High above the Vispa valley in the Swiss canton of Valais sits Törbel, a village of sun-browned wooden chalets and about six hundred people. Its parish records run back to 1224. In 1483 its families signed a charter establishing an association to govern the things no family could own alone: the alpine meadows, the forests, the irrigation channels that carried glacier water to the fields. The charter’s most famous rule fits in a sentence: no citizen may send more cows to the summer alp than he can feed through the winter.
The rule ties a person’s claim on the common pasture to work the whole village can verify, because every neighbor knows how much hay you cut; they watched you cut it. Overreach becomes visible, cheap to catch, and embarrassing. The alp has stayed green for five hundred and forty years.
When the anthropologist Robert Netting arrived in 1970, colleagues asked why an Africanist was going to Switzerland. His answer became Balancing on an Alp (1981), a portrait of a community that had managed a fragile shared resource without a landlord or a state for half a millennium. It caught the attention of a political scientist named Elinor Ostrom, who was assembling something unusual: an empirical catalog of commons that had not ended in tragedy.
The third option
The standard story was set in 1968, when Garrett Hardin published “The Tragedy of the Commons.” Every herdsman on a shared pasture, Hardin argued, captures the full gain of adding one more animal while the cost of overgrazing is spread across everyone. So each adds another, and the pasture dies. The failure is real. But his prescription hardened into policy orthodoxy for a generation: a commons must be either privatized or nationalized, because the people who use it cannot be trusted to govern it. Törbel’s meadow has never been privatized, never been nationalized, and never collapsed.
Ostrom’s response was to go look. Törbel’s meadows. The mountain commons of Hirano and Nagaike in Japan. The huerta irrigation communities of Valencia, whose water court has convened at the cathedral’s Apostles’ Gate every Thursday at noon for roughly a thousand years. Fisheries, forests, groundwater basins. Again and again she found the third option Hardin’s model said couldn’t exist: communities governing shared resources themselves, with no owner and no ministry, for centuries at a stretch. Governing the Commons (1990) distilled what the survivors had in common, and in 2009 the work won the Nobel Memorial Prize in economics.
Her distillation is eight design principles. Compressed brutally: boundaries, so it is clear who is a member and what the resource is; fit, so rules match local conditions rather than a template; collective choice, so the people affected by the rules can change them; monitoring by community members accountable to the community, not by outsiders; graduated sanctions, so a first violation draws a warning, not exile; conflict resolution that is cheap, fast, and local; the right to organize, so outside authorities let the arrangement stand; and nesting, so small units federate into larger ones rather than dissolving into them.
The principles are not incentives, exactly, and not technology at all. They are answers to four questions any shared resource forces: who is inside, who watches, what watching costs, and what happens when someone takes too much. Answer them well and you have the third option. Leave them unanswered and you have Hardin’s pasture.
The pasture made of trust
A community’s reputation is a common-pool resource, and it behaves exactly the way Ostrom said such resources behave.
A common-pool resource has two defining properties. It is hard to fence (many people can draw on it) and it is subtractable (what one person takes is gone, at least for a while). A community’s collective credibility fits both. When any member vouches, endorses, certifies, or signs, they draw on a shared stock of believability the whole community built, and every hollow claim grazes it down. The pasture doesn’t die when one cow overgrazes; it dies when overgrazing becomes free.
LinkedIn endorsements are the overgrazed meadow.
Grade inflation is the same failure inside the university. An A is a claim drawn on the institution’s collective credibility. When professors stopped paying any reputational cost for granting one, the A’s multiplied and the transcript died as a signal. The admissions gate, which stayed ruthlessly guarded, kept the brand alive. One commons inside the institution was governed; the other was grazed to mud.
And Klout was the enclosure movement. Enclosure was the fencing of common land into private hands. Klout did the same to reputation: it pulled every member’s standing out of the community that had built it and published it as a single private score. Separating standing from the people who could vouch for it made the score worthless.
Different platforms, different decades, one diagnosis. These systems didn’t fail for lack of users, capital, or cryptographic sophistication. They failed because nobody governed the pasture.
The natural experiment
Then, starting around 2016, the internet ran the largest commons-governance experiment since Hardin’s essay. Thousands of them, in public, at speed, with real money.
Decentralized autonomous organizations deserve a more honest telling than they usually get. Strip away the coin-press cynicism of the era and the ambition was almost precisely Ostrom’s question: can a community govern a shared resource (a treasury, a protocol, a collective project) without a corporation above it or a state behind it? Tens of thousands of people joined in good faith. Treasuries worth billions in aggregate were placed under collective control. Some jurisdictions created new legal forms to let these communities hold property and sign contracts, a real institutional innovation worth keeping.
But the first generation built its governance from the vocabulary it had inherited, which came from corporate finance: shares and votes. Measured against the eight principles, the standard design was not a partial violation. It was a near-perfect inversion.
Influence was linearly purchasable. One token, one vote, means the price of a governance outcome is quoted on an exchange. Not a bug that crept in; the first-order property of the design.
There was no boundary. Anyone holding the token was a member, anonymously, instantly, with no distinction between a founder of five years and an arbitrageur of five minutes. Ostrom’s first principle, the one Törbel wrote down in 1483, was absent by construction. No inside means no context, nothing at stake, and no way to tell a neighbor from an opportunist.
Voting was costless, so almost nobody voted. Turnout on most proposals ran in the low single digits; even flagship protocols struggled to bring a tenth of their tokens to a vote. The vacuum filled with delegation to whoever asked: governance capture without governance activity. Monitoring by accountable members, Ostrom’s fourth principle, requires monitors who exist.
And there was no wall between reputation and speculation. When the governance instrument is also a tradable asset, every vote is also a position. A community cannot deliberate about its long-term good in an instrument its members are simultaneously day-trading.
The failures were structural, not cultural, which is why they arrived on schedule regardless of how idealistic any particular community was.
The cleanest demonstration took thirteen seconds.
On April 17, 2022, a lending protocol called Beanstalk was governed by token vote, with an emergency mechanism allowing a two-thirds supermajority to execute a proposal instantly. An attacker had submitted two proposals the day before: one, prominently, a $250,000 donation to Ukraine relief; the other containing the code that mattered. Then he borrowed roughly a billion dollars through a flash loan, a DeFi instrument in which the loan is taken and repaid inside a single transaction. For the length of that transaction, one Ethereum block, about thirteen seconds, he held a supermajority of Beanstalk’s governance. He voted, passed his own proposal, transferred $182 million out of the protocol, repaid the loan, and kept about $80 million, before most members knew a vote had occurred.
Resist the urge to file this under crime. The contract executed exactly as written; the vote was legitimate under the constitution the community had adopted. Beanstalk’s members were not fools, and many were volunteers left holding a collapsed token. What failed them was a governance design under which a thirteen-second member, with no name, no history, and no work witnessed by anyone, could hold more standing than everyone who had built the thing combined. Hardin’s herdsman needed a season to ruin the pasture. Composable finance got it down to one block.
Ostrom’s principles, violated wholesale, at speed, in public.
What the survivors would build
The temptation after Beanstalk is to conclude that online communities can’t govern shared value at all: Hardin’s conclusion, freshly reheated. That reading gets the evidence backwards. Törbel is five hundred years of counterexample; the huertas are a thousand. The first generation of internet commons didn’t disprove Ostrom. It replicated, at unprecedented cost and documentation quality, her account of what happens when the principles are ignored. So the design brief for a second generation is not mysterious. It is sitting in a book from 1990, and each violation has an answer.
Earned influence. The answer to purchasable influence is not to banish money. Ostrom never pretended markets away; her communities traded constantly (hay, water turns, labor) while keeping governance anchored in membership and contribution. Money can participate, but it cannot dominate. Recent mechanism design has made this precise. Puja Ohlhaver’s work on community currencies, built consciously on Ostrom, shows how influence can grow sublinearly with committed stake, so the tenth unit buys far less voice than the first and concentrated capital flattens into diminishing returns. Add commitments that are permanent and non-transferable, stakes a member locks for good as a bond to one community, and you get something capital cannot retroactively acquire: time. A patient contributor’s years of standing become a position a wealthy newcomer can approach only slowly, on the community’s terms.
The boundary. The boundary is the collateral. A community with a real membrane, legible membership, and doors it controls itself recovers everything Beanstalk lacked: context, stakes, and the ability to tell a member from a visitor. Standing earned inside a boundary should stay scoped to it, because that is where the witnesses are. This is Klout’s lesson read forward: portability, where it ever comes, will arrive the way it always has, through federations of communities that trust each other’s rules (Ostrom’s nested enterprises), not through a universal number.
Witnessed weight. Make voting weight something earned by doing witnessed work, and the electorate changes: the votes are cast by the people who did the work, each with standing to lose. This is where Ostrom’s monitors reappear in modern dress. Peer attestation, members vouching for specific work they saw, is monitoring by accountable community members almost word for word. What makes the monitors accountable is not an automated punishment waiting behind them; there shouldn’t be one. It is the membrane’s own economics. Every signature is visible inside the boundary, so a hollow one is a public act among the people best positioned to know it was hollow, and everything a signer holds is denominated in the community’s credibility: debase the commons and you have debased your own account in it. A protocol that slashed automatically would be more dramatic, and less Ostrom. Her fifth principle assigns sanctions to the community, graduated and fitted to the offense, because the village knows things no formula does. Törbel ran this exact design: your claim on the alp was tied to hay your neighbors watched you cut, and the punishment for cheating was theirs to choose.
The firewall. Make it absolute. The moment attesting to a neighbor’s work earns the attester anything financial, testimony becomes advertising and the commons begins to consume itself. So: a community’s currency can be traded, priced, even speculated on. Its testimony cannot, because attesting earns nothing, ever. Markets get the currency. The commons keeps the witness.
None of this is speculative institutional design. It is amonng the oldest institutional design we have records of, restated for communities whose pasture is trust.
The instruments have caught up. Records can now outlive any platform, and verification can be performed by anyone. For the first time, a Törbel-shaped institution can hold together among people who do not share a valley. The evidence has caught up too. The first generation failed in public, block by block, and the second generation’s designs will be tested the same way: in participation rates, in collusion attempts, in what real communities do with real boundaries. Ostrom would have insisted on nothing less; her whole career was a rebuke to armchair conclusions about what communities cannot do.
Thirteen seconds and five hundred years are now data points in the same ledger. The village above the Vispa valley never heard of a flash loan, but it would have understood the attack instantly: a stranger arrived with a vast herd, grazed the alp bare in one afternoon, and left before dark. And it would have understood the remedy, because it wrote the remedy down in 1483. Know who is in the village. Tie every claim to work the neighbors witnessed. Make the watching cheap, the vouching cost something, and the overreach cost more.
Reputation is a commons, and Ostrom told us how commons survive.
Ken Leiserson builds tools for trust between people who work together. He can be reached at app.extol.work/profile/ken or on X @kenserson.