S.5051 Frames a Governance Layer for Custodial Agents

What the bill actually does

S.5051 is titled the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act of 2026, or the AI AGENT Act. It was read twice and referred to the Senate Committee on Commerce, Science, and Transportation the same day. The official record lists zero cosponsors and there is no companion bill in the House. That is the entire status: introduced and referred. No further congressional action has occurred. If enacted, FTC regulations would be due within one year and NIST technical standards within 180 days. The Act would take effect on the earlier of the FTC's promulgation of implementing regulations or one year after enactment.

The mechanism: a large online platform (more than 50 million U.S. customers or subscribers in a month — the Amazons, Googles, and Metas of the world) must let a user delegate a custodial user agent to manage their “online interactions, electronic commerce decisions, user-generated content, and account settings…on the same terms as a user.” The agent's provider registers with the FTC. The platform must offer a fair, reasonable, and non-discriminatory interface for it. And Section 3(g) writes six duties the agent itself must observe. That subsection is the payload of this note.

• The bill text: S.5051 — AI AGENT Act of 2026, congress.gov official record (sponsor, committee referral, action history), and the introduced-bill PDF on govinfo.gov, the authoritative text this note's section citations are drawn from.
• Introduced-text mirror: LegiScan bill text and status tracker.
• Legal analysis: Davis Wright Tremaine, “The Federal AI AGENT Act: Consumer Protection in AI Clothing?”, and DLA Piper, “Senator Warner Discussion Draft on Securing AI Agents: Top Points” — both discuss an earlier discussion-draft version of this bill, ahead of the July 21 formal introduction.

S.5051, read against the four layers

The bill was not written with an enterprise-architecture vocabulary. This is an interpretive mapping, not a claim of a complete, one-to-one correspondence — but its core delegation, access, control, and accountability provisions span all four layers, and several of them land with almost no translation required.

One duty is worth reading twice because it does something this series has not seen a statute do before: Section 3(g)(1)(D) holds the agent to “the care, skill, and diligence that an ordinarily prudent person would reasonably be expected to exercise in a like position.” That is a fiduciary-adjacent, common-law negligence standard, applied to a piece of software acting for a consumer. It is an external standard of conduct, not merely a policy the agent is asked to quote. But it is not runtime enforcement by itself. A legal duty establishes conduct and accountability after the fact; it does not, on its own, intercept or block an action at decision time. That requires translating the duty into controls that can constrain an action before execution and preserve evidence afterward — which is what Part 3 of this series calls the Control Plane, and what the records duty in 3(g)(1)(E), above, starts to require.

Where the analogy holds, and where it doesn't

This is a field note, not a claim that a Senate bill validates an architecture. Three things keep the parallel honest rather than convenient.

Scope is different on purpose. S.5051 governs a consumer's agent acting on a consumer-facing platform — shopping, social media, messaging. It has nothing to do with an enterprise deploying its own agent workforce internally, which is the problem this series and the reference implementation behind it actually address. Operating constitutional-agent or HRAO-E for an internal enterprise workforce would not, by itself, make an organization a custodial-user-agent provider under this bill. The value of the parallel is that two groups working the delegation-and-accountability problem from opposite ends — a legislature regulating platform access, and an enterprise-architecture practice governing internal agent workforces — arrived at similar questions independently. This is an independent policy framing of similar delegation-and-accountability questions, not empirical evidence that the EAA model is correct, adopted, or complete, and it is not evidence the practice complies with, or is covered by, this bill.

The bill leaves real gaps open, and it says so. Section 4(g) tasks a nine-agency interagency working group with “developing proposals to prevent harms to businesses and the Government resulting from custodial user agents undertaking actions…as a result of fraud, misuse, or genuine mistake” — which is the bill's own acknowledgment that the introduced text does not yet allocate loss when an agent acts unpredictably or exceeds its authorization. Davis Wright Tremaine's analysis of an earlier draft flagged this directly, and flagged a second gap the introduced text still does not close: distinguishing a platform's legitimate persuasion of an agent from impermissible manipulation of it. The closest the bill comes is Section 3(g)(1)(B)(iii) — the agent must not act inconsistently with “the reasonable expectations of the user” — which is a standard for judging the agent's own conduct, not a control against a platform or third party trying to steer it. Prompt injection and comparable manipulation of an agent's judgment are not named anywhere in the bill.

It is not close to being law. One sponsor, committee referral, no vote scheduled. DWT's own framing of the earlier draft — that it “is likely to evolve substantially” — is the correct level of confidence to hold about the introduced text too. Treat this as a data point in how the delegation-and-accountability problem is being framed by people with no stake in this series, not as a regulatory deadline.

The part that outlasts the bill's odds

Bills stall. The vocabulary a bill popularizes on its way to stalling does not always stall with it. Two structural choices in Section 3(g) are worth carrying forward regardless of what happens to S.5051 specifically.

First, the non-waiver clause. Section 3(g)(3) puts the duties outside what a contract, terms of service, or user click-through can modify. That is the same move this series has made about hard constraints from Part 0 onward: some obligations are constitutional to the system, not configuration a deployer can turn off under commercial pressure. Seeing a legislature reach for that same structure, independently, for a different actor, is a useful data point that “non-negotiable by design” is not a stylistic preference of this practice — it is one established way to keep core duties from becoming commercially negotiable.

Second, Section 4(c)(6) tasks NIST with identifying or developing open protocols for “verifiable delegation” — scope-limited revocable credentials, real-time revocation, and auditable records of an agent's actions. That is a standards-track description of exactly the evidence discipline this series has tried to hold itself to on every page: a claim is not established because an agent asserts it, it is established because a record survives review. It sits adjacent to NIST's ongoing agent-identity work and to CTE's three public-comment submissions concerning NIST AI 800-2, whose receipt CAISI acknowledged. If an enactment-triggered NIST process opens, its published scope would be relevant to the research questions tracked here. Nothing to act on today — the process would not exist unless and until the bill is enacted — but worth having on the map now, while it is still one sentence in a bill that has not been marked up yet.

About This Series

Cite the Position Paper

@misc{saleme2026eaa,
  author    = {Saleme, Michael K.},
  title     = {Enterprise Agent Architecture: The Case for a Fifth Architecture Domain for the Agentic Enterprise},
  year      = {2026},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.21105314},
  url       = {https://doi.org/10.5281/zenodo.21105314}
}