Your Logs Say the Agent Did It. Can You Prove Anyone Authorized It?

On 21 July 2026 Senator Mark Warner introduced S. 5051, the AI AGENT Act, and an analysis published on 13 August by Aashis Luitel at the University of the Cumberlands put the interesting part of it in front of a wider audience. The bill defines a category it calls a custodial user agent, meaning an agent authorized to act for a person in a transparent, documented, limited and revocable manner, and it generally requires such agents to keep real time records of the actions they take. It then directs the National Institute of Standards and Technology to identify existing protocols or develop technical standards for two specific things: verifying that a user delegated authority to an agent, and keeping auditable records of what that agent subsequently did. Whether the bill passes in this form is beside the point for anyone running a business. The definition is the news, because it names a gap that almost every AI deployment currently has.

The gap is the difference between logging and proof of authority. Nearly every organisation running agents can already answer the first question. Your cloud trail shows a service account called something like automation-bot creating a record at 14:12, your workflow platform shows the run that triggered it, and your model provider shows the tokens that were spent. What none of that shows is that a specific human, with the standing to make the decision, granted the agent permission to do that specific class of thing, within a boundary, for a period, with a way to withdraw it. Auditors have a word for the property that is missing, and it is non repudiation. A log entry is a record of an event. Evidence of delegation is a record of a decision, and the two are not interchangeable no matter how detailed the log gets.

NIST has been circling this since the start of the year. Its National Cybersecurity Center of Excellence published a concept paper on 5 February 2026 titled Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization, with comments closing on 2 April and the responses now under review. The framing is refreshingly unromantic: existing identity and access management was designed for human users and for static software services, and an AI agent behaves like neither. The paper asks whether the standards already in the building, OAuth, OpenID Connect and SPIFFE, can be stretched to cover agent identification, authorization, auditing and non repudiation, and it explicitly raises controls for preventing and mitigating prompt injection. The intended output is a practical guide built in the NCCoE labs with commercially available technology, not a new framework document.

One limitation in the NIST scope is worth knowing before you plan around it. The initial effort covers agents operating inside organisations, where the enterprise can maintain visibility and control over both the agent and the systems it touches. Agents arriving from outside, from an untrusted party, are excluded from the first phase, with public facing and individual agents flagged as possible later work. That is a sensible sequencing decision and it is also the exact inverse of where the pressure is building, because the cross organisational case, an agent from another company presenting itself to your systems at runtime, is the one nobody has a settled answer for. If you were hoping for a standard that tells you how to accept a supplier agent next quarter, plan for that answer to arrive later than the internal one.

The most developed working example of what proof of delegation actually looks like sits in payments. Google announced the Agent Payments Protocol, AP2, in September 2025 with more than sixty launch partners including Mastercard, PayPal, American Express, Coinbase and Salesforce. Its central object is the Mandate, a cryptographically signed artefact expressed as a W3C Verifiable Credential and passed between parties as verifiable JSON. The flow splits into two: an Intent Mandate captures the high level instruction a person gave, and a Cart Mandate captures approval of the specific transaction the agent found. The design is honest about the hard case too, because for pre authorized tasks the agent may generate the Cart Mandate itself provided the conditions of the Intent Mandate are met precisely. That is the moment where the evidence chain either holds or becomes a story, and it is the same moment that exists in every internal workflow where an agent acts without a human in the loop.

None of this is confined to buying things, which is the mistake we expect most teams to make when they read the headlines. The same question applies to a coding agent in Cursor or Claude Code that opens a pull request against production infrastructure, to a Microsoft Copilot or Gemini agent that sends a message to a customer, to an automation platform that updates a CRM record or issues a refund, and to a browser agent that acts inside a session belonging to a member of staff. In each of those cases the action lands somewhere consequential and the record you will be asked for later is not the transcript. It is the answer to who authorized this, within what boundary, and how would we have stopped it. The correlation problem has a boring existing solution, incidentally, because a trace identifier of the kind W3C standardised for tracking events across services is precisely how you tie the human approval at one end to the agent action at the other.

The framework mapping is unglamorous and that is a point in its favour, because nothing here requires a new control family. ISO 27001 already expects identities to be managed across their lifecycle, access rights to be provisioned and revoked, logging to be in place and activity to be monitored, and an agent identity is an identity whatever you choose to call it. ISO 42001 goes further for anyone deploying AI systems, because it asks for clear accountability, defined roles across the AI value chain, and records that show how AI systems are used and overseen, which is a delegation question by another name. SOC 2 pushes at the same place through the logical access and monitoring criteria, and PCI DSS has been demanding audit trails that link actions to individual users for years, which is a requirement an agent acting under a shared service account quietly fails. If you run Vanta, Drata, Secureframe, Sprinto or Thoropass, note that these platforms are very good at collecting evidence that a control exists and are not, today, collecting evidence that a delegation happened.

The counterargument deserves a fair hearing. A bill introduced in July may never reach a vote, NIST is at the concept stage rather than the publication stage, and AP2 is one vendor led consortium among several proposals in a young field. Building signed mandates into every internal workflow right now would be an expensive bet on a standard that has not settled, and anyone selling you a cryptographic delegation layer this month is selling ahead of the market. We agree with all of that. What we do not accept is the conclusion some teams draw from it, which is to wait. The expensive part of this is not the cryptography. It is knowing which agent actions in your business are consequential enough to need an authorization record at all, and that inventory takes a morning and stays useful regardless of which standard wins.

So here is the exercise for this week. List every agent action in your organisation that changes something outside the agent itself: money moving, code merging, a message reaching a customer, a record being written to a system of record, access being granted. For each one, write down four things, which are the human or role that authorized the capability, the boundary it is limited to, the date it expires, and the exact steps to revoke it. Then check two properties in your logs. First, that agent activity is attributable to a distinct identity rather than hidden inside a shared service account, because a shared account destroys the evidence before you start. Second, that a single identifier connects the human approval to the resulting agent action, so the two records can be joined without someone reconstructing it by hand from timestamps. Finally, put an expiry date on every standing agent permission, because the property the Warner bill puts in its definition, revocability, is the one that ages worst in practice. Permissions granted to agents in a hurry six months ago are still live in most companies we talk to, and no future standard is going to fix that for you.