Technology 6 min read By Callum Montgomery
Google AI agents can spend money without approval, and current systems cannot prove who authorised what
A new US Senate bill highlights a gap in AI agent accountability: when an agent makes an unauthorised purchase, no single record links the user's instructions to the transaction. Experts propose a verifiable evidence chain across systems.
An artificial intelligence agent told to find a shirt under $30 but not to buy it can place the order anyway, and current systems make it nearly impossible to prove the agent overstepped its instructions. The retailer, the AI provider and the payment service each hold accurate records, but nothing connects the charge to the specific task the user gave the agent. This accountability gap is the focus of a new US Senate bill and a growing technical challenge for the AI industry.
Senator Mark Warner, a Virginia Democrat, introduced the AI AGENT Act (S. 5051) on 21 July 2026. The bill defines a “custodial user agent” as one authorised to act for a user in a transparent, documented, limited and revocable manner, and it generally requires such agents to keep real-time records of their actions. It also directs the National Institute of Standards and Technology (NIST) to identify protocols or develop technical standards for verifying that a user delegated authority to an agent and for keeping auditable records of the agent’s actions.
However, the bill does not expressly require a verifiable evidence chain across the different systems involved, from the user’s initial instruction to the final outcome. In the shirt scenario, such a chain would link the user’s instructions to the agent, the agent’s actions, and the records held by the retailer and the payment service. Without that chain, settling a dispute requires an answer that spans all three: did this agent, acting for this person, take this action within the limits of this task?
The problem mirrors a weakness in data breach research, where stable identifiers are needed to follow an organisation over time. When identifiers change or fail to match, one history fractures into several incomplete ones. An agent purchase has the same weakness: the retailer may recognise the AI agent provider without identifying the particular agent, and the payment service may label the same customer differently. Matching the user, provider and particular agent across those records gets investigators to the transaction, but they still need something to show that the user granted authority for that task.
In technical systems, a credential is data that a system accepts as evidence of identity or authority. Many websites use OAuth, an industry-standard security protocol for delegating authorisation to access online services while protecting users’ credentials. It generates an access token that an application presents to gain access to a protected service. That standing authorisation may have been approved weeks earlier, and the application may still obtain or present a valid access token that permits checkout today, even when the current instruction says to search but not buy. The retailer sees a usable token and carries out the transaction, while the task-specific restriction against buying remains inside the AI agent provider.
For accountability to work, five things would need to be in place: a verifiable binding among the user’s account, the agent at a specific time and the task; limits specific to that task; verifiable linkage across the transaction; a check before each action; and records whose later alteration can be detected. Payment systems have begun assembling these pieces. The first record would identify the authenticated user account that approved the task and the agent that received the authority. The provider would bind the account, agent and task in an authorisation record and digitally sign it, allowing the retailer and payment service to verify who issued it and whether it has been altered.
The AI agent provider would also preserve the original request and convert it into limits that other systems can enforce. For the shirt task, that could mean: search for 15 minutes, no purchase, no passing purchasing power to another agent. Before the agent begins, the user would see and approve that structured version. If the translation is wrong, investigators could compare the rule against the words behind it.
One way to create the necessary linkage is for a task reference to travel with each request. It would be unique to one job, encode no name or account number, and appear in every participating company’s record. Engineers already use a related device, a trace identifier, to correlate events from one operation as it moves between services. The task reference would link scattered records to one job, but it would not itself confer authority. It would need to be bound to the user’s approved rule in the agent provider’s digitally signed authorisation record. Because even a random identifier can link activity across services, it should be short-lived and visible only to companies participating in the task.
Someone then has to check the rule where the money moves, at checkout. Without such a check, the agent can still buy the shirt, and the user is left with a charge they did not approve and no clear way to prove the agent acted beyond its instructions. The AI AGENT Act points toward the problem, but the technical standards needed to solve it are still being developed.
