AI Agents Are About to Need Receipts

Hand your car keys to a valet and you get a ticket. That ticket is not a courtesy. It is proof of who you handed the keys to, what they were allowed to do with the car, and how you get it back. We have had some version of that arrangement for a century, for cars, for safe deposit boxes, for lawyers acting on our behalf.

We do not have it for AI agents. Right now, software that can log into your accounts, move your money, and message your customers mostly runs on a shared password and a lot of optimism. That is about to change, and it is changing from two directions at once.

Congress just gave the thing a name

On July 21, 2026, Senator Mark Warner introduced the AI AGENT Act (S. 5051), and the agent identity question finally got a legal shape rather than a philosophical one.

The bill defines a custodial user agent: one authorized to act for a user in a manner that is transparent, documented, limited and revocable. Read those four words slowly, because they are doing enormous work. Transparent means you can see it. Documented means there is a record. Limited means it has a fence around it. Revocable means you can take the keys back.

To make that real, the bill would require such agents to keep real-time records of actions taken on the user's behalf, and it directs NIST to identify existing open protocols, or build and publish standards where none exist, for two specific things:

• Scope-limited, verifiable, real-time consent delegation and revocation.
• Auditable verification of an agent's identity, its registration status, and the actions it took.

That is not vague gesturing at "responsible AI." It is a spec for a log.

NIST was already warming up the oven

This did not arrive out of nowhere. On February 17, 2026, CAISI launched the AI Agent Standards Initiative, the first US government program aimed explicitly at agentic interoperability and security. NIST is currently working through comments on a concept paper that asks three questions with uncomfortable clarity: how does an agent prove it has authority, how does that authority connect back to an actual human being, and how does it produce a record anyone can verify? A parallel NCCoE project is scoped to software and AI agent identity and authorization.

The popular framing has caught up too. One recent headline put it as bluntly as it can be put: an AI agent spent your money, can anyone prove you authorized it?

The question is no longer whether an agent can act for you. It is whether anyone can prove you said yes.

Google shipped it before the law showed up

Here is the part that makes this feel less like a policy story and more like a deadline. Google announced general availability of its Gemini Enterprise Agent Platform, folding Vertex AI and Agentspace into a single surface for building, scaling, governing, and optimizing enterprise agents grounded in company data.

Two operational details in that announcement matter more than the branding. Platform agents maintain state for several days, so they are genuinely long-running rather than one shot. And each agent uses dedicated Agent Identity credentials to minimize permissions and log every operation.

Put that next to S.5051 and the overlap is almost comical. Scoped credentials, per agent, logging every action. That is the compliance posture Congress is drafting toward, already sold as a product feature. The hyperscalers are not waiting for the standard. They are building the primitive and letting the standard catch up.

The gap this opens

Large enterprises will get agent identity, scoping, and per-action logging bundled into a platform they already pay for. It will arrive as a checkbox in a console.

Everyone else will not. The small business running automations on a single API key, the team that wired an agent into a CRM one Friday afternoon, the operator with one credential shared across a dozen workflows: none of them have a record of what the software did, and none of them can revoke a single agent without breaking all of them.

Think of it as the difference between an office building with badge readers and a building with one key under the mat. Both work fine until someone asks who went into the server room on Tuesday. The badge system answers instantly. The mat has no idea, and neither do you.

What this actually implies

You do not need to wait for a bill to pass to act on the direction of travel. Three things follow directly from what has already been published:

1. Stop giving agents shared credentials. One agent, one credential, narrowest scope that still works. A read-only agent should be structurally incapable of writing, not merely instructed not to.
2. Keep a per-action record. Timestamp, which agent, which tool, read or write, what changed, who authorized the scope. If you cannot produce that today, you are not ready for the question when someone asks it.
3. Make revocation something you have tested. Revocable is one of the four words in the bill's definition. A kill switch you have never pulled is a theory, not a control.

The pattern underneath all of this is old and familiar. Every time we let something act on our behalf at scale, we eventually build the paperwork that makes it accountable. Checks got signatures. Cards got statements. Employees got audit trails. Agents are just the newest delegate, and they are arriving faster than the paperwork.

The interesting question is not whether the log gets built. Congress named it, NIST is being told to standardize it, and Google is already shipping it. The interesting question is who builds it for everyone the cloud vendors are not selling to.

FAQ

What is the AI AGENT Act (S. 5051)? A bill introduced by Senator Mark Warner on July 21, 2026 that defines a "custodial user agent" as an AI agent authorized to act for a user in a transparent, documented, limited and revocable way, and requires real-time records of actions taken on the user's behalf.

What is NIST being asked to do? Identify existing open protocols, or develop and publish standards where none exist, for scope-limited real-time consent delegation and revocation, and for auditable verification of agent identity, registration status, and actions taken.

Is any of this available as a product today? Yes. Google's Gemini Enterprise Agent Platform is generally available, with agents that maintain state for several days and use dedicated Agent Identity credentials to minimize permissions and log every operation.

What should smaller teams running agents do now? Move from shared API keys to one credential per agent with minimal scope, keep an append-only record of every agent action, and test that you can revoke a single agent's access without taking down everything else.