Three efforts are advancing in parallel: a payment protocol for agents backed by Google, standards work on agent identity and permissions, and a US bill on the subject. All converge on the same requirement: having a verifiable trail establishing who authorised what, for how long, and within what limits.
We have covered the arrival of agentic commerce and the opening of trading to agents, each time highlighting the same gap: nobody knows who answers when something goes wrong. That gap is starting to close.
The problem to solve
An agent making a payment raises a question that existing systems do not know how to handle.
A standard transaction rests on the idea that a person consented at a given moment. The system records that consent, and in the event of a dispute you trace back to that act.
With an agent, consent was given upstream, in the form of general rules, sometimes weeks earlier. The user authorised a scope, not a transaction. When the agent buys, there is no act of consent at that precise moment.
Hence three unanswered questions today: did this purchase fall within the mandate? How do you prove it? And if the agent was manipulated by an injection into the data it was consulting, who bears the loss?
The answer taking shape
The three efforts converge on the same mechanism, which can be summarised as: a signed, bounded authorisation.
The principle: when you give an agent a mandate, the system produces a signed digital document specifying what is permitted, up to what amount, for how long. That document then accompanies every request the agent issues.
A merchant receiving an agent order can then verify that the authorisation exists, that it covers this operation, and that it has not expired. In the event of a dispute, the chain can be reconstructed without an investigation across systems that do not talk to each other.
This is the same principle as described regarding scoped tokens: you do not hand over the resource, you hand over a delimited, traceable permission.
This framework makes a smart choice: it does not try to determine whether the agent actually reasoned correctly, which is impossible since nobody can reconstruct a model's internal reasoning path. It only seeks to establish whether the action fell within an authorised scope. That is a verifiable question, unlike the previous one. Intent is abandoned in favour of the mandate, which is exactly what the law has done with human agents for centuries.
What it does not solve
Two difficulties remain fully open.
Liability in cases of manipulation. If a duly authorised agent makes a purchase because poisoned content misled it, the authorisation was valid and the action was within scope. The trail proves everything was in order, and the user has still lost money. This is exactly the gap we described in our article on liability.
Poorly defined scope. A mandate that is too broad protects against nothing. Yet defining precisely what an agent may do requires anticipating situations you cannot imagine. This is the problem we saw with the agent that learns to cheat: a system optimises what you wrote, not what you meant.
What to take away
This effort is good news, and it illustrates something rarely seen in this sector: regulation arriving during deployment rather than after an accident.
It also confirms the shift we have been describing for weeks. What is difficult today is no longer making an agent capable: it is connecting it to the real world with verifiable permissions and a way to settle disputes.
For anyone building with agents, the practical recommendation is simple and applies right now, without waiting for the legislation: log what you authorise, with limits and a duration. The day something goes wrong, that is the only thing that will let you explain what was intended.