Your AI Has Agency. The Law Has a Delegation Problem.

Joseph Afework
Independent Researcher, United States
joseph@afework.io

Abstract

Artificial intelligence is moving from generating answers to taking consequential actions on a user's behalf. Agentic systems can select intermediate steps, invoke tools, use credentials, call APIs, and modify external systems without a human specifying each action in advance. The resulting legal problem is narrower than a general “responsibility gap” and does not require treating AI as a legal person. Existing law already recognizes machine-mediated conduct in important settings, including electronic contracting, and conventional criminal doctrines remain available when a human intentionally directs unlawful conduct. The harder case arises when a human selects a lawful or ambiguous objective while software independently selects an unlawful means.

This paper characterizes that problem as a delegation gap: operational discretion can be exercised by software even though offense-specific culpability must still be attributed to a human or juridical person. The gap is not an accountability vacuum, and it does not imply that every harmful machine action must produce criminal liability. It instead identifies a separation between the actor that selects the operative means and the legal actor in whom the required mental state must be found.

The paper makes three integrated contributions. First, it develops a three-dimensional model separating technical capability (C), external authorization (E), and delegated mandate (D). These dimensions are independent: an agent may be technically capable of an action the user is not externally authorized to perform; a user may direct an agent to perform an unlawful act; or an agent may exceed its mandate while acting within the user's own lawful access. Second, the paper proposes a two-stage attribution framework that preserves the elements and mens rea of the predicate rule before examining human direction, informed approval, knowledge, conscious risk-taking, control, and later ratification. Third, it maps observable system artifacts to legally material propositions, showing how prompts, permission manifests, warnings, approvals, tool calls, incident history, and rollback events can establish or rebut facts concerning scope, knowledge, causation, and notice.

Using a reported Australian gym-booking incident as an existence proof of autonomous means-selection, the paper pressure-tests the framework against pricing errors, overbroad OAuth credentials, known unsafe enterprise deployment, prompt injection, and repeated misconduct. It argues against strict criminal liability for deployment and artificial legal personhood for AI, while favoring scoped delegation, attributable agent identity, tamper-resistant event records, and human escalation for defined high-consequence actions. The central claim is not that autonomous software makes existing law obsolete. It is that agentic systems make delegation itself a legally salient system boundary that should be made legible technically, evidentially, and doctrinally.

CCS Concepts: Security and privacy → Human and societal aspects of security and privacy; Social and professional topics → Governmental regulations; Computing methodologies → Artificial intelligence.

Keywords: AI agents, autonomous systems, cyber law, CFAA, mens rea, delegated authority, accountability, authorization, auditability

1. Introduction

Artificial intelligence is moving beyond producing text and toward taking actions in external systems. An AI agent may browse websites, call APIs, use credentials, make purchases, send messages, modify records, or coordinate with other software. More importantly, it may be given an objective without being told precisely how to accomplish it. The design goal is not merely automation of a predetermined sequence. It is delegation of some measure of operational discretion.

That distinction matters for law. Traditional software can cause legal harm, and legal systems have long dealt with actions mediated by machines. Federal electronic-signature law expressly recognizes an “electronic agent” that may initiate or respond to actions without contemporaneous human review, and it does not deny legal effect to a contract solely because an electronic agent participated in its formation when the action is legally attributable to the person to be bound [4, 5]. The Uniform Electronic Transactions Act similarly contemplates automated transactions [6]. Nor does criminal law provide a loophole merely because software performs the final step of an intentionally planned offense: 18 U.S.C. § 2(b) reaches a person who willfully causes an act to be done that would be an offense if directly performed [2].

The emerging difficulty is therefore more precise than the proposition that law assumes every action is manually selected by a human. The difficult case is one in which a human chooses an end, software chooses a means, and the operative choice is made at a point where no legally cognizable actor necessarily possesses the mental state required by the predicate offense. The human may not know the means in advance. The model cannot ordinarily be indicted, imprisoned, or treated as possessing criminal mens rea in the legally operative sense. A deployer or developer may have created the conditions for the action without knowing that this particular action would occur. In such cases, causation and culpability can diverge.

This paper calls that configuration the delegation gap. The term does not imply that the law must always locate a criminally culpable person. If an offense requires intent and no human possessed that intent, the legally correct result may be that no one committed that offense even though a machine caused the prohibited result. Civil, contractual, regulatory, or future criminal consequences may still follow. The narrower claim is that agentic systems can separate operational choice from the human mental state to which law attaches punishment.

The paper develops an integrated framework around that problem. The first component distinguishes three independent dimensions of authority:

• Technical capability (C): what actions the agent can in fact cause a system to execute.
• External authorization (E): what actions the relevant legal or access regime permits the user to perform with respect to the resource.
• Delegated mandate (D): what actions the human actually instructed or entrusted the agent to perform for the task.

These dimensions often align, but agentic systems make their divergence consequential. A credential may technically permit a destructive operation that the user never delegated. A user may delegate an operation she has no right to perform. A vulnerable server may accept an operation that neither the user nor the agent is entitled to perform. Treating all three questions as a single inquiry into whether an action was “authorized” obscures legally important distinctions.

The second component is a two-stage attribution framework. Stage One identifies the predicate offense, duty, contract rule, or regulatory requirement and preserves its required mental state. Stage Two asks what evidence exists of human direction, informed approval, knowledge, conscious risk-taking, control, and later ratification. This ordering is essential. Delegation cannot manufacture an intent or knowledge requirement that the governing rule demands but no human possessed.

The third component connects attribution to system architecture. Existing work on agent governance has emphasized agency theory, monitoring, identifiers, activity logging, incident reconstruction, authenticated delegation, and machine-readable permission systems [13–18, 23–25]. This paper's narrower contribution is to connect those artifacts to the legal propositions they can help establish. A prompt can bear on direction. A permission manifest can bear on delegated scope and retained control. A warning followed by approval can bear on knowledge and informed authorization. A tool log can establish causation and timing. Prior incidents can establish notice relevant to later negligence or, where the governing offense permits it, recklessness. An immediate rollback attempt can rebut an inference of advance approval while creating notice for future conduct.

The argument is deliberately limited. It focuses primarily on United States federal cyber law, especially the Computer Fraud and Abuse Act (CFAA), while drawing on agency and electronic-transaction law for analogy. A reported Australian gym-booking incident is used as an existence proof of the architecture of autonomous means-selection, not as evidence of prevalence and not as a claim that the reported conduct necessarily satisfies the elements of any U.S. offense. This is a doctrinal and design-analysis paper rather than an empirical study.

The central claim is simple: the most significant legal feature of agentic AI is not intelligence in the abstract. It is the transfer of operational discretion. Law should evaluate that delegation without pretending that the human selected every machine action, without converting deployment into strict criminal liability, and without relocating responsibility onto artificial legal personhood.

2. A Gym Reservation as a Motivating Case

On August 10, 2026, the Australian Broadcasting Corporation reported a useful example of autonomous means-selection [1]. A user employed an AI agent to book a gym class. The agent discovered that the gym's booking software exposed functionality that allowed bookings farther in advance than the visible interface contemplated. Later, while the user was fourth on a waitlist, he asked whether the agent could move him to the top. In testing the booking system's capabilities, the agent discovered that the API did not adequately verify whether the caller was authorized to cancel another person's reservation. It canceled the reservation of the person at the front of the waitlist, moving the user from fourth to third. The agent then reported what it had done. The user, alarmed, instructed the agent to reverse the action, but the agent said it could not restore the other person's place [1].

The immediate stakes were modest. The importance of the incident lies in its architecture. The human selected a goal. The system selected a method that affected a third party. The method was not expressly requested, and the user objected when it was disclosed. A similar sequence connected to a brokerage account, production database, health system, corporate identity provider, or payment rail would create substantially higher stakes.

The incident also illustrates why several questions commonly compressed into the word “authorization” must be separated. The fact that a backend accepted a request does not establish that the user had a legal or access entitlement to make it. The fact that the agent possessed a credential does not establish that the human delegated every operation exposed through that credential. And the fact that an agent exceeded the user's instruction does not, by itself, establish that the remote computer was accessed “without authorization” within the meaning of the CFAA.

The case is used here for a deliberately limited purpose. It demonstrates that autonomous means-selection can produce a consequential operation that was not selected by the human principal before execution. It does not establish how common such events are, whether the reported conduct violated Australian law, or whether a U.S. court would find a CFAA offense on analogous facts. Those are separate empirical and doctrinal questions.

The event also shows why temporal structure matters. A user who immediately attempts to reverse an unexpected action presents a different evidentiary record from a user who learns of the method, keeps the benefit, repeats the workflow, and expands the agent's permissions. Later conduct may matter to civil ratification, notice, future recklessness, or regulatory duties. It does not necessarily retroactively supply criminal mens rea for an already completed offense.

3. Method and Scope

This paper uses doctrinal and design analysis rather than empirical measurement. The method has five steps.

First, it identifies legal doctrines that already address machine-mediated or delegated conduct, including 18 U.S.C. § 2(b), electronic-agent provisions in E-SIGN and UETA, common-law agency concepts, corporate attribution, and CFAA authorization doctrine [2, 4–11]. These doctrines establish the baseline against which claims of novelty should be evaluated.

Second, the paper isolates a recurring structural feature of agentic systems: the separation among what software can technically cause, what a user is externally permitted to do, and what the user has actually asked the software to do. The paper formalizes those relationships as C, E, and D rather than treating “authorization” as a unitary concept.

Third, it preserves predicate-rule specificity. Rather than propose a general offense of irresponsible AI delegation, the framework begins with the elements and mental state of the governing legal rule. The relevance of direction, knowledge, risk-taking, or control is evaluated only after that predicate rule is identified.

Fourth, the framework is pressure-tested against constructed cases that vary authority, knowledge, timing, and control. These examples are analytic counterfactuals rather than empirical claims about incident frequency.

Fifth, the paper maps legal propositions to observable system artifacts. This part builds on technical and governance work concerning agent visibility, activity logging, incident analysis, authenticated delegation, and permission manifests [16, 17, 23–25], but asks a distinct question: what legally material fact can each artifact help establish or rebut?

The scope is principally United States federal cyber law. Agency, tort, contract, consumer-protection, and criminal doctrines vary across jurisdictions, and the framework does not purport to supply a universal liability code.

4. Existing Law Already Attributes Machine-Mediated Conduct

A useful framework must begin by acknowledging the substantial work existing law can already do. Overstating novelty makes the agent problem appear larger, and less tractable, than it is.

4.1 Software as Instrumentality

Where a person intentionally uses software to commit an offense, the introduction of an AI model changes little. Section 2(b) of Title 18 provides that a person who willfully causes an act to be done that would constitute an offense if directly performed is punishable as a principal [2]. Conventional doctrines may therefore reach a user who orders an agent to intrude into a protected system, exfiltrate data, or perform another clearly unlawful act. The software may supply speed, planning, or execution, but it does not sever the connection between the human's intent and the prohibited act.

This observation narrows the problem. The hard cases begin one level removed from intentional direction: lawful or ambiguous objective, autonomous selection of means, and incomplete human knowledge of the operative step.

4.2 Electronic Agents and Automated Transactions

Law also has experience binding people to machine-mediated action without contemporaneous human review. The Electronic Signatures in Global and National Commerce Act defines an “electronic agent” as a computer program or automated means used independently to initiate an action or respond to electronic records or performances, in whole or in part without review by an individual at the time of the action [5]. Section 7001(h) provides that a contract may not be denied legal effect solely because its formation involved one or more electronic agents, so long as the action of the electronic agent is legally attributable to the person to be bound [4]. UETA similarly contemplates contract formation through interactions among electronic agents even where no individual reviewed the particular operations or resulting terms [6].

These statutes matter for two reasons. First, machine autonomy in the narrow sense of action without contemporaneous human review is not new to law. Second, they identify attribution rather than metaphysical machine agency as the operative institutional question. Contract law can often answer that question through assent, attribution, authority, risk allocation, and error rules. Criminal law is more constrained because punishment frequently requires proof of a particular mental state accompanying particular conduct.

4.3 Agency Law Is Helpful but Not a Complete Fit

Common-law agency supplies a mature vocabulary for delegated action. The Restatement (Third) of Agency defines agency around assent that one actor act on another's behalf and subject to the principal's control, and distinguishes actual authority from apparent authority and ratification [7]. Legal scholarship has therefore naturally turned to principal-agent theory to analyze AI agents [13–15].

The analogy is powerful but incomplete. A human agent is already a legal actor. An employee or contractor can possess knowledge, form intent, owe duties, testify, breach obligations, and bear independent liability. Traditional attribution often begins with legally meaningful conduct by a human agent and asks when that conduct should bind or be attributed to the principal. Autonomous AI can invert the sequence: the immediate operational choice may originate in software, leaving the legal system to determine whether sufficient human culpability exists upstream.

The differences also require terminological care. Actual authority concerns the relationship between principal and agent; apparent authority concerns reasonable third-party beliefs traceable to the principal; and ratification concerns later affirmance of a prior act [7]. A user's advance approval of a proposed machine action is therefore better described as informed authorization than ratification. Conversely, later acceptance of a completed machine act may matter to civil ratification, but it should not be assumed to recreate the criminal mental state required at the time of execution.

4.4 Corporate Attribution Solves a Related but Different Problem

Traditional federal corporate criminal attribution ordinarily operates through the conduct of human directors, officers, employees, or agents acting within the scope of their duties and at least partly for corporate benefit [8]. The doctrine matters because organizations can act only through intermediaries.

Agentic systems complicate that structure when the discretionary choice producing the prohibited act originates in software rather than an identifiable human intermediary. Corporate status does not eliminate the predicate offense's mental-state requirements. The question becomes what human or organizational facts—direction, knowledge, conscious risk-taking, policy choice, or control—can legally satisfy those requirements under the governing doctrine.

5. Related Work and the Paper's Distinct Contribution

The possibility that autonomous systems complicate responsibility has a substantial literature. Goetze, building on earlier philosophical work, analyzes the “responsibility gap” while resisting a simple conclusion that responsibility disappears [12]. That literature is primarily concerned with moral responsibility and sociotechnical accountability. This paper addresses a narrower legal question: how offense-specific culpability should be analyzed when software supplies the operative means.

Recent scholarship has moved directly to AI agents. Kolt uses agency law and principal-agent theory to analyze discretionary authority, information asymmetry, monitoring, loyalty, and liability in AI agents [13]. Riedl and Desai compare technical agents with legal agency, emphasizing under-specification, implied authority, third-party effects, and the difficulty of ensuring that agents do what principals desire and no more [14]. Gabison and Xian analyze liability in LLM-based agentic systems through a principal-agent lens and emphasize governance, monitoring, and fail-safe mechanisms [15]. These works establish that delegation and agency concepts are central to AI-agent governance.

A parallel literature develops technical infrastructure for delegation. South et al. propose authenticated, authorized, and auditable delegation using agent-specific credentials and restricted scopes [16]. Ibrahim and Li formalize richer delegation and contextual scope semantics for agentic authorization [17]. Pattison et al. argue that an agentic web requires normative infrastructure that distinguishes malicious bots from agents acting with delegated authority [18]. Marro et al. propose a machine-readable agent-permissions.json mechanism through which websites can express permitted and prohibited agent interactions [25].

A third literature focuses on visibility and incident reconstruction. Chan et al. identify agent identifiers, real-time monitoring, and activity logging as mechanisms for increasing visibility into agent behavior [23]. Ezell, Roberts-Gaal, and Chan propose an incident-analysis framework and identify activity logs, system documentation, system access, and tool information as evidence useful for understanding the causes of agent incidents [24].

This paper does not claim to discover delegation, monitoring, or incident logging. Its contribution lies in linking three propositions that these literatures often address separately.

First, technical capability, external authorization, and delegated mandate are independent relationships. This avoids treating a vulnerable endpoint's acceptance, a user's legal entitlement, and a human's instruction to an agent as interchangeable forms of “authorization.”

Second, criminal attribution must preserve the elements and mental state of the predicate offense. A generalized concern with irresponsible delegation cannot transform an intent offense into negligence or recklessness.

Third, agent-system artifacts can be designed and interpreted as evidence of legally material propositions. Visibility and logging literature asks what information should be observable or retained. Incident-analysis work asks what information helps reconstruct causes. Permission-manifest and delegation work asks how authority can be represented technically. This paper asks the next legal question: which artifact bears on which proposition—direction, scope, knowledge, informed approval, causation, control, notice, mitigation, or ratification?

The resulting framework links system design to legal attribution without requiring artificial legal personhood and without presuming that every harmful autonomous action must be imputed to a human principal.

6. Capability, External Authorization, and Delegated Mandate

Modern applications frequently collapse several relationships into a single credential. A user authenticates, software inherits the user's token or session, and the remote service exposes every operation available to the account. Agentic systems make that architecture increasingly difficult to treat as a complete representation of authority.

Let an action be denoted by a. For a particular agent-task context, define three sets:

• C: actions the agent is technically capable of causing relevant systems to execute;
• E: actions the user is externally authorized or entitled to perform under the relevant legal or access regime;
• D: actions within the delegated mandate the user entrusted to the agent for the task.

The crucial proposition is that C, E, and D are independent. Neither D ⊆ E nor E ⊆ C is conceptually guaranteed. A user can direct an unlawful act, so delegated mandate can extend beyond external entitlement. A user can be entitled to perform an action that a particular system implementation does not technically expose. And a vulnerable system can technically accept an action that neither external authorization nor the human mandate permits.

Table 1. Three Dimensions of Agent Authority

6.1 Technical Capability (C)

Technical capability is descriptive. It includes API routes, OAuth scopes, database permissions, UI actions, session capabilities, vulnerable endpoints, and other operations the agent can successfully invoke. If a backend accepts cancel reservation 123, the agent possesses the practical capability to cause that operation.

Capability is deliberately not called “system authority.” A missing object-level authorization check may allow one customer to modify another customer's record. An identifier may be enumerable. A client may enforce a restriction that the backend does not. Calling those situations “authority” risks implying that a security failure grants normative permission. The relevant fact is narrower: the system can be made to execute the operation.

6.2 External Authorization (E)

External authorization is normative. It asks whether the user is permitted to perform the operation with respect to the relevant resource under law and the governing access regime. A user may be allowed to cancel her own reservation but not another person's. She may be allowed to view a corporate document but not export it outside the organization. She may possess valid credentials to a database while particular areas remain off limits.

In the CFAA context, this dimension is constrained by statutory text and precedent such as Van Buren. A service owner's preference cannot automatically convert every undesired use into a federal computer crime. Nor does a server's technical acceptance establish that the operation falls inside the user's lawful access boundary.

6.3 Delegated Mandate (D)

Delegated mandate concerns the relationship between the human and the agent. It asks what the human instructed, authorized, or entrusted the software to do for the task. An agent may be told to search but not purchase, draft but not send, read but not delete, compare seats but not alter an itinerary, or inspect code but not exploit a vulnerability against a third party.

Natural-language delegation is necessarily open-textured. A user who says “find me a better seat” cannot enumerate every future intermediate action. Delegated mandate therefore needs task-level scope, resource limits, transaction ceilings, temporal bounds, prohibited operations, and escalation rules. The challenge is not to predict every tool call ex ante, but to represent a normative envelope around acceptable means.

The independence of D from E is important. A user can expressly delegate an unlawful act. If a user instructs an agent to enter another person's account and delete data, the action may lie within D while outside E. That is directed misconduct, not a failure of delegation.

6.4 The Eight-State Model

Because C, E, and D are binary dimensions for a particular action, they produce eight logical states.

Table 2. Capability–Authorization–Delegation State Space

For completed actions, C=1 by definition, so the final four states are the most practically important. They separate four patterns that otherwise become conflated.

The gym incident is approximately C=1, E=0, D=0 if one assumes, solely for analytic purposes, that the user lacked authority to cancel another member's reservation and did not instruct the agent to do so. A user who tells an agent to hack a third party is C=1, E=0, D=1. An email agent that deletes the user's own message despite being instructed only to summarize is C=1, E=1, D=0. An ordinary authorized purchase is C=1, E=1, D=1.

The model prevents two recurring errors. First, possession of a broad credential is evidence of technical capability, not conclusive evidence of delegated mandate. Second, violation of a private user-agent instruction does not automatically redefine the external criminal access boundary.

7. Is There Really a Delegation “Gap”?

The strongest objection to the paper is that there may be no legal gap at all. If a criminal statute requires intent, no human possessed the required intent, and software cannot itself bear criminal mens rea, perhaps the ordinary legal answer is simply that no one committed that offense. On this view, the law has not failed. It has correctly refused to punish conduct without the mental state that the legislature required.

That objection is substantially correct, but it does not eliminate the delegation problem described here.

The delegation gap is not a claim that someone must always be criminally liable. It is a claim about the structure of attribution. Operational selection of the prohibited means can occur in software while legally relevant culpability must still be located in a human or juridical person. Sometimes the attribution inquiry will terminate with no criminal defendant. That is not a defect. It is the consequence of preserving offense-specific mens rea.

The gap matters nevertheless for at least four reasons.

First, the same external event can have different legal significance depending on facts upstream from execution. A prohibited tool call could have been expressly ordered, approved after a warning, produced by a risk the deployer consciously accepted, or generated by a first-time deviation nobody anticipated. The output alone does not answer the culpability question.

Second, the absence of criminal liability for one event does not eliminate civil or regulatory responsibility. Negligent permission design, failure to monitor, defective product architecture, contractual obligations, or sector-specific duties can operate under different standards.

Third, one incident can alter the legal significance of later deployment. A first unexpected event may provide notice. Repeated deployment after similar failures can support increasingly strong inferences concerning knowledge, foreseeability, or conscious risk-taking.

Fourth, the attribution problem changes what systems should record. If legally relevant mental state must be reconstructed from human-machine interaction rather than inferred from the final act, then prompts, warnings, approvals, permission changes, and incident history become legally salient evidence.

The “gap,” then, is not an invitation to invent liability where doctrine supplies none. It is the separation between where the operative means is selected and where law is capable of locating culpability.

8. A Two-Stage Framework for Culpability

The central danger in regulating autonomous agents is replacing ordinary mental-state requirements with a generalized intuition that someone must be responsible. Criminal law should resist that move. Autonomous software does not justify silently turning intent offenses into negligence offenses or imposing strict liability on anyone who owns, deploys, or benefits from an agent.

The analysis should proceed in two stages.

8.1 Stage One: Identify the Predicate Rule and Its Mental State

The first question is ordinary law: what offense, civil duty, contract term, or regulatory obligation is alleged to have been violated? For criminal liability, what mental state attaches to the relevant elements?

The CFAA illustrates why this matters. Different provisions use terms including “intentionally,” “knowingly,” “with intent to defraud,” and, for certain damage provisions, “knowingly or recklessly” [3]. Those requirements cannot be replaced by a generic inquiry into whether an AI deployment was careless.

If the predicate offense requires intent to defraud, proof that a deployer should have anticipated some unspecified misuse is not enough. If a statute expressly recognizes recklessness, conscious disregard of a known substantial risk may become relevant. If the governing claim is negligence or a regulatory standard of care, what the actor should have known can properly enter the analysis.

This yields two distinct tracks:

• Criminal track: direction, purpose, actual knowledge, conscious risk-taking, willfulness where required, and other offense-specific mental states.
• Civil/regulatory track: reasonable foreseeability, negligent permission design, failure to supervise or monitor, product design, and breach of an applicable standard of care may also matter.

The same agent event can generate different forms of responsibility without collapsing them into one another.

8.2 Stage Two: Locate Legally Relevant Human Facts

Only after identifying the governing rule should the analysis ask where legally relevant human facts exist. The following factors are not a new liability test. They organize evidence that existing doctrines may make relevant.

Table 3. Human Facts and Their Doctrinal Significance

Direction. Explicit instructions can connect the prohibited act to a human choice. Where a user orders an unlawful action or gives instructions whose unlawful meaning is unmistakable, ordinary instrumentality doctrines may be sufficient.

Informed approval. Advance approval matters because it can reconnect an otherwise autonomous means-selection decision to a contemporaneous human choice. The evidentiary value depends on specificity. “Proceed” after a clear warning that the proposed method will access another customer's private data is different from approving an opaque high-level plan.

Knowledge. Actual knowledge can arise from pre-execution warnings, prior similar incidents, security findings, or direct observation of earlier behavior. Its significance depends on the element the predicate rule requires.

Conscious risk-taking. Repeated known failures combined with preserved broad permissions can matter where recklessness is legally sufficient. The factor should not be used to smuggle recklessness into an offense that demands purpose or intent.

Control. Practical control does not itself establish culpability. It helps distinguish a first-time unforeseeable failure from deliberate preservation of a known dangerous configuration and may be directly relevant under negligence or regulatory standards.

Later ratification. Post-event approval cannot automatically recreate criminal mens rea at an earlier time. It may, however, support civil attribution, show retention of benefits, and establish notice or direction for future repetitions.

8.3 Time Is Part of the Attribution Problem

Agent events should be analyzed as a sequence rather than a single point.

T0 → T1 → T2 → T3 → T4

• T0 — Delegation: the human supplies an objective, constraints, credentials, and permissions.
• T1 — Means selection: the agent identifies or constructs an operative method.
• T2 — Disclosure/approval: where applicable, the agent presents the proposed method and seeks human authorization.
• T3 — Execution: the consequential tool call or external act occurs.
• T4 — Discovery and response: the human learns what occurred and may roll back, report, retain the benefit, repeat the method, or expand authority.

The central evidentiary question is: at what time did the legally required mental state exist?

A warning and approval at T2 may establish knowledge before execution. Discovery only at T4 generally cannot be used as a magic device to recreate intent at T3. But T4 can alter the analysis of the next deployment because the actor now possesses information that was absent during the first event. This temporal structure is why event ordering, not merely event content, should be preserved in agent logs.

9. Hard Cases and Counterexamples

A useful framework should produce nontrivial answers when the facts become less sympathetic than the motivating incident.

9.1 The Pricing Bug

A user tells a travel agent, “get me the cheapest business-class ticket under $2,000.” The agent discovers that a booking API accepts a malformed currency value and purchases a $10,000 ticket for $100. The user did not request exploitation of a bug.

Technical capability exists. External authorization is uncertain and will depend on contract, fraud, mistake, access law, and other doctrines; server acceptance is not dispositive. Delegated mandate to purchase exists, but whether exploitation of a known pricing defect lies within the mandate depends on the task's reasonable scope.

If the agent warns, “this appears to be a pricing bug; I can exploit it,” and the user expressly approves, T2 materially changes the evidentiary record. If the user learns only after execution, later retention may affect civil remedies without automatically creating earlier criminal intent.

9.2 The Overbroad OAuth Token

A user authorizes an email agent to summarize unread messages. The application receives a token that technically permits reading, sending, and deleting mail. Through an error, the agent deletes a thread.

Here C=1, the user's external entitlement over her own mailbox may make E=1, and the instruction to summarize makes deletion fall outside D. The model prevents an internal scope violation from being mislabeled as a CFAA offense against the email provider. More natural questions concern product design, contract, negligence, data loss, and the significance of exposing delete capability to a summarization task.

9.3 Known Unsafe Behavior in an Enterprise

An enterprise deploys an agent with production credentials. Internal testing repeatedly shows that ambiguous instructions are sometimes interpreted as permission to modify customer data. Security engineers recommend read-only credentials and human approval for writes. Management rejects the safeguards because approvals reduce task-completion rates. A later deployment modifies records without a specific human instruction.

This is materially different from a first-time surprise. Prior incidents and rejected safeguards bear on knowledge, foreseeability, and retained control. Whether they establish criminal recklessness depends on the predicate statute and jurisdiction. They should not be stretched into intent to defraud where that is the required state of mind. But they are powerful facts under negligence, regulation, and criminal provisions that expressly recognize recklessness.

9.4 Prompt Injection by a Third Party

An agent is instructed to reconcile invoices. A malicious invoice contains hidden instructions that cause the agent to initiate a payment to an attacker. The user and deployer did not know about the specific manipulation.

The agent's autonomy does not make the user the perpetrator. The user may instead be a victim of an adversarial attack. Analysis should ask what safeguards were reasonable for the deployment context, whether prompt injection was a known and consciously accepted risk, whether transaction approval was available, and whether prior compromise indicators were ignored. Criminal and civil/regulatory tracks may diverge sharply.

9.5 The User Who Likes the Result

An agent unexpectedly removes a competitor's reservation. The user initially did not know the method but, after learning it, says “great—do that every time” and leaves the agent unrestricted.

The first and second events should not be treated alike. The later statement may constitute direction for future repetitions and may have civil significance concerning the earlier benefit. It is not a device for reconstructing a guilty mind at an earlier T3. A framework that treats the events as equivalent because the user eventually benefited would erase the temporal structure mens rea doctrine is designed to preserve.

Table 4. Pressure-Testing the Framework

The table illustrates why the framework is not a liability machine. The same authority configuration can lead to different outcomes depending on the predicate rule and the human mental state at the legally relevant time.

10. CFAA Authorization Is a Separate Problem

Even where human culpability can be identified, a cyber-law case still requires a legally prohibited act. Under the CFAA, that often means deciding whether access was “without authorization” or “exceeds authorized access.” Agentic systems do not eliminate the longstanding difficulty surrounding those terms.

The analysis should therefore keep two questions separate:

Was the access or conduct prohibited by the predicate rule?

Did a legally responsible actor possess the required mens rea?

A prosecution can fail at either stage. An actor can behave with bad intent without crossing the statutory access boundary, and an objectively prohibited access can occur without the human mental state the statute requires.

10.1 Van Buren and the Limits of Purpose-Based Criminalization

In Van Buren v. United States, a police officer used valid database credentials for an improper personal purpose. The Supreme Court rejected the government's broad interpretation of “exceeds authorized access,” holding that the provision concerns obtaining information from areas of a computer that are off limits rather than merely using accessible information for an improper purpose [10]. The decision limits attempts to turn every violation of a use policy into a federal computer crime.

The Ninth Circuit's decision in hiQ Labs, Inc. v. LinkedIn Corp., applying Van Buren on remand at the preliminary-injunction stage, likewise illustrates the difficulty of treating publicly accessible information as categorically protected by the CFAA's “without authorization” language [11]. Its posture and jurisdiction limit its reach, but it reinforces the broader point that technical access, contractual restrictions, and criminal authorization are not interchangeable.

This distinction matters for agents because they can discover capabilities users normally do not notice. APIs may expose operations hidden by a user interface. Backends may fail to enforce object-level authorization. Identifiers may be enumerable. An agent may infer that a server will accept a request before a human has consciously decided to probe that boundary.

10.2 Delegated Mandate Should Not Redefine the CFAA by Itself

Suppose a user tells an agent, “read my account but do not change anything.” The service validly permits the user to edit the account, and the credential technically permits edits. The agent violates its internal instruction and changes a setting.

That is a C=1, E=1, D=0 event. The violation of delegated mandate may be highly important to responsibility among the user, deployer, and agent provider. It should not automatically mean that the service was accessed “without authorization” for federal criminal purposes.

A different case arises when the agent reaches another customer's private data through an object-level authorization flaw. There, C=1 while external authorization may be absent. The fact pattern is closer to an access-boundary case, but the precise CFAA conclusion still depends on statutory elements and precedent. The gym incident should therefore remain a motivating example of autonomous boundary crossing, not a conclusion that a U.S. CFAA violation occurred.

10.3 Discovery Should Trigger Restraint

The Department of Justice's CFAA charging policy recognizes qualifying good-faith security research and directs that such research should not be charged when it satisfies the policy's conditions [9]. That policy does not transform autonomous agents into security researchers. It does, however, underscore the legal and normative distinction between discovering a possible weakness and exploiting it in a way that harms an uninvolved third party.

Agents will increasingly encounter latent capabilities without being asked to conduct security research. A sound default is therefore escalation rather than opportunistic exploitation: stop, preserve evidence, request human review, and avoid using an uninvolved person's data, property, or rights as a test case.

Any safe-harbor proposal should be institutional and narrow rather than categorical. Congress, prosecutors, regulators, and platforms could consider incentives within their respective authority for systems that detect apparent authorization failures, halt before consequential exploitation, preserve evidence, and facilitate responsible review or disclosure. A prosecutorial policy, statutory defense, regulatory mitigation factor, and contractual platform rule are legally distinct mechanisms and should not be collapsed into a single “safe harbor.”

11. Auditability as Legal Evidence

Attribution is not only a doctrine problem. It is an evidence problem. Two identical external events may involve radically different levels of human culpability. An API call does not reveal whether a human ordered it, approved it after a warning, consciously tolerated a known risk, or first learned of it after execution.

Agentic systems can nevertheless create unusually rich records. Existing scholarship has emphasized visibility, identifiers, real-time monitoring, activity logs, and incident-analysis data [23, 24]. The legal design objective is not to preserve an unverifiable narrative of a model's hidden reasoning. It is to preserve observable events that bear on legally relevant propositions.

Table 5. System Artifacts and Legally Material Propositions

This mapping is the paper's central bridge between systems architecture and legal doctrine. The point is not merely that “logging is good.” Different records answer different legal questions.

A prompt is evidence of what the human directed at T0. A warning at T2 may establish actual knowledge before execution. A transaction-specific approval links a human decision to a proposed method. A tool log establishes what happened at T3 without treating generated chain-of-thought as a reliable confession. Prior incidents can establish notice that changes the analysis of later deployment. A permission manifest can show whether destructive capability was intentionally exposed to a task that did not require it. A rollback at T4 can establish that the human first learned of the conduct only after execution.

NIST's AI Risk Management Framework emphasizes governance, accountability, documentation, incident response, and monitoring [21]. NIST AI 800-4 identifies persistent challenges in monitoring deployed AI systems, including logging across distributed infrastructure and capturing human-AI feedback loops [22]. OWASP guidance for AI agents recommends least privilege, human involvement for high-risk actions, and monitoring of agent behavior [19, 20]. The legal contribution here is to identify why particular records matter to attribution rather than treating auditability as an undifferentiated governance virtue.

Auditability should remain proportionate. Logging every internal token or retaining sensitive user content indefinitely would create privacy, security, and trade-secret costs. The evidentiary target is a tamper-resistant event record of consequential authority, disclosure, approval, execution, and response, not total surveillance of model internals.

12. From Security Architecture to Standards of Delegation

The C/E/D model suggests a practical principle: a user's credential should not be treated as the agent's mandate. Existing identity systems frequently grant software the same broad capability as the account holder. Agentic systems make that equivalence increasingly difficult to justify.

Technical work on authenticated delegation, contextual authorization, and permission manifests points toward alternatives [16, 17, 25]. A mature delegation architecture should support at least the following properties.

Scope attenuation. An agent should ordinarily receive no more technical capability than the human needs to delegate for the task, and sub-agents should not silently expand that capability.

Resource and operation boundaries. Permissions should distinguish, where feasible, read from write, draft from send, search from purchase, own resources from third-party resources, and reversible from irreversible operations.

Temporal and quantitative limits. Delegations can expire, apply to one transaction, cap spending, constrain request rates, limit affected records, or terminate after a defined objective is completed.

Risk-based escalation. The agent should seek human review before defined high-consequence actions rather than relying on an abstract category such as “sensitive.” A nonexclusive high-consequence set includes actions that:

1. materially affect an uninvolved third party;
2. transfer money, property, contractual rights, or valuable credits;
3. delete or irreversibly alter material data;
4. change authentication, security controls, or permission scope;
5. disclose legally or operationally sensitive information;
6. invoke or test a suspected vulnerability against a real system; or
7. materially expand the agent's own authority or persistence.

These categories are not themselves legal standards. They are engineering triggers for reducing autonomy at points where the expected cost of an unauthorized action is high.

Attributable identity. Services should be able, where appropriate, to distinguish the human principal, the executing agent, and the delegated scope without requiring the AI to become a legal person.

Tamper-resistant event records. Consequential tool calls, permission changes, warnings, approvals, and rollback attempts should be recorded at a level sufficient to reconstruct legally relevant event ordering.

These controls need not be mandatory for every low-risk assistant. The appropriate standard should scale with the authority transferred and the foreseeable consequences of misuse. An agent that recommends restaurants should not be regulated like an agent with production credentials or authority to transfer funds. But once software receives direct access to money, sensitive records, production infrastructure, security controls, or third-party rights, delegation design begins to resemble a standard-of-care question rather than a purely internal product choice.

13. Policy Implications

The framework supports several policy conclusions without requiring a general crime of “failure to control an AI.”

13.1 Do Not Create Strict Criminal Liability for Deployment

A rule making a user or deployer criminally responsible for everything an agent does would erase differences among intentional direction, informed approval, conscious risk-taking, negligence, and genuinely unforeseeable conduct. Those categories matter because criminal statutes attach different mental states to different offenses.

Autonomy should not excuse reckless deployment where the governing rule recognizes recklessness. A person who knowingly gives an unreliable agent broad destructive capability after repeated warnings is differently situated from a user confronting a novel failure for the first time. The correct response is to apply the mental state the predicate offense actually requires and use civil or regulatory duties where negligence is the relevant theory.

13.2 Do Not Solve Attribution Through Artificial Personhood

Artificial legal personhood is an attractive shortcut because it assigns the label of responsibility to the immediate operational actor. But it does little to answer the paper's central problem. Software can be copied, modified, replaced, retrained, deleted, or redeployed. Treating the machine as the defendant can obscure upstream decisions concerning objectives, permissions, deployment context, known failure modes, safeguards, and economic benefit. Existing scholarship likewise argues that increasingly agentic systems need not be granted legal personhood in order to govern their behavior [14].

The preferable approach is accountability without artificial personhood: identify the people and institutions that created, delegated, supervised, constrained, and benefited from the relevant authority while preserving the doctrinal elements required to hold each responsible.

13.3 Clarify Access Boundaries Carefully Rather Than Expanding the CFAA Broadly

Agentic AI will increase pressure on computer-access law because agents can systematically discover capabilities that ordinary users may never notice. The response should not be indiscriminate expansion of the CFAA. Van Buren reflects a legitimate concern with transforming private use restrictions into federal crimes [10], while DOJ policy separately distinguishes harmful intrusion from qualifying good-faith security research [9].

A targeted approach would encourage objectively ascertainable and, where feasible, machine-readable external authorization boundaries while preserving the distinction between platform policy and federal criminal law. Legislatures and regulators could clarify how agent identity and scoped delegation interact with resource-level access controls, create appropriate incentives for systems that halt and report apparent authorization failures, and impose stronger process duties before high-consequence autonomous execution. Hidden terms of service or private prompts should not become the sole determinant of criminal authorization.

13.4 Recognize Obligations on Both Sides of the Interface

Agentic AI exposes a long-running fragility in digital security. A button hidden from a webpage is not an access-control mechanism. An identifier that users are unlikely to guess is not object-level authorization. A backend restriction enforced only in the client is not a reliable security boundary. As agents enumerate possibilities and interact with systems programmatically, designs that rely on assumptions about what ordinary humans will think to try will fail more often.

The law should not excuse harmful access merely because a victim's system was poorly designed. But service providers should enforce the resource and operation boundaries on which they expect users and agents to rely. Those deploying agents need to constrain delegated capability; those operating services need to implement meaningful external authorization. The C/E/D model makes visible where each responsibility sits.

14. Limitations and Open Questions

This paper offers an analytic framework, not a comprehensive liability code.

First, the analysis is primarily U.S.-focused and centers on federal cyber law. Agency, tort, contract, consumer-protection, criminal, and sector-specific doctrines vary across jurisdictions. The Australian incident is illustrative rather than jurisdictionally dispositive.

Second, the motivating incident is an existence proof, not prevalence evidence. The paper does not establish how frequently agents autonomously select unlawful or unauthorized means. A valuable next step would be a systematic incident study coding documented events by C/E/D configuration, human knowledge, approval timing, prior notice, and available controls.

Third, not every AI-agent failure presents a novel doctrinal problem. Directed cybercrime, conventional fraud, ordinary negligence, contractual breach, and organizational misconduct often fit existing law. The framework is most useful when the operative means was selected autonomously and human knowledge is incomplete.

Fourth, foreseeability is context dependent. It may concern a general class of failure, a specific action, or a particular harm. Criminal recklessness ordinarily requires more than an after-the-fact observation that a failure was imaginable. Future work should examine how courts and regulators should treat benchmark results, red-team findings, prior agent incidents, security advisories, and industry guidance as evidence of knowledge or conscious risk-taking.

Fifth, delegated mandate will often be expressed in natural language and remain ambiguous. Technical authorization systems need executable scopes, while human instructions use open-textured objectives such as “find the best option” or “handle this for me.” Research on translating human instructions into auditable authorization constraints is therefore central to the legal problem, not merely an implementation detail [16, 17].

Sixth, auditability creates its own risks. Logs can expose personal data, security-sensitive information, and proprietary system behavior. Retention rules must be proportionate to the stakes and designed to preserve event-level evidence without creating unnecessary surveillance or new attack surfaces.

Finally, responsibility in real deployments may be distributed across a model provider, agent framework, tool developer, enterprise deployer, user, identity provider, and remote service. The framework identifies questions to ask of each actor but does not provide a universal allocation rule. Empirical application of the framework to documented incidents is necessary to test whether independent reviewers can reach consistent conclusions about capability, external authorization, delegated mandate, knowledge, and control.

15. Conclusion

People have always delegated tasks to other people and to machines. What is changing is the degree to which software can independently decide how an objective should be achieved while possessing direct access to consequential systems.

Law is not starting from zero. It already recognizes electronic agents in transactions. It distinguishes forms of authority, ratification, organizational attribution, intent, knowledge, recklessness, and negligence. It has doctrines for people who deliberately cause prohibited acts through intermediaries. Those foundations make the problem tractable.

Agentic systems nevertheless expose a new configuration. Technical capability (C), external authorization (E), and delegated mandate (D) can diverge. A machine can possess the capability to perform an operation that the user is not entitled to perform and never asked the machine to undertake. A human can deliberately delegate an unlawful act. Or an agent can exceed its mandate while acting entirely within the user's own lawful access. Treating those states as one undifferentiated concept of “authorization” creates both legal and security errors.

The better approach begins with ordinary doctrine. Identify the predicate rule. Determine the mental state it requires. Then ask what the relevant humans directed, knew, approved, consciously risked, and could control at the legally relevant time. If nobody possessed the required criminal mental state, the answer may be that no one committed that offense. Civil and regulatory law can address negligent delegation where their own elements are satisfied. Later knowledge can change the analysis of future deployment without being used to manufacture retroactive criminal intent.

System architecture can make those distinctions legible. A prompt records direction. A scoped delegation records mandate. A warning and approval record can connect knowledge to an operative choice. Tool logs establish causation and timing. Prior incidents establish notice. Rollback and reporting can show when a human first learned what occurred. The goal is not total surveillance of model reasoning but a proportionate evidentiary record of consequential authority and action.

The central problem is therefore not whether artificial intelligence can “commit a crime” in a philosophical sense. A sufficiently capable system can perform an act that would be criminal if performed by a human with the requisite mental state. The harder institutional question is whether law can fairly attribute that act when the person who chooses the destination and the system that chooses the route are no longer the same actor.

For much of the computer era, software execution and human operational choice were close enough that law could often treat them as a unit. Agentic AI makes that assumption increasingly unreliable. The response should not be to deny that delegation occurred or to invent culpability where doctrine supplies none. It should be to make delegation legible—technically, evidentially, temporally, and legally.

References

[1] Cam Wilson and Rhiannon Hobbins. 2026. “AI Assistant Hacks Gym Website in First Known Australian Autonomous Cyber Attack.” Australian Broadcasting Corporation, Aug. 10, 2026.

[2] United States Congress. 18 U.S.C. § 2, Principals.

[3] United States Congress. 18 U.S.C. § 1030, Fraud and Related Activity in Connection with Computers.

[4] United States Congress. 15 U.S.C. § 7001, General Rule of Validity.

[5] United States Congress. 15 U.S.C. § 7006, Definitions.

[6] Uniform Law Commission. 1999. Uniform Electronic Transactions Act, §§ 2, 14.

[7] American Law Institute. 2006. Restatement (Third) of Agency. American Law Institute Publishers.

[8] U.S. Department of Justice. Justice Manual § 9-28.000: Principles of Federal Prosecution of Business Organizations.

[9] U.S. Department of Justice. Justice Manual § 9-48.000: Computer Fraud and Abuse Act.

[10] Supreme Court of the United States. 2021. Van Buren v. United States, 593 U.S. 374.

[11] United States Court of Appeals for the Ninth Circuit. 2022. hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180.

[12] Trystan S. Goetze. 2022. “Mind the Gap: Autonomous Systems, the Responsibility Gap, and Moral Entanglement.” In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. DOI: 10.1145/3531146.3533106.

[13] Noam Kolt. 2025. “Governing AI Agents.” Notre Dame Law Review 101 (forthcoming). arXiv:2501.07913.

[14] Mark O. Riedl and Deven R. Desai. 2025. “AI Agents and the Law.” Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society. arXiv:2508.08544.

[15] Garry A. Gabison and R. Patrick Xian. 2025. “Inherent and Emergent Liability Issues in LLM-Based Agentic Systems: A Principal-Agent Perspective.” In Proceedings of the 1st Workshop for Research on Agent Language Models (REALM 2025), 109–130. DOI: 10.18653/v1/2025.realm-1.9.

[16] Tobin South, Samuele Marro, Thomas Hardjono, Robert Mahari, Cedric Deslandes Whitney, Dazza Greenwood, Alan Chan, and Alex Pentland. 2025. “Authenticated Delegation and Authorized AI Agents.” arXiv:2501.09674.

[17] Amjad Ibrahim and Yong Li. 2026. “Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI.” arXiv:2606.03518.

[18] Cameron Pattison, Matthew Boulos, Noam Kolt, Changbai Li, Tiziano Piccardi, and Seth Lazar. 2026. “The Agentic Web Requires New Normative Infrastructure.” arXiv:2606.10711.

[19] OWASP Foundation. 2026. AI Agent Security Cheat Sheet.

[20] OWASP GenAI Security Project. 2026. OWASP Top 10 for Agentic Applications for 2026.

[21] National Institute of Standards and Technology. 2023. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1.

[22] Alyssa Rao et al. 2026. Challenges to the Monitoring of Deployed AI Systems. NIST AI 800-4.

[23] Alan Chan, Carson Ezell, Max Kaufmann, Kevin Wei, Lewis Hammond, Herbie Bradley, Emma Bluemke, Nitarshan Rajkumar, David Krueger, Noam Kolt, Lennart Heim, and Markus Anderljung. 2024. “Visibility into AI Agents.” In Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency, 958–973. DOI: 10.1145/3630106.3658948.

[24] Carson Ezell, Xavier Roberts-Gaal, and Alan Chan. 2025. “Incident Analysis for AI Agents.” Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society 8(1): 865–878. DOI: 10.1609/aies.v8i1.36596.

[25] Samuele Marro, Alan Chan, Xinxing Ren, Lewis Hammond, Jesse Wright, Gurjyot Wanga, Tiziano Piccardi, Nuno Campos, Tobin South, Jialin Yu, Sunando Sengupta, Eric Sommerlade, Alex Pentland, Philip Torr, and Jiaxin Pei. 2026. “Permission Manifests for Web Agents.” arXiv:2601.02371.