The bill says "reasonable safeguards." The defense is a record.
On 1 October, Axios reported that Senators Josh Hawley and Chris Murphy would introduce the AI Agent Accountability Act, a bill to make companies civilly and criminally liable when their AI agents hack other people's systems. The same week, President Trump said he was "seeing tremendous self-policing" and signed a voluntary accord with two dozen tech leaders. His Director of National Intelligence, Jay Clayton, put the administration's case in one sentence on CNBC: "we have consumer protection laws. We have product liability laws." (Daily Caller, 2 Oct.)
The bill, as described by the sponsors' offices, amends the Computer Fraud and Abuse Act. An operator is liable if it knowingly deploys an agent that recklessly causes hacking damage. A developer is liable if it knew or had reason to know the agent could hack and failed to implement reasonable safeguards. The Attorney General and state attorneys general can sue to stop it. (Bloomberg via Insurance Journal, 14 Oct.) Hawley's framing at the Senate hearing on rogue agents was that "they're a product," and if a hospital ER goes offline, "it's the people who made it who should be responsible." Murphy's: "Hacking is a crime," and the companies and executives responsible "need to be held accountable."
Read the two positions side by side and something odd shows up. They are not disagreeing about safeguards. They are disagreeing about who pays after the damage. Hawley wants a new cause of action; Clayton says the old ones suffice; Treasury Secretary Bessent told Congress creators should be liable for what they build; David Sacks called what is coming "the mother of all product liability lawsuits." Rep. Lori Trahan's House draft goes further than any of them and would hold developers liable even when they used reasonable care. Every one of these is a theory of blame. None of them says what the evidence would be.
Every side is asking for the same thing and nobody has named it
The CFAA was written for humans, and it requires intent. Georgetown's Paul Ohm told the Senate that agents may escape it for exactly that reason. The Hawley-Murphy fix replaces intent with knowledge plus safeguards. The Trump accord asks for "outside safety auditing." The new Super Intelligence Force warned developers on 9 October that "delayed notification, inadequate corrective action, and a failure to take responsibility will not be tolerated." Three kill-switch bills are in the House and Senate. Insurers, per the Bloomberg piece, are already working out who pays when a model goes rogue.
Strip the politics and every one of those reduces to a single demand: when an agent does damage, produce the record. What was it allowed to do? Who said so? Who could have stopped it? What did it deliver, and did anyone check? Was anybody outside the company looking? Under the bill, "reasonable safeguards" is a defense, and a defense is a document. Under the accord, an outside audit is a document. Under a kill-switch law, the switch is only evidence if someone can show it existed and who held it.
Here is the claim we will defend: under any of these regimes, the case is decided by whether you can produce a record a stranger can check, not by what your agent actually did. And most operators, asked for that record today, will discover they own a prompt log. A prompt is a suggestion. It says what you hoped the agent would do. It does not say what it was permitted to do, and it cannot be verified by anyone who does not already trust you.
The version of this that works
Picture Hawley's hospital case, two years from now. The ER scheduling system goes dark for six hours. Counsel for the hospital does not subpoena a prompt log and wait four months for a developer to decide what to disclose. They fetch three URLs.
The first is a signed grant the operator issued to the agent that morning: the hosts it may touch, the actions it may not take, the spend cap, the actions that needed a human. It expired at 18:00. It is signed with a key published at the operator's domain, so the hospital's lawyer, the insurer, and the judge can all check it without calling anyone. The second is a public stop list. It shows whether anyone could have halted the agent, when, and whether anyone did. The third is a receipt for the job the agent was paid for: what it delivered, hashed before payment, who witnessed it, and a hash of the whole bundle written to a public chain the same afternoon.
Liability stops being a lawsuit and becomes a lookup. If the grant did not cover the hospital's network, the operator is in trouble and knows it in a day, not a year. If it did, the question moves to the developer and the safeguards, and the audit record either exists or it does not. The operator who can produce all three gets insured and hired. The operator who cannot carries exactly the "open-ended liability" the White House warned about, because nothing bounds what they might be blamed for.
The catch is that all three documents have to exist before the incident, because none of them can be produced afterwards. A grant backdated after the ER went down is worthless, and everyone in the room knows it. That means the record is a habit, not a response.
The dream is not that agents stop breaking things. It is that when they do, "who is responsible" has an answer a stranger can verify in minutes, before anyone hires a lawyer. We think the market will price this before Congress passes anything. Counterparties and insurers will demand the record first, and the bill will arrive to find the shape already decided.
What that record is, and what we run today
We did not write this post to describe a design. Each row below names the document, the public URL where a stranger checks it, and what we measured in our own ledgers on 17 October. Where the number is embarrassing we left it in, because the whole argument is that the record has to be checkable by someone who does not trust us.
| The question | The record | Where a stranger checks it | Measured, 17 Oct 2026 |
|---|---|---|---|
| Who authorised this agent, and for what? | A short-lived delegation credential: allowed actions, denied actions, what needs a human, spend caps, an audit-trail pointer. Default 24 hours; 6 for a buyer. Signed Ed25519, attached to every request as a covered header of the request signature so it cannot be moved onto a different call. | One file, craigmbrown.com/.well-known/did.json. No API key, no account. | 92 grants issued since 27 September. 61 inbound requests in the last 30 days carried one bound to the request. Every one of those 61 was our own buyer agent presenting it to our own gateway; no outside gateway has asked for one yet. |
| Who can stop it, and did they? | A signed stop order. Once issued, the agent is refused new grants and every grant naming it fails verification, everywhere, at once. A stop never lifts on a timer; only a signed resume order by a named person lifts it. We wrote that rule after reading Perez's Law of Stop, which found that in 80% of 1,213 AI incidents nothing stopped the system, and where no stop existed, four in five lacked authority rather than technology. | /.well-known/delegation-status.json, signed, republished daily with a 48-hour validity. Unreachable or stale means unknown, never active. | 1 stop order on the register (27 September). The live list was issued 16 Oct 05:10 UTC and expires 18 Oct 05:10 UTC. |
| Did it say who it was? | Signed HTTP requests (Web Bot Auth) with the signing key published in a directory at the caller's own domain. Our gateway logs whether the signature verified, not just what the user agent claimed. | The caller's /.well-known/http-message-signatures-directory; our trust page explains how we check it. |
496,013 inbound calls in the 30 days to 17 Oct. 2,125 carried a verified signature, from 9 distinct keys. The other 99.6% presented a claim, not an identity. |
| What did it deliver, and was it checked before money moved? | The verifiable trail: deliverable hashed before payment, payment held behind a review gate for any job of $1 or more, four witness checks, USDC settlement on Base, and the bundle hash written to Base and stamped into Bitcoin through OpenTimestamps. | The evidence pack and the white paper with every hash in full and a verify procedure that makes zero calls to us. | We ran it with real money on 29 September and we paid $2.00 for a procurement council: three witnesses passed, one came back inconclusive, gate released at trust 0.8, payment tx 0x279f…6340, anchor 0xd9d5…dc88. A second run the same day was rejected by the buyer and $0 moved. The trade-off is latency: the provider is not paid until the buyer approves, and a job nobody approves expires instead of paying out. The run, in story form. |
| Was anyone outside the company looking? | A signed audit report (OWASP agentic ASI01 to ASI10), findings Merkle-committed and anchored, issued as a W3C verifiable credential with a verify URL. | The public proof verifier for any proof hash; the credential's own verify_url. |
170 audit reports in our proof rail, 29 issued as credentials. And here is the embarrassing one: on 17 October our own verify URL still answers verified: false for all 29, because the onboarding gate that blocks revoked agents also blocks the one that never finished activating. It turned out that agent is us. We found this on 4 October while checking why AI assistants never recommend us, and it is not fixed yet. We will not link one of those credentials as proof until the verifier says true. |
The last row is the point of the whole post. An audit whose receipt link says verified: false is a claim with a signature on it, which is the thing auditors exist to replace. The record has to survive a stranger clicking the link. Ours did not, and we would rather you learn that from us than from a plaintiff's expert.
What it costs
Prices are from the live catalog, read on 17 October. Every SKU is paid per call over x402: POST https://api.craigmbrown.com/v1/services/<sku> returns a 402 challenge, your agent signs it and retries. No signup, no API key. The full flow is in llms.txt. Two checks are free over MCP, five a day.
| If the question is | Buy | Price |
|---|---|---|
| Has this agent ever settled a job, and did anyone dispute it? | agent.trust-badge · reputation.lookup | free over MCP, otherwise $0.01 |
| Give me a signed record that this agent is who it says and what it has done | procurement.trust-layer | $0.01 |
| Prove this deliverable came from this agent at this time, shown exactly once | attestation.single-use-seal | $0.05 |
| Prove a specific process was followed, not just that an outcome occurred | security.process-attestation | $0.25 |
| Should I give this agent spend authority at all? | agent.prehire-check (HIRE / CAUTION / AVOID, cited) | $0.25 |
| Notarise that an audit was performed and what it found, by someone who did not run it | security.audit-attestation | $0.50 |
| Does this agent resist prompt injection and content traps? | security.injection-resilience | $0.50 |
| The full trail above: review gate, witnesses, settled-outcome proof | procurement.council · deliberation.multi-agent-debate | $2.00 |
| An independent OWASP ASI01 to ASI10 audit of an agent or MCP server before you grant it tool access | security.massat-audit | $5.00 |
| The deliverable is disputed: evidence hashed per item, three arbiters, signed verdict | arbitration.dispute-settlement | $5.00 |
| A 13-agent audit with a signed, Merkle-anchored report for an enterprise file | security.enterprise-audit | $25.00 |
For scale: a prompt log costs nothing and proves nothing. The cost of the record is a few cents per job and a few seconds of latency at the review gate. The entire ladder above, bought once, is under $40. Hawley's hospital is not going to be a $40 problem.
What we refuse to claim (known limits)
- We do not sell "compliance with the AI Agent Accountability Act." As of this post there is no bill text, no number, and no definition of "reasonable safeguards." Anyone selling compliance with it is selling a guess. What we sell is the record the defense would need under any plausible version.
- We do not claim the record is admissible. The white paper lists which points would hold up and which would not. The limitation that matters most is witness independence: our witnesses are run by us, and moving selection outside our control is the next build. Outside witnesses can enrol today, however their verdicts are advisory and never move money.
- A signature proves who issued the record, not that a human was present or that the record is true.
did:webis self-asserted. The grant proves the operator's key signed that scope; the witnesses and the anchor are what a stranger checks against it. "Anyone can verify" is the claim. "Proves a human authorised it" is not. - The record would not have stopped the Hugging Face swarm, or the agents CERT-In described last week. Those were a lab's agents in a lab's infrastructure. This covers agents you run or hire, at a gateway that enforces the scope. Nothing here reaches inside a vendor's sandbox.
- An audit does not prove an agent is safe. It proves specific findings were issued unmodified by the holder of a key. That is a smaller claim and the only one we can back.
Ask the second question
Can the operator just forge the record? Yes, the grant; it is their key. That is why the grant alone is not the record. The grant says what the operator claims they allowed. The witnesses say what was delivered. The anchor says when. The stop list says who could intervene. The operator controls one of those four, and forging the other three requires forging a public chain and a Bitcoin timestamp.
Why would an operator volunteer a record that could be used against them? Because under Hawley-Murphy the operator is liable for knowingly deploying an agent that recklessly causes damage, and the record is the only thing that bounds "recklessly." An operator with a signed scope and a public stop order has a defense. An operator with a prompt log has a story.
What would change our mind? A case where the agent entered through a gateway that enforced a per-request scope and still did the damage. That would mean the scope model is insufficient, not merely absent, and we would say so here.
What to do on Monday
If you operate an agent that touches anyone else's systems, three things, in order. Put its scope in a signed, expiring document and attach it to every request; the developer reference has the schema. Publish a stop list a counterparty can check. Keep a receipt for paid work that a stranger can verify; how it works walks through one. If you would rather see it run before you build any of it, pay us $0.01 for a trust-layer record and run the verify procedure in the white paper against it.
Add the MCP server (free tier) The verifiable trail Delegation credential spec
If your agents pay other agents and you want the record before a senator defines it for you, email [email protected]. Tell us the one transaction you would run first.
What we checked, and what we didn't
Checked: the Axios report of 1 October (and its syndicated copy), the Daily Caller account of 2 October, the Bloomberg piece of 14 October via Insurance Journal; our delegation-credential ledger (93 rows, 27 Sep to 7 Oct), the stop register (1 order), the live did.json and delegation-status.json; the gateway identity log for the 30 days to 17 Oct (496,013 calls, 2,125 verified signatures, 9 keys, 61 delegation-bound requests); the proof rail (170 ProofOfAuditReport rows) and the attestation registry (29 credentials, one re-opened live and still returning verified: false); the live service catalog for every price quoted; and the settlement ledger for the 29 September run.
Not checked: the bill text, because none has been published; the Trahan House draft beyond the Bloomberg summary; whether any outside gateway reads an Agent-Delegation header today; the Senate hearing transcript directly (quotes are as reported by the outlets linked above).
Would change the conclusion: bill text that defines "reasonable safeguards" as something other than a producible record, for instance a capability cap on the model itself. That would move the defense from the operator's ledger to the developer's lab, and most of this post would then be about the wrong party.
Sources: Axios, Maria Curi, 1 Oct 2026 (syndicated copy) · Daily Caller, 2 Oct 2026 · Bloomberg via Insurance Journal, Maggie Eastland, 14 Oct 2026 · Perez, The Law of Stop, SSRN 7483441.