The AI AGENT Act would give consumers a legal right to send their own AI agent into the largest online platforms, and would bind that agent to duties of loyalty and care towards the user it serves. Senator Mark Warner (Democrat, Virginia) circulated a discussion draft on 29 June 2026 and introduced the bill as S. 5051, the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act of 2026, on 21 July 2026. It was referred to the Senate Commerce Committee and, as reported in October 2026, has had no further action. It is a bill, not a law. This guide works from the introduced text on govinfo.gov and explains who is covered, the "custodial user agent" model, the fiduciary-like duties, the FTC registration scheme, what platforms would have to build, and why most of it is a delegated identity problem that security and IAM teams can design for now.
Source note: obligations and deadlines come from the introduced text unless another source is named. The June discussion draft and its section-by-section summary, DLA Piper, Forkast and ID Tech Wire supply context. Where the draft and introduced text differ, the introduced text is used. Confirm against the official text before relying on it.
Key takeaways
- A right to delegate. Users could designate a registered custodial user agent (CUA) to manage interactions, purchases, content and account settings on a large online platform, on the same terms as the user, never with more access than the user has.
- Only the largest platforms are covered. A large online platform has more than 50 million US customers or subscribers in any calendar month of the previous 12. It must keep a third-party interface for CUAs on fair, reasonable and non-discriminatory terms.
- Duties that cannot be waived. CUAs owe loyalty, care, data minimisation, data security and real-time records to the user, may not sub-delegate without express, specific and revocable consent, and cannot contract out of any of it.
- The FTC is gatekeeper. CUA providers must register with the FTC before accessing platform interfaces, the FTC or a recognised certification body evaluates registrations within 180 days, and violators can be deregistered. Violations are unfair or deceptive practices, counted per affected user.
- NIST would standardise verifiable delegation. Within 180 days NIST must identify or publish standards for scope-limited, revocable credentials, registration verification, real-time revocation and auditable action records.
Status and timeline
| Date | Event | Source |
|---|---|---|
| February 2025 | Warner's AI policy framework first describes "fiduciary-like" duties for agents | Forkast |
| 29 June 2026 | Discussion draft and section-by-section summary circulated for comment | DLA Piper; Warner section-by-section |
| 21 July 2026 | Introduced as S. 5051 by Senator Warner, no cosponsors listed; referred to the Committee on Commerce, Science, and Transportation | Introduced text; Forkast |
| 10 October 2026 | Still in committee with introduction as the only action | Forkast |
| Enactment plus 120 days | Platforms publish complete interface documentation | Sec. 3(h)(5) |
| Enactment plus 180 days | FTC rules on verifiable, revocable access and request verification; NIST protocols or model standards; interagency working group formed | Sec. 3(c), 4(b), 4(c), 4(g) |
| Earlier of FTC rules or enactment plus 1 year | Act takes effect | Sec. 4(i) |
The bill follows Warner's 2019 ACCESS Act on data portability (DLA Piper). It sits alongside other agent bills, including a liability proposal from Senators Hawley and Murphy announced on 1 October 2026 (Forkast). Forkast also reports the FTC Chair's stated view that agents are "tools not actors", a policy position rather than a rule. The prospects of passage are uncertain; the design ideas are likely to recur.
Who and what is covered
| Term | Meaning in the introduced text | Practical reading |
|---|---|---|
| Large online platform | A product, app or service of an online platform with more than 50,000,000 US customers or subscribers in any calendar month of the preceding 12 months | Major marketplaces, social networks, payment and banking apps, and large AI services |
| Online provider | Consumer facing communications, retail or information services, including social media, e-commerce, personal finance and AI | Sets the service classes NIST must cover |
| Custodial user agent | Software a user expressly authorises to act for them with a large platform in a transparent, documented, scope-limited and revocable way | A delegated non-human identity acting for one person |
| CUA provider | Any entity offering CUAs, including a user running one only for themselves | Must register; a hobbyist running their own agent is still a provider |
| Interoperability interface | The electronic interface a large platform maintains for interoperability | In practice an authenticated API |
| Open protocol | A public standard for interoperability with no licence fees or patent restrictions | What NIST must find or write |
Enterprises are affected in three ways: as large platforms that must open interfaces, as CUA providers if they build consumer agents, and as businesses whose customers arrive through agents. See the Agentic Commerce Identity Guide and the Bot vs AI Agent Traffic Management Guide.
The duties of a custodial user agent
Section 3(g) is why commentators call this the first federal bill to treat agents as fiduciaries rather than tools. The text does not use the word "fiduciary"; it lists the duties.
| Duty | What the bill requires | Control that evidences it (our suggestion) |
|---|---|---|
| Safeguards | Reasonably protect the privacy and security of user data | Encrypted token storage, secrets vaulting, access reviews |
| Loyalty | No acting for the CUA's own benefit to the user's detriment, in foreseeably harmful ways, or against the user's directions or reasonable expectations | Policy checks on actions, conflict of interest rules for ranking and recommendations |
| Data minimisation | Collect, use or share data only as needed for the delegated service; no advertising, behavioural profiling, sale or other secondary commercial use | Purpose tags on data, retention limits, no ad SDKs in the agent path |
| Care | The care, skill and diligence of an ordinarily prudent person | Confirmation steps for high value actions, spending limits |
| Records | Real-time records of actions taken, provided to the user on request, except those the user asked to delete | Per-action audit log tied to the delegation grant |
| Sub-delegation | No delegation to another entity or AI system without express, specific, revocable authorisation; the sub-delegate is bound by the same duties | Attenuated, audience-restricted tokens for each downstream agent |
| Provider responsibility | Reasonable compliance measures; a pattern of violations is attributed to the provider | Monitoring, testing and incident records per CUA |
These duties cannot be waived by contract, terms of service or user consent. See AI Agent Action Approvals and Spending Limits and Delegation Chains and Attenuated Authority for AI Agents.
The FTC registration scheme
- Register before access: CUA providers must register with the FTC before operating CUAs that use platform interfaces. The FTC may allow self-attestation under uniform terms.
- Evaluation: the FTC or a recognised independent certification body evaluates each registration within 180 days of submission. Certification in good standing creates a rebuttable presumption of compliance with the section 3(g) duties. Certifiers tied to one provider, or earning most of their revenue from one, are excluded.
- Sensitive settings: the FTC may set specialised terms limiting CUA access where privacy, financial security or personal safety is at stake.
- Deregistration: providers that breach the duties, or whose CUAs do, can be removed.
- Platform refusal: platforms may deny or revoke access for unregistered providers, CUAs that repeatedly facilitate fraud or malicious activity, or where the user has revoked consent.
Commentators describe this as an FTC registry of trusted agents (ID Tech Wire). For identity teams it is a federal "know your agent" check. See the Know Your Agent (KYA) Guide and the AI agent registry.
What large platforms would have to build
- An interoperability interface for registered CUAs, on fair, reasonable and non-discriminatory terms, with complete documentation (not source code) published within 120 days of enactment.
- Verifiable, revocable delegation under FTC rules due within 180 days: each request must be verifiable and user revocation promptly communicated to the platform.
- Usage thresholds and fees that are public, proportional to cost, complexity and risk, and subject to provider petitions to the FTC.
- Security and privacy standards for CUA access, filed with the FTC (which publishes them), with suspected violations reported.
- A denial process: report each denial to the FTC, explain it to the provider, allow a 14 calendar day cure period and accept FTC appeals; the FTC can restore access if a denial was arbitrary, capricious or unsupported.
- Functional equivalence: if the platform interoperates with its own affiliated agent, competing CUAs get an equivalent interface. Interface changes designed to undermine access are violations.
See API Design for AI Agent Consumers.
Where identity fits
The bill is competition law in form, but it is an identity specification in substance. Every CUA action is a delegated, scoped, revocable authorisation from a person to a non-human identity, verified by a platform that did not issue it. NIST's model standards would have to cover:
- Scope-limited, revocable credentials: OAuth 2.0 with fine grained scopes or Rich Authorization Requests (RFC 9396) is the obvious current pattern. See the OAuth Rich Authorization Requests (RAR) Guide.
- Identity and registration verification: the platform must check that the agent belongs to a registered provider, a workload identity problem rather than a user login.
- Real-time revocation: user revocation must reach the platform quickly, which suggests short lived tokens plus event based signals. See Revoking Delegated Access During an Active Agent Incident.
- Auditable action records: each action tied to the user, the CUA, the grant and any sub-delegate. See the AI Agent Audit Trails for Regulators Guide.
These are our mappings to existing standards; the bill names no protocol.
Enforcement, pre-emption and other laws
- FTC enforcement: violations are treated as violations of an FTC rule on unfair or deceptive acts or practices, enforced with full FTC Act powers, including against common carriers. Each affected user counts as a separate violation, so exposure scales with user numbers. See the FTC Act Section 5 Data Security Guide.
- No state role: the introduced text gives state attorneys general no enforcement power and creates no private right of action.
- Narrow pre-emption: only state laws inconsistent with the Act are pre-empted.
- Savings: nothing modifies federal privacy and security laws such as GLBA Title V, FCRA, COPPA, FERPA and HIPAA rules, or the antitrust laws.
- Harm working group: within 180 days the FTC convenes the CFPB, FDIC, OCC, Treasury, DHS, Commerce, the Attorney General and the SEC to address losses from CUA fraud, misuse or honest mistakes. Liability allocation is left open. See the AI Liability and Product Liability Guide.
Decision guidance
- Large platforms: the cheapest path is one well documented, standards based delegation API with clear security standards, rather than blocking agents and defending denials before the FTC.
- Agent builders: design to the duties now. Real-time records, no secondary data use and consented sub-delegation are hard to retrofit.
- Banks and fintechs: personal finance is named and the FTC must coordinate with the CFPB, FDIC and OCC. Expect specialised terms; align with existing third-party access controls.
- Smaller businesses: no direct duty unless you exceed 50 million users, but agent traffic will reach you through the large platforms. Decide how you recognise and limit it.
Detection and measurement
- Revocation latency: seconds from user revocation to the last accepted request from that CUA; target minutes or less.
- Unregistered agent attempts: requests to the interface from agents without valid registration evidence, per day.
- Record completeness: share of CUA actions with a user, agent, grant and timestamp in the audit log (target 100 per cent).
- Denial quality: denials reported with documented reasons, and share overturned on cure or appeal.
- Sub-delegation coverage: downstream agent calls carrying an attenuated, consented grant versus the parent's full token.
Framework mapping
| Framework | Reference | Link to the bill |
|---|---|---|
| NIST CSF 2.0 | PR.AA-01, PR.AA-05 | Agent identities and scoped authorisations |
| NIST CSF 2.0 | PR.PS-04 | Real-time action records |
| NIST CSF 2.0 | GV.OC-03, GV.SC-07 | Legal duties and third-party agent risk |
| NIST SP 800-53 Rev 5 | IA-8, IA-9 | Authenticating external users and services such as CUAs |
| NIST SP 800-53 Rev 5 | AC-3, AC-6, AC-21 | Access enforcement, least privilege, controlled sharing |
| NIST SP 800-53 Rev 5 | AU-10, AU-6 | Non-repudiation and review of agent actions |
| ISO/IEC 27001:2022 | A.5.15, A.5.18, A.8.15 | Access control, access rights, logging |
Common failure patterns
- Credential sharing as delegation: agents that log in with the user's password cannot be scoped, attributed or revoked, which is the opposite of a scope-limited, revocable credential.
- Revocation that does not propagate: long lived refresh tokens keep working after the user withdraws consent.
- Silent sub-delegation: an agent passing its full token to a tool or second agent without new consent.
- Monetising agent data: ad or analytics SDKs inside the agent path would breach the data minimisation duty.
- Blocking by interface change: platforms tightening rate limits or changing APIs to exclude rival agents, which the bill treats as a violation.
Practitioner checklist
- Decide whether you would be a large platform, a CUA provider or neither, and record why.
- Replace any password based agent access with scoped, revocable delegated tokens.
- Give every agent its own identity, linked to its provider and user grant.
- Log every agent action with user, agent, grant and sub-delegate.
- Measure revocation latency end to end and fix long lived tokens.
- Require fresh, specific consent before any sub-delegation.
- Remove secondary data uses from agent data flows.
- Track S. 5051 and the NIST and FTC work it would trigger.
Standards and references
- US Government Publishing Office: S. 5051, AI AGENT Act of 2026, introduced text
- Office of Senator Mark Warner: AI AGENT Act discussion draft, section-by-section
- DLA Piper: Senator Warner discussion draft on securing AI agents, top points
- Forkast: Warner's agent fiduciary bill sits in committee
- ID Tech Wire: Draft US bill would require identity accountability for AI agents
- IETF: RFC 9396, OAuth 2.0 Rich Authorization Requests
- IETF: RFC 8693, OAuth 2.0 Token Exchange
Related NHI Mgmt Group resources: Agent Identity and Access Guide · OAuth Token Exchange and Delegation Guide · Agentic Commerce Fraud Guide · US Federal AI Policy Guide. This guide summarises S. 5051 as introduced and is not legal advice.