AINEWS
An AI agent uses your accounts to shop on other companies' sites, and when one ignores a 'don't buy' instruction, no party holds the proof to dispute the charge, even though Sen. Mark Warner's new bill names the gap.
Tell an AI agent to find a shirt under $30 but not to buy it, and the agent places the order anyway. The agent provider's record shows the agent acted. The retailer's record shows a valid token. The payment service's record shows an authorized transaction. No party holds the chain from your instruction to the charge.
Sen. Mark Warner (D-Va.) introduced the AI AGENT Act (S. 5051) on July 21, built around a discussion draft his office released on June 29. The bill defines a new legal category, a "custodial user agent" authorized to act for a consumer "in a transparent, documented, limited and revocable manner," with real-time action records. It points at the National Institute of Standards and Technology to develop the technical standards that would make those records verifiable.
Aashis Luitel walks through the gap in a recent analysis for The Conversation. The dispute is not really about a $30 shirt. It is about whether any of the three systems involved can produce a complete, tamper-evident record linking a user's instruction to a final charge.
The mechanism is well-understood inside the industry. Consumer AI agents today carry OAuth-style access tokens, the same kind of standing credentials that let a budgeting app read your bank transactions for weeks at a time. When that token reaches a retailer at checkout, it shows a valid, currently authorized request. The narrower instruction the user typed in the chat box, "find a shirt under $30, do not buy it," lives only inside the agent provider's system. The retailer never sees it. The payment service never sees it. The user, in turn, has no portable proof of what they actually asked for.
Luitel proposes a five-part accountability stack: a signed authorization record binding user, agent, and task; task-specific limits translated from the prompt and approved by the user; a short-lived, non-identifying task identifier that travels with every request and appears in every party's log; a per-action rule check at checkout that can block a purchase even with broader token access; and tamper-evident records at retailer, payment service, and provider, paired with a plain-language user receipt. Google's Agent Payments Protocol (AP2), as Luitel describes it, implements part of the stack, signed authorization records and per-party evidence, but stops short of assigning loss or setting retention and retrieval rules.
The Warner bill does some of this work and points to NIST for the rest. The discussion draft, as analyzed by Davis Wright Tremaine's AI Law Advisor blog, frames the legislation as opening a marketplace for consumer AI agents with privacy, security, and market-fairness protections. The bill defines the custodial user agent, requires real-time action records, and tells NIST to identify or develop verification and auditability standards. It does not, however, require any specific end-to-end evidence chain across the three parties.
If a dispute ever reaches a courtroom, the consumer still has to stitch together three partial records held by three companies. Each record is internally consistent and consistent with the others' narrow slice. None of them is the record the consumer needs.
The strongest defense of the bill is that legislating a specific technical chain would be premature, and that NIST is the right place to work out the details. NIST is reviewing comments on a February 2026 concept paper on agent identity and permission, and the agency's initial scope explicitly defers consumer agents that cross company boundaries. That is the policy lever the bill is betting on.
The same $30 shirt problem scales to a $40,000 wire transfer, a contested benefits appeal, or a prescription refill that was supposed to be held for review. In each case, the consumer loses by default because no party is required to keep the chain that would prove the instruction. The bill names that default. It does not yet reverse it.
Neither the bill nor the NIST process has answered the central design question yet: a task identifier that travels from the agent's prompt to the retailer's order to the payment service's charge, signed by the user and logged by all three, is one concrete version. Whether that is the right one, who pays to build it, and who carries the loss when the chain breaks are the questions the standards process now has to answer.