to know it was hollow. And everything a signer holds, standing and stake alike, is denominated in the community’s credibility: debase the commons and you have debased your own account in it. A protocol that slashed automatically would be more dramatic, and less Ostrom. Her fifth principle assigns sanctions to the community, graduated and fitted to the offense, precisely because the village knows things no formula does. Törbel ran this exact design: your claim on the alp was tied to hay your neighbors watched you cut, and the punishment for cheating was theirs to choose.
The firewall. Make it absolute. The moment attesting to a neighbor’s work earns the attester anything financial, testimony becomes advertising and the commons begins to consume itself. So the rule is easy to state. A community’s currency can be traded, priced, even speculated on. Its testimony cannot, because attesting earns nothing, ever, and a signature is the one thing money cannot place. Markets get the currency. The commons keeps the witness.
None of this is speculative institutional design. It is amonng the oldest institutional design we have records of, restated for communities whose pasture is trust.
The instruments have caught up. Records can now outlive any platform, and verification can be performed by anyone. For the first time, a Törbel-shaped institution can hold together among people who do not share a valley.
The evidence, too, has caught up. The first generation of internet reputation systems and on-chain governance experiments failed in public, block by block. The second generation’s designs will be tested the same way: in participation rates, in collusion attempts, in what real communities actually do with real boundaries.
Ostrom would have insisted on nothing less. Her whole career was a rebuke to armchair conclusions about what communities cannot do.
Thirteen seconds and five hundred years are both now data points in the same ledger. The village above the Vispa valley never heard of a flash loan, but it would have understood the attack instantly: a stranger arrived with a vast herd, grazed the alp bare in one afternoon, and left before dark. And it would have understood the remedy too, because it wrote the remedy down in 1483. Know who is in the village. Tie every claim to work the neighbors witnessed. Make the watching cost something and the overreach cost more. Let the village make its own rules, and let villages federate without dissolving.
Reputation is a commons, and Ostrom told us how commons survive.