The metaverse disrupts long-settled allocations of legal authority by layering immersive virtual environments on top of distributed infrastructures that rarely map onto territory. This article argues that hierarchical, state-centric regulatory models cannot adequately govern such environments, because power is already distributed among states, platforms, protocol designers, and user communities. The article asks a precise legal question: how should legal authority be allocated across these actors to sustain rights, accountability, and coherence in immersive virtual worlds? To answer it, the article adopts a polycentric governance lens and develops a layered allocation-of-functions framework that distinguishes four governance layers (state law, platform governance, protocol architecture, and user and community norms) and specifies their cooperative, conflictual, and fallback interfaces, evaluated through the metrics of legality, legitimacy, efficacy, and auditability. Drawing comparatively on the GDPR’s cross-border enforcement architecture and on the wider literature on international law and cyberspace, including the Tallinn Manual process, the article identifies how multi-level governance can produce order without hierarchy. It concludes with calibrated near-term and medium-term reforms and a research agenda attentive to re-territorialisation pressures and Global South perspectives.