By Gleb Tsipursky, PhD

Rep. Pramila Jayapal’s proposal for a federal AI charter asks a serious question: Which firms should have permission to build and sell powerful AI systems? The most difficult enforcement question comes after a model leaves its developer. Who authorizes the software to act inside a bank, an insurer, a hospital, or a government agency, and how can that authorization be withdrawn when the software goes wrong?

A federal charter could set expectations for developers, require testing, and create a clear consequence for violation. Yet a developer cannot know every action that downstream customers will delegate to an agent. A company may buy a compliant product, connect it to private records and payment systems and grant it broad authority that the developer never intended.

A regulator assessing responsibility needs evidence about that deployment. Promises about responsible AI and model testing will reveal little about whether an individual agent can approve a reimbursement, change a benefit determination, or send confidential material outside the organization.

Microsoft’s October 19 agent-security guidance describes a useful design principle: give each agent a separate identity and only the permissions necessary for a specific task. The company also describes dynamic controls that can remove write access or require human approval when risk changes. That is vendor guidance, and regulators should not treat any vendor’s claims about its products as independent evidence of safety. The underlying permission architecture nevertheless points toward a testable public standard.

Require organizations deploying consequential agents to maintain an authority register. For each deployment, it should name the responsible human executive, identify the systems the agent can access, record the categories of actions it can perform, and show when those permissions expire. It should also distinguish actions a human must approve from those a machine may complete without further review.

An authority register does not need to expose trade secrets or individual customer data. Auditors could inspect redacted records showing what permissions were granted, how they changed, and whether approved limits were enforced. A regulator should be able to reproduce an audit trail for a disputed action without having to trust the model’s explanation of its own behavior.

Then test the revocation mechanism. Can the organization stop an agent from initiating payments while keeping employees able to perform the underlying work? Does the system revoke tokens and access to connected services promptly? Does it preserve evidence for later investigation? If a system cannot be stopped reliably, its deployment risk is not under meaningful control.

Some sectors already have mature audit and approval procedures. Regulation should build on them. Financial institutions may have dual authorization for large transfers, while health systems have established rules for protected patient records. Agent-specific controls should extend those systems, avoiding an entirely separate paperwork regime. Small companies could use standardized registers and tests proportionate to the harm a tool can cause.

Enforcement must account for shared responsibility. A developer should answer for false safety claims or defects in its product. An organization that grants unauthorized access or ignores a documented failure should answer for its own deployment decisions. That distinction would prevent each party from treating the other as the sole source of risk.

The debate over whether AI companies need federal charters will continue. Whatever Congress decides, public accountability requires a way to examine the authority people actually give to agents. Regulators should insist on proof that such authority was limited, monitored, and revocable before a consequential failure forces the question.

Gleb Tsipursky, PhD, a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026)