Where the Craft Bites Back

Five lessons in, you can do the trick. You can take a bad situation, spot the outcome you want, and design the rules so that self-interest walks itself there — cut-and-choose for a fair split, a second-price auction that makes honesty a dominant strategy, a Pigouvian tax that makes the polluter clean up because it’s now their own best move. It feels like a superpower, and it nearly is. Which is exactly why this final teaching lesson is the safety briefing.

Every model is a lie that’s usefully wrong, and the mark of someone who understands a tool — rather than merely wields it — is that they can say precisely where it stops being trustworthy. Mechanism design is unusual here, and in a way that’s actually a point of pride: it can prove its own limits. Not “sometimes this is hard” — actual theorems that say you cannot have everything at once, and here’s the exact tradeoff. So we’ll walk the five honest limits of the craft, one by one, then close the whole course with a recap. After that: the exam.

1. Impossibility results — you can’t have everything

The first limit isn’t a bug you can engineer around. It’s math. There are things the world would obviously love from a mechanism — that it be efficient (the good stuff ends up with whoever values it most), honest (nobody profits by lying), fair, budget-balanced (money in equals money out, no outside subsidy), and voluntary (nobody’s forced to join). The uncomfortable discovery of the field is that several of these clash provably. You can pick a subset. You can’t have the lot.

Three landmark results, in words:

• Myerson–Satterthwaite. Take the simplest possible market: one seller who privately knows what the thing is worth to them, one buyer who privately knows what it’s worth to them. You’d love a mechanism that trades whenever the buyer values it more than the seller (efficiency), that nobody can game by lying about their value (incentive compatibility), that neither party is forced into (individual rationality), and that doesn’t need an outside sponsor writing checks (budget balance). The theorem says: you cannot have all four at once. Something must give. Real bilateral bargaining leaves money on the table — trades that should happen don’t, because both sides are strategically shading their true value — and no clever rule fully fixes it.
• Gibbard–Satterthwaite. Turn to voting over three or more options. You’d want a rule that’s strategyproof — where honestly ranking your true preferences is always your best move, never something you can improve on by voting tactically. The theorem says: any non-dictatorial voting rule over three or more options is manipulable. Unless you let a single dictator decide (which is not a voting rule anyone wants), there will always be situations where a voter can get a better outcome by lying about their preferences. Tactical voting isn’t a flaw in your particular system; it’s baked into the mathematics of choice.
• Arrow’s impossibility theorem. Go one level deeper, to ranked voting as a way of aggregating everyone’s preference orderings into one collective ranking. Arrow wrote down a short list of eminently reasonable fairness conditions — no dictator, respect unanimity, and independence of irrelevant alternatives (adding a losing option shouldn’t flip who beats whom). The theorem says: no ranked-voting rule satisfies all of them at once. The very idea of a “perfectly fair” way to combine rankings is, in a precise sense, incoherent.

Notice the pattern. None of these says mechanism design fails. They say it faces a tradeoff frontier — and the discipline is honest enough to hand you the map of exactly where you have to give something up. That’s not a weakness. A field that can prove its own boundaries is a field you can trust inside them.

2. Goodhart’s law — when a measure becomes a target

Here’s the second limit, and it’s the one that quietly wrecks the most real-world mechanisms. Goodhart’s law: when a measure becomes a target, it ceases to be a good measure. A mechanism rewards exactly what it measures — never what you actually meant. Players are relentless optimisers of the letter of your rule, and supremely indifferent to its spirit. So if you reward a proxy instead of the real thing, you’ll get the proxy, maximised, often at the expense of the real thing you cared about.

The examples are a rogues’ gallery:

• Teaching to the test. You wanted educated kids, so you measured test scores and rewarded schools for raising them. Rational response: drill the exact test format, narrow the curriculum to what’s tested, coach for the metric. Scores rise; education doesn’t necessarily follow. You optimised the measure and lost the thing the measure was standing in for.
• Sales quotas by channel-stuffing. You wanted more sales, so you paid reps on units shipped this quarter. Rational response: “sell” enormous volumes to distributors near the deadline — shove product into the channel — booking revenue that hasn’t really happened and often comes back as returns next quarter. The number hit target. The business got worse.
• The cobra effect. The apocryphal-but-perfect parable: a colonial government wanted fewer cobras, so it paid a bounty per dead cobra. Rational response: breed cobras to collect bounties. When the scheme was scrapped, the now-worthless snakes were released — leaving more cobras than before the bounty existed. You measured “dead cobras produced,” not “wild cobras reduced,” and got exactly, catastrophically, what you paid for.

The through-line: a mechanism is a wish-granting genie that takes your words with murderous literalism. It does not know what you meant. It rewards what you measured, and the players — being rational, which is the entire assumption the field is built on — find the cheapest way to make that measure go up. Measure the wrong proxy and you don’t get a bit of the wrong behaviour; you get the wrong behaviour, industrialised, delivered with total confidence.

3. Unravelling — markets that jump the gun

The third limit is about timing, and it’s sneaky because it can wreck a market that has no other problem at all. Unravelling is what happens when the when of a transaction collapses earlier and earlier, each participant trying to jump the queue, until deals are struck absurdly far ahead of when they should be — often before anyone has the information that would let them choose well.

The mechanism is a race. If I can lock in a good counterparty by moving before my rivals, I do — so I make my offer a little earlier. Seeing that, everyone else moves earlier too, to not be left with the leftovers. There’s no stable stopping point on the way down, so the whole market’s timing slides, sometimes by years.

The classic cases:

• Exploding job offers. An employer, fearing the best candidates get snapped up, issues an offer that expires in 48 hours — take it now or lose it. Candidates, facing exploding offers everywhere, must accept before they’ve heard from other firms or even finished interviewing. Everyone is worse-matched; nobody can unilaterally stop, because slowing down means losing out.
• Medical residencies made years early. Before the modern centralized match, US hospitals competed to hire residents earlier and earlier, until offers were being made two years before graduation — long before anyone knew how the students would actually turn out. The market had unravelled so badly that it became nearly useless, which is precisely why a mechanism (a centralized clearinghouse match) was introduced to hold the timing in place.
• College admissions creep. Early-decision deadlines, ever-earlier applications, recruiting athletes and courting students further and further ahead — the same jump-the-gun logic, nudging the whole calendar forward.

The lesson for a designer: timing is not automatically self-stabilising. Left to itself, a market’s clock can run away, with every rational participant making it worse. A mechanism — typically a centralized match that fixes when everyone commits — isn’t bureaucratic overhead here; it’s the thing holding the market’s timing together. Take it away and the market can eat itself before a single price is even discussed.

4. Participation — people can just walk away

The fourth limit is the humblest and the most easily forgotten: a mechanism only works on the people who agree to be in it. This is the individual rationality (or participation) constraint — the requirement that being inside your mechanism leaves each player at least as well off as their outside option, the best they can do by declining. Violate it and they don’t grumble and comply. They leave.

You cannot design a rule that squeezes players harder than they’ll tolerate, because the “or else” is always available: or else I opt out. A tax so punishing it drives the activity underground or offshore; an auction whose entry fee exceeds the expected winnings, so nobody bids; a “voluntary” scheme whose terms are worse than doing nothing, so no one volunteers. In each case the mechanism’s beautiful incentive properties are irrelevant, because the mechanism is empty. A rule that no one joins achieves precisely nothing, no matter how elegant it is on paper.

This is also the deep reason behind part of the Myerson–Satterthwaite result from limit 1: one of the four properties you can’t simultaneously guarantee is exactly individual rationality — you can’t force the trade and keep it voluntary and keep it honest and balance the budget. Participation isn’t a footnote; it’s a live constraint that bites against your other goals. Always ask: compared to walking away, is every player I need actually better off inside my mechanism? If not, they’ll be somewhere else, and your rules will govern an empty room.

5. The equilibrium assumption — people have to actually play it

The fifth limit is the quietest and, for that reason, the most dangerous. Every mechanism we’ve built in this course carries a hidden clause in the fine print: …assuming the players find and play the intended equilibrium. We proved that in a second-price auction, truthful bidding is a dominant strategy. We proved cut-and-choose forces a fair split. But “there exists a dominant strategy” and “an actual human will find it and use it” are two different claims — and real people are boundedly rational. They don’t always read the fine print of the game they’re in.

Studies of real second-price auctions find people overbidding — paying above their true value — even though truthful bidding is provably optimal and beating it is impossible. Why? Because the reason it’s optimal is subtle (you set the price you might pay only when you don’t win it), and if a bidder doesn’t grasp that, the mathematically watertight incentive does them no good. A mechanism that is strategyproof on paper but too convoluted for its users to understand is, in practice, not strategyproof at all. The incentive only works if the player perceives it.

This flips a whole design value into view: simplicity and transparency are not niceties — they’re load-bearing. A rule people can see through — where it’s obvious that honesty pays — will actually elicit honesty. A rule that’s technically optimal but opaque invites confusion, superstition, and gaming, because players fall back on rules of thumb when the real logic is beyond them. The best mechanisms in the wild (eBay’s proxy bidding presented as “just tell us your max”; the residency match with its “just rank your true preferences” promise) work partly because someone did the hard job of making the honest move also the obvious one. Design for the humans you have, not the flawless optimisers your proof assumed.

Recap

You’ve walked the entire course — from the great flip through incentive compatibility, the second-price auction, the revelation principle, mechanisms in the wild, and now the limits. Here’s a mixed quiz that reaches back across all of it. Six questions, no penalties, just a final tune-up before the exam.

When to use it

Reach for this safety briefing every time you’re tempted to trust a mechanism — your own or someone else’s — a little too much. Before you deploy a rule, run the five checks like a pre-flight list. Am I promising properties that some impossibility theorem forbids together — which one am I really sacrificing? What proxy am I rewarding, and how will a rational player game its letter instead of my intent? Is the timing self-stabilising, or will this market unravel without something holding the clock? Is every player I need actually better off inside than walking away? And is the honest move not just optimal on paper, but simple and obvious enough that a real, distractible human will actually find it? A designer who asks these five isn’t being pessimistic — they’re being the kind of engineer whose bridges stay up. The craft is powerful precisely because it knows where it isn’t.

Where this goes next

That’s the course. You started with two children and a slice of cake, and you can now do the whole trick: flip a helpless “how do I make people behave?” into a solvable “what rule makes good behaviour their own best move?”, build in incentive compatibility so honesty pays, reach for a second-price auction when you want truthful bids, invoke the revelation principle to search only among honest rules, spot mechanism design running the world from spectrum auctions to kidney exchange — and, as of today, name the five places the craft bites back so you never oversell it. Knowing where a tool lies is the difference between wielding it and being fooled by it.

One thing stands between you and the certificate: the Final Exam. Fair warning — it plays by different rules than the friendly practice quizzes. It runs one question at a time, and once you submit an answer it locks for good: no Back button, no retry, no Restart. Your score appears only at the end, and you need 70% to pass. It’s the rigour you’d want from anyone who claims to understand mechanism design rather than just having read about it. You’ve done the work across six lessons — trust the questions you’ve learned to ask, then go take it.