SPQR: senate and people of the internet

Four letters are stamped on every manhole cover, bus, and fountain in Rome: SPQR, Senatus Populusque Romanus, the senate and people of Rome. It is not a logo. It is a constitutional formula, an answer to the two questions every commons eventually faces: who deliberates, and who consents. Strip away the Latin and it describes, with uncomfortable precision, how the internet's best institutions already govern themselves. It also describes what its newest institution is missing.

A senate that could not command

Start with the half everyone gets wrong. The Roman Senate was not a legislature, and nobody elected it. It was a council of former magistrates: people who had climbed the cursus honorum, the ladder of offices, and served. What it held was auctoritas, the weight of earned counsel, which Romans distinguished sharply from potestas, formal power, and imperium, the right to command.

A senatus consultum, a decree of the senate, was technically advice. The senate could not order a consul to do anything. Yet for centuries nothing serious happened against its counsel, because it carried the three things you cannot order into existence: institutional memory, deliberation in the open, and standing that had to be earned before it could be spent.

Its decrees were technically advice. Nothing serious happened without them.

The internet built senates without naming them

Now look at how the internet governs its own plumbing. The IETF has no formal power over anyone. It cannot fine, compel, or license. Membership is whoever shows up and does the work. Yet its RFCs, documents whose name still means "request for comments", govern the planet's communications, because their authority is earned through open deliberation and demonstrated competence.

David Clark named the constitution in 1992: "We reject: kings, presidents and voting. We believe in: rough consensus and running code." That is auctoritas, operationalised. And the pattern repeats wherever the internet's commons is actually maintained: Debian's technical committee, the Linux kernel's maintainer trees, the Apache Software Foundation, the standards bodies and CVE boards.

The shape is always the same. You rise through contribution, a cursus honorum of patches and reviews. You govern through persuasion and review rather than command. And your legitimacy is continuously revocable, which is the clause Rome never wrote down and open source did.

The fork is the people's veto

The Populusque half matters just as much, and the internet encodes it more cleanly than Rome ever managed. Rome's plebeians had the secessio plebis: when governance failed them, they walked out of the city en masse, first to the Sacred Mount in 494 BC, and stayed out until the terms changed. The city could not function without its people, and both sides knew it.

Open source has the same mechanism with better tooling: the fork. When XFree86 changed its licence in 2004, the community walked to X.org. When Oracle absorbed OpenOffice, it walked to LibreOffice. When ownCloud's company drifted from its community, it walked to Nextcloud. In each case the maintainers' authority lasted precisely as long as the community chose not to leave.

That is the strict, structural sense in which a commons is republican: the senate proposes, and the people can always secede. Now run the same test against the systems where you cannot fork, cannot export, cannot leave: closed platforms, proprietary models, locked ecosystems.

A senate whose people cannot leave is not a senate. It is an oligarchy with better manners.

Shared law, sovereign locality

For the regions, Rome's mechanism was the municipium: local self-government under shared law. Municipalities ran their own affairs and kept their own customs, gods, and languages, while contracts, citizenship, and roads worked identically from Spain to Syria. Rome standardised the law, not the places.

The internet was built on the same topology: common protocols, autonomous systems. Email, Matrix, and ActivityPub federate; nobody's server answers to anybody's headquarters, yet every message interoperates. European law rediscovered the principle as subsidiarity, decide at the lowest level capable, and its data-residency rules are municipal autonomy restated for the cloud: the data lives under local law, the protocol stays common.

The republic test

Polybius, a Greek who watched Rome up close, credited its stability to the mixed constitution: consuls for executive energy, senate for deliberation, assemblies for consent, each element checking the others. Healthy open-source projects converge on his triad without ever reading him: a lead who can decide, a maintainer council that deliberates, a community that can leave.

Polybius' deeper point was why the mix is necessary at all: every pure form is undone by its own source of legitimacy. Power tied to votes decays into promising the most; power held by the worthy curdles into oligarchy; power vested in one person dies with the person. Only elements that check each other outlive their own principle.

That gives you a portable test. Name the missing element and you have named the failure mode. Deliberation without a decider stalls. Democracy without stewardship strip-mines the commons. And stewardship without exit is capture, however benevolent it looks this quarter.

What the four letters leave out

Look back at the formula. Senatus Populusque: deliberation and consent, two of Polybius' three elements, and no consul anywhere. The omission is the doctrine. In republican theory the executive has no authority of its own: imperium was granted by election, held for a single year, split between two colleagues who could veto each other, and subject to appeal. Consuls wielded power; they never owned it.

That is why the legions marched under standards reading SPQR rather than the general's name. The army belonged to the senate and people; the man commanding it was a temporary delegate. The formula states the direction of delegation: authority flows from deliberation and consent to the executive, and never back. The emperors kept stamping SPQR on coins and standards for centuries after that direction inverted, a polite fiction covering a command that had swallowed its source.

The modern translation writes itself. A project lead is a consul: appointed, revocable, replaceable without the project dying. Keys, infrastructure, and governance documents belong to the organisation, never to the person, and succession should be boring. A platform inseparable from its founder, an ecosystem that dies with its company, has put the general's name on the standard.

The standard outlives the general, or the republic is already over.

AI still runs on imperium

Which brings us to the one system the test fails outright. AI governance today is pure imperium: a handful of executives command, models change behaviour by fiat overnight, and users consent through terms of service nobody deliberated. There is no senate with published reasoning, no standing audit, and no exit a working business could actually take.

Rome even had the audit institution. The censores were magistrates whose whole job was reviewing conduct and membership rolls, including the senate's own. The mapping to the present is uncomfortably direct:

You cannot audit a model the way you audit code, which is an argument for more institutional audit, not less: provenance, evaluations, incident disclosure. When you cannot inspect the artifact, you audit the institution that makes it.

A model you cannot audit and cannot leave is governed by imperium alone, whatever its safety page says.

The republic fell

The most useful part of the story is how it ended. The Roman Republic did not fall to barbarians. It fell to wealth concentrated enough to buy politics, to private armies loyal to their generals rather than the state, and to emergency powers that became permanent. The modern rhymes need no forcing:

• hyperscaler concentration that can outspend every standards body it sits on;
• ecosystems loyal to a company, not a protocol;
• "temporary" surveillance and emergency measures that never sunset.

The senate's fatal flaw was that auctoritas had no defence against concentrated money and force once mos maiorum eroded, the unwritten customs everyone honoured. Rome ran its republic on norms and trusted them to hold. They held for four centuries, and then, against Caesar's legions and Crassus's fortune, they did not.

That is the sharpest argument for building the audit and the exit into the system itself, while building is cheap. European law has started writing down the censor's half, NIS2 and the Cyber Resilience Act are audit requirements with enforcement attached, and the exit half is what open weights, open protocols, and portable data are for. The internet's senates work because running code enforces what custom merely remembers. Norms erode. Encode them.