A vendor's "updated" invoice arrives with new wiring instructions. Any trained accounts-payable clerk knows the rule: changing bank details is outside your authority. Stop, escalate, write down why.

Now an AI agent is running accounts payable. Will it follow that rule? Maybe, if someone thought to prompt it. Maybe, on the platform where it was configured. Nothing yet guarantees it carries that same duty everywhere it goes.

And if it doesn't, it's on you. The law treats an AI agent as a tool. In August, the Ninth Circuit said of a shopping agent that it "is a tool, not a person." When an agent acts, the liability lands on whoever deployed it. You are fully responsible for something you cannot fully oversee.

Meanwhile, whatever duties your agent has right now are whatever its vendor decided to configure, read by the vendor's rules, inside the vendor's walls. Your agent's duties should be yours: written once, and carried everywhere it acts.

The agentic action revolution

We will have to deal with a hard-to-comprehend number of agents taking an increasing number of actions on our behalf. IDC projects more than a billion of them by 2029, taking over 200 billion actions a day: financial services, legal services, accounting, operations, the design of physical goods. Everything.

Coding is close to a verifiable domain. A test suite tells you whether the work runs, and even there agents learn to game the tests. Most of what agents are about to do is not verifiable at all. Whether a legal, financial, or operations task was completed to satisfaction is a judgment call, often made only after something goes wrong. In these domains, better evals won't save you. When nobody can check the work, the only thing that scales is oversight.

We already solved this once

This is an issue we as humans have been handling for a long time, one familiar to any employer: the principal-agent problem. Over centuries we devised laws, customs, and norms for it. An agent must act within its authority, follow instructions, stay loyal, take care, and keep the principal informed.

Legal scholars like Noam Kolt have mapped agency law onto AI agents, and payment networks have encoded narrow slices of it, such as signed spending limits. But nobody has turned these ancient and pre-existing norms into operative rules that follow an agent across platforms. People, businesses, and communities need to be able to take the norms they already live by and apply them as a harness, one that makes agents behave according to the old rules humans have always behaved under.

Not a system prompt

The obvious objection: human agents follow the rules because they fear being fired, sued, or shamed. An agent fears nothing, so writing the old rules down is just a system prompt with extra steps.

But agency law never relied on the agent's goodwill either. It relied on limits of authority that hold no matter what the agent wants, on records of what was done and why, on escalation to someone with the power to say no, and on liability that lands on someone. Those are external structures, not instructions. In July, when about 1,200 OpenAI agents in a benchmark invented their own norms to cheat the scorer, the lesson wasn't that norms fail. It was that norms the agents write for themselves, enforced by no one, fail. The old rules have to be enforced from outside the agent.

Conflict, scope, abstraction

When you look at how people created ways to oversee people in the past, the biggest issues are conflict, scope, and abstraction. What happens when two principals give conflicting instructions? Where does an agent's authority end? How far down a chain of sub-agents do the duties reach?

Human institutions already have answers. Take abstraction. When an agent hands work to a subagent, agency law says the duties travel with the authority. The subagent owes the principal the same loyalty and care, and the agent who delegated stays answerable. A chain of AI agents needs exactly that rule, and today it mostly doesn't have one.

These answers are not optimal. They are mere efficiencies, trade-offs in the solution space. Some floors should be fixed for everyone, as the law already fixes them. Above those floors, the trade-offs belong to the principal, not the platform.

The new patrician priests

Rome faced a version of this. Its plebeians grew tired of patrician priests interpreting unwritten custom however it suited them, so they demanded it be written down. The Twelve Tables were posted in the Forum for everyone to read and argue over. They didn't invent Roman law. They captured existing norms and customs and applied them with greater force against those who held the power to interpret them.

Today the platforms are the priests. The industry agreed on how agents talk, through open protocols like MCP and A2A. It has not agreed on who they answer to, and the platforms would prefer the answer be them. Slack cut outside apps' access to its data in 2025. Amazon sued Perplexity to keep its shopping agent off the store. Data, identity, and governance are being built as proprietary control planes. One way companies enforce their own top-down control is by siloing their agents, and they still try to wall out agents they don't control.

Platforms have real reasons to police agents on their own turf. Fine. The principal's duties shouldn't live there too. The limits, the records, and the right to say no should sit with the principal and travel with the agent, not live on whichever platform it happens to be acting on.

Oversight that works only inside one vendor's walls isn't oversight of the agent economy. I believe the future is general-purpose agents, in business just as in consumer use, but even in a world of specialized agents, a principal should be able to set scope, duties, and limits once and have them follow the agent everywhere it acts.

Refitting the wheel

We're not reinventing the wheel. We are refitting it to a new economy, putting it onto a new vehicle. We need to bring forth our pre-existing customs and rules, the ones we humans created for ourselves, and enforce them on the agents we have unleashed upon the world. We wrote those rules for each other. Now we have to write them down for agents, and the principal, not the platform, should hold the pen.