AI Agent Authorization: The 2026 Liability Gap

An AI agent that exceeds its instructions leaves accurate records at every company it touched — and no single record proving what you authorized. The AI AGENT Act, introduced on July 21, 2026, would require agents to log their actions. It never says who pays for the mistake.

TL;DR

Sen. Mark Warner (D-VA) introduced S.5051, the AI AGENT Act of 2026, on July 21, 2026.¹² It would give you the right to designate your own agent to act for you on any online platform with more than 50 million US customers — provided that agent's provider has registered with the FTC first.¹

It also requires every "custodial user agent" to maintain real-time records of actions taken on your behalf.¹

What it does not do is allocate the loss. When an agent buys something you told it not to buy, the bill hands that question to an interagency working group and asks it to develop proposals.¹

Industry reached the same wall first. AP2 — Google's protocol, donated to the FIDO Alliance in April 2026 — along with Mastercard's Verifiable Intent and FIDO's new agentic working groups, all produce evidence of authorization.³⁴⁵ None of them decides who eats the charge.

One company did put a concrete answer on the table — and it was a card issuer, not a legislature.⁶

What You'll Learn

• What S.5051 actually requires, and the compliance clock that starts on enactment
• Why the bill's definition of "custodial user agent provider" may cover you personally
• Where AP2, Verifiable Intent, FIDO, and OpenID's AuthZEN each stop short
• Why NIST's agent identity project explicitly deferred the consumer case
• How Regulation E and Regulation Z treat a purchase your agent made with your credentials
• What American Express did in April that nobody legislated

The record that does not exist

Start with the scenario that put this story back in the news.

You tell an agent to find a shirt under $30 and not buy it. The agent finds one and orders it anyway.

You dispute the charge. The retailer shows the order came through your account. The agent provider shows your instruction not to buy. The payment processor shows the charge cleared.

Every record is accurate. None of them links the charge to the task you actually gave.

That framing comes from Aashis Luitel, associate teaching professor of artificial intelligence at the University of the Cumberlands, writing for The Conversation and republished by Fortune on August 24, 2026.⁷

His point is not that the evidence is missing. It is that the evidence does not travel. Each company can verify only the slice it sees, and no participant holds a record that answers the question a dispute actually turns on: did this agent, acting for this person, stay inside the limits of this task?

What the AI AGENT Act requires — and what it leaves out

Warner released a discussion draft on June 29, 2026 — explicitly to gather feedback "before it is formally introduced" — then introduced the formal bill three weeks later.⁸¹

S.5051 was read twice and referred to the Senate Committee on Commerce, Science, and Transportation on July 21. As of August 27, 2026, that referral is still the bill's latest recorded action.² The committee's most recent markup, on August 5, took up five kids' online-safety and AI bills; S.5051 was not among them.⁹

The bill defines a custodial user agent as "a software-based agent that is expressly authorized by a user to interact with a large online platform provider on that user's behalf in a transparent, documented, scope-limited, and revocable manner."¹

A large online platform is one with more than 50,000,000 US customers or subscribers in any calendar month during the preceding 12 months.¹

Here is what starts running the day it would take effect.

The NIST mandate is the technically interesting one. Alongside messaging, social media, e-commerce, personal finance, and AI services, Section 4(c)(6) asks for standards covering scope-limited and revocable delegation credentials, verification of agent identity and registration status, "real-time communication and effectuation of revocation," and "the creation of auditable records of actions taken by custodial user agents on behalf of users."¹

That is close to a complete specification for proving delegation. It is also, notably, a records mandate rather than a liability rule.

The duties in Section 3(g) follow the same pattern. An agent must safeguard user data, must not act in ways inconsistent with the user's directions or reasonable expectations, must not use the data for advertising or profiling, and must "maintain real-time records of actions taken on the user's behalf" and hand them over on request — with one carve-out, for records the user previously told the agent to delete.¹

Those duties cannot be waived by contract, terms of service, or any form of user consent — a meaningful provision, given how much of today's agent risk is disclaimed away in a EULA.¹

Section 3(g)(1)(F) is the sub-delegation rule: an agent cannot pass its authority to another entity's agent or AI system unless the user expressly, specifically, and revocably authorized it, and the recipient takes on the same duties.¹ Anyone building multi-agent handoffs should read that clause twice.

But search the bill for who bears the cost of a bad transaction and you land on Section 4(g), which directs the FTC, CFPB, FDIC, OCC, Treasury, DHS, Commerce, DOJ, and SEC to form a working group "for the purpose of developing proposals to prevent harms to businesses and the Government resulting from custodial user agents undertaking actions on behalf of a principal as a result of fraud, misuse, or genuine mistake."¹

Proposals. Not a rule. And the harms named are those to businesses and the government — the consumer's $30 shirt is not the subject of that sentence.

The registration clause that may cover you

One definition in Section 2 deserves more attention than it has gotten.

A "custodial user agent provider" means any entity that operates or offers one or more custodial user agents — and includes a user who operates a custodial user agent on the user's own behalf and not on behalf of any other user.¹

Read that against Section 3(d)(1): a custodial user agent provider "shall register with the Commission as a condition of, and prior to, any custodial user agent operated or offered by that provider accessing an interface" covered by the Act.¹

On its face, that means the hobbyist running a self-hosted agent against a covered platform is a provider who must register with the FTC first.

The bill softens this. The Commission "may establish uniform terms and scope of service, by which a custodial user agent provider may register through self-attestation," and the FTC or a recognized certification body has 180 days from submission to evaluate a registration.¹ Self-attestation would make solo registration a form, not an audit.

Whether that is how it plays out depends entirely on rulemaking that has not started, for a bill that has not moved out of committee. It is worth watching if you build agents in the open.

Where the standards bodies stopped

The legislative timeline is the tail end of a much faster industry one. Every entry below strengthens the record of what a user authorized. Only one of them — the odd one out, and not a standard — also says who absorbs the cost when the record shows the agent got it wrong.

Two of those entries deserve a closer look.

AP2 v0.2 pushed further into unattended territory. The same April 28 release that moved AP2 to neutral governance shipped what Google called "critical updates for autonomous transactions," including "Human Not Present" payments that let agents "securely execute payments autonomously — like securing and purchasing limited-run tickets the moment they're on sale — based on pre-authorized user instructions."³

The delegated, human-not-present flow was not new in itself; AP2's launch post described signing an Intent Mandate upfront for a task like "Buy concert tickets the moment they go on sale."¹⁰ What v0.2 added was fuller support for it. Either way, the direction of travel is more transactions whose only evidence of intent is a mandate signed before the fact.

AuthZEN is solving the adjacent problem well. The AARP draft standardizes how a system says "not yet, and here is what is required" — approval, consent, delegated authority, an attestation — so an agent can park a request and resume once a human clears it.¹¹ The companion COAZ profile targets Model Context Protocol tools, letting them expose the authorization checks required to call a tool.¹¹

That is the human-in-the-loop primitive agent builders have been hand-rolling. It still governs whether an action happens, not who pays when the wrong one does.

To be fair to AP2, accountability was in scope from the start. Google's launch post named it as one of three questions the protocol addresses — "Determining accountability if a fraudulent or incorrect transaction occurs" — and described the intent-to-cart-to-payment sequence as creating "a non-repudiable audit trail" that provides "a clear foundation for accountability."¹⁰

A foundation for accountability is not an allocation of it. Luitel's assessment applies to the whole column: AP2 "does not decide who bears the loss or specify how long each company must keep that evidence and how it can be retrieved later."⁷

Knowing exactly what happened tells you who was at fault. It does not tell you whose balance sheet absorbs the charge while that gets sorted out.

NIST deferred exactly the case consumers are in

The AI AGENT Act would put NIST on a 180-day clock for verifiable-delegation standards. NIST's own agent identity work is already running — and its scope is narrower than the bill's.

The National Cybersecurity Center of Excellence published a draft concept paper, Accelerating the Adoption of Software and AI Agent Identity and Authorization, in February 2026, authored by Harold Booth, Bill Fisher, Ryan Galluzzo, and Joshua Roberts.¹² Its comment period ran from February 5 to April 2, 2026, and the project is now listed as "Reviewing Comments."¹³

The paper asks the right questions. "How do we handle delegation of authority for 'on behalf of' scenarios?" "How do we ensure non-repudiation for agent actions and binding back to human authorization?"¹²

Then it draws a boundary:

The focus of the project will be on enterprise use-cases where greater control and visibility can be maintained over agents and the systems they access. The challenge of identifying and managing access for external agents from untrusted sources will not be addressed under this initial effort, but use-cases focused on public facing or individual agents could be addressed in future iterations of the project.¹²

That is a defensible scoping decision for a demonstration project. It is also, precisely, the deferral of the case where an agent crosses three companies that have never met.

For what it is worth, the standards NIST names as candidates are already familiar to agent builders: MCP, OAuth 2.0/2.1 and its extensions, OpenID Connect, SPIFFE/SPIRE, SCIM, and NGAC.¹² The building blocks exist. The cross-boundary assembly does not.

The old rules were written for people

Here is the part that makes the gap concrete today, before any of this is law. This is general information about published regulations, not legal advice.

Debit and other electronic fund transfers. Regulation E defines an "unauthorized electronic fund transfer" as one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit."¹⁴

Then comes the exception. The term does not include a transfer initiated "by a person who was furnished the access device to the consumer's account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized."¹⁴

The official interpretation is blunter still: "If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized."¹⁴

Note where the escape hatch is. Liability stops when you tell the bank the delegation is over — not when you tell the agent.

Whether an AI agent — or the company operating it — is a "person" for this purpose is untested. Regulation E defines "person" as "a natural person or an organization, including a corporation, government agency, estate, trust, partnership, proprietorship, cooperative, or association."¹⁴ Software is not on that list. The provider behind it is an organization.

Credit cards. Regulation Z caps cardholder liability for unauthorized use at the lesser of $50 or the amount obtained before the issuer is notified.¹⁵ But "unauthorized use" means the use of a credit card "by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit," and whether such authority exists "must be determined under state or other applicable law."¹⁵

The official interpretation then closes the loop the same way Regulation E does: "If a cardholder furnishes a credit card and grants authority to make credit transactions to a person (such as a family member or coworker) who exceeds the authority given, the cardholder is liable for the transaction(s) unless the cardholder has notified the creditor that use of the credit card by that person is no longer authorized."¹⁵

Substitute an agent for the coworker and the $50 cap stops doing the work most people assume it does — if an agent, or its provider, counts as a "person" who was granted authority.

Neither framework was drafted with autonomous software in mind, and no published CFPB guidance squarely applies either one to an AI agent as of August 2026. That ambiguity is the actual state of play — not a gap the AI AGENT Act closes.

One issuer put money behind the answer

On April 14, 2026, American Express launched its Agentic Commerce Experiences (ACE) Developer Kit and, alongside it, Agent Purchase Protection.⁶

The kit has five components: agent registration, account enablement, purchase intent, passing tokenized payment credentials, and an optional cart-context handoff from the merchant.⁶ Supporting partners at launch included OpenAI, Google, Microsoft, Stripe, PayPal, Adyen, Cloudflare, Delta, Expedia, and Hilton.⁶

The protection is the part the record-keeping standards leave out. Luke Gebb, Amex's EVP and global head of innovation, described the case directly:

If the merchant has made no error and the cardmember has made no error, but the agent has made the error, that's a new paradigm in agentic commerce today and one that has not been figured out — how to deal with that.⁶

Amex's answer: "As long as we're dealing with a registered agent who has used our developer kit to come in and register and they've shared the customer intent … then we will stand behind that transaction and credit the consumer so they're not out of pocket."⁶

Gebb's framing of why is worth quoting too, because it explains the structural difference between a protocol and a guarantee: "no one has yet brought the issuer into the equation (or the bank). That's where, when you start to have the issuer in the equation, you start to have legitimate financial liability for transactions."⁶

Note what this is and is not. It is one closed-loop network, covering agents registered with that network, that shared intent through that network's kit. It is a commercial commitment, not a legal standard, and it is the network's own characterization of its scope. Other issuers may match it; as of this writing, no comparable federal rule requires them to.

What this means if you are building agents

Four things follow, none of which require the bill to pass.

Log intent, not just actions. Agent observability tends to center on tool calls and outputs. What a dispute needs is the user's original instruction, the structured constraints derived from it, and evidence the user saw and approved that structured version before the run started. Store all three, timestamped and immutable.

Carry a correlation ID across every hop. Luitel's proposal is a task reference — unique to one job, carrying no account number or name, short-lived, and present in every participating company's record.⁷ Engineers already have the shape of this in W3C Trace Context. Treat cross-company traceability as a product requirement, not an ops nicety.

Build the approval gate now. AuthZEN's AARP gives you a standard pattern for "policy cannot authorize this yet, here is what it needs" — and a way to hand off, wait for a human, and re-evaluate rather than route around the denial.¹¹

If you have already written your own approval plumbing, the draft is worth reading before you harden it. The same logic applies to how you scope tool access through MCP's enterprise authorization model and how you give the agent itself a verifiable identity.

Do not assume the settlement layer protects your user. The agent payment standards race is still unsettled, and the open protocols in it produce evidence rather than recourse. Build spending caps, hard stops on irreversible actions, and confirmation prompts as your own layer — the same defensive posture that applies to verifying which agents can reach your services at all.

The bottom line

The agent authorization stack picked up most of its missing pieces between March and July of this year: a tamper-resistant intent record in Verifiable Intent, neutral governance and a new working group at FIDO, an approval-prerequisite standard in AuthZEN, and a legislative mandate for NIST to define verifiable delegation — all on top of AP2's signed mandates from September 2025.

Every one of those produces better evidence. Not one of them says who pays.

That is not an oversight in any single effort — it is the boundary where standards bodies stop and liability regimes begin. The AI AGENT Act could have crossed it and chose a working group instead. NIST's demonstration project explicitly deferred the consumer case. The clearest concrete answer so far came from a card issuer with a closed loop and a balance sheet.

If you ship agents that spend money, act on the assumption that the recourse layer does not exist yet. Log the user's instruction alongside the agent's actions, carry a task reference across every boundary you cross, gate irreversible actions behind a human, and cap what an unattended run can do. Those are your controls to build, and for now they are the only ones you can count on.

References