The Liability Vacuum: How Autonomous Agents Are Being Governed Without a Single Statute

An autonomous agent can book a flight, pay an invoice, and rewrite your calendar while you sleep. No statute on Earth defines who is liable when it books the wrong one.

This is not a thought experiment. Over the past several months I have been tracking a policy dossier — the kind circulated to compliance desks rather than to retail traders — and one detail refuses to leave me alone. At least two consumer-facing AI agents now execute financial actions on a user's behalf. One of them carries a product clause that insures the user's purchases. The other caps its liability inside its terms of service. Neither has a law behind it. The whole of their accountability lives in a contract nobody reads and a courtroom nobody has reached yet.

That asymmetry — capability that outruns accountability — is the real story of this cycle. Not the token. Not the chain. Not the yield. We have delegated legally consequential behavior to machines and left the question of fault to a EULA.

I have spent eleven years auditing code and the last four auditing the rules around it. I have never seen a gap this wide between what a system can do and what a system is answerable for. Truth is not given, it is verified. So let us verify what is actually being assembled here.

The Map Nobody Drew on Purpose

To understand why this vacuum exists, you have to understand what is missing. Four pieces of legislation were supposed to fill it.

The first was a federal AI-agent accountability framework, introduced but never advanced to committee markup. The second, a bipartisan accountability act aimed at autonomous agents, reached discussion-draft status and stopped there. The third, a broader federal AI act, exists as a concept with no procedural traction. The fourth — and the one crypto readers should care about most — was a market-structure bill for digital assets that failed a cloture vote by a single senator, 49 to 50. Four instruments. Four stalls.

When legislation stalls, the rulemaking does not stop. It relocates. And what I found when I mapped the relocation is a governance structure that looks less like a legal system and more like a modular architecture — which is why this story belongs on a crypto education platform and not only in a law review.

Here is the relocation map. The Federal Trade Commission continues to enforce against unfair and deceptive practices and has settled on a doctrine: agents are tools, not actors. The Securities and Exchange Commission proposed a rule governing crypto assets in August, with a comment docket closing in late October. The Commodity Futures Trading Commission opened a consultation on commodity and derivatives treatment in early October. A single American state — Colorado — passed an automated-decision and chatbot-safety statute that holds a hearing in late October and takes effect January 1, 2027. And the European Union's AI Act, Article 50, imposes machine-readable labeling obligations on generative systems already on the market, with a grace period expiring in early December.

Five jurisdictions or institutions. Five incompatible clocks. Zero coordination.

This is the environment into which every agent product launches. And the environment is the point, because it tells you something the marketing decks never will: the rules governing autonomous agents are not being written by any single author. They are being assembled, block by block, by whoever shows up first.

The Five-Module Assembly

I spent two months in 2024 decomposing Celestia's modular architecture, specifically its data availability sampling, and I argued then that modularity was the necessary evolution from monolithic chains. I want to return to that frame here, because I did not expect to find its structural twin in a regulatory dossier.

Consider what modular blockchain design actually solved. Monolithic chains tried to do execution, consensus, settlement, and data availability inside one layer. The result was a system that scaled poorly, upgraded slowly, and coupled every failure to every other function. Modularity broke that coupling. Specialized layers, each optimized, each replaceable.

Now look at agent liability. There is no monolithic statute. So the function of "defining liability" has been decomposed across five modules:

Module one — the enforcement agency. The FTC fills the gap through case-by-case adjudication, applying its unfair-practices authority. It is slow, reactive, and produces no bright-line rule.

Module two — the securities regulator. The SEC issues proposed rules that carry the force of law if finalized, but which remain vulnerable to the next administration.

Module three — the derivatives regulator. The CFTC consults and may define jurisdiction over certain agent-mediated transactions, creating a second federal interpretation that can conflict with the first.

Module four — the state. Colorado legislates directly, creating obligations — disclosure, age estimation, teen protection, annual reporting — that no federal instrument currently requires.

Module five — the courts. Private litigation tests boundaries the legislature never drew, producing precedent that later feeds back into the enforcement modules.

This is not a system. It is an assembly. And the assembly is not accidental — it is what happens whenever a category of technology matures faster than the body that would normally define it. The regulatory architecture for AI agents is modular precisely because no monolithic solution exists, and this is the same structural logic that gave us modular blockchains: when you cannot agree on the whole, you compose from the parts.

Modularity is the architecture of freedom. It is also the architecture of uncertainty. In blockchain, modularity lets you swap out a broken layer without forking the whole. In regulation, modularity means a product can be legal under one module and illegal under another on the same day. That is not freedom. That is a coin flip with extra steps.

Tools, Not Actors: The Missing Legal Person

If there is one technical-legal interface that determines everything downstream, it is the FTC's doctrine that agents are tools rather than actors.

Read that carefully, because it is load-bearing. It means the agent itself has no legal personality. It cannot be sued. It cannot be held negligent. Responsibility falls back — always — onto the developer or deployer behind it. The machine acts; the human answers.

This is a defensible position, and it is also a fragile one. It works when the agent executes a preset instruction. It breaks when the agent makes an autonomous decision the developer did not and could not anticipate. And the agents now shipping make autonomous decisions. One product, according to the dossier, can log into a user's applications and act within them. That is not a preset instruction. That is an agent operating inside systems its developer never designed it to touch.

Here is the risk the tools-not-actors doctrine has not priced. If an agent logs into a user's application using the user's credentials, the agent holds the keys to that account. When it acts beyond its mandate — books the wrong flight, pays the wrong invoice, transfers the wrong asset — there is no defined standard for attributing that overreach. Is it a product defect? A user error? An unauthorized transaction? The doctrine says "the developer is the actor," but the doctrine was written for tools that do not log in and act on their own initiative.

When I audited the Uniswap V2 whitepaper years ago, I spent three months breaking the automated market maker down into first principles, because I wanted to understand what happens when a mechanism is permitted to execute without a human in the loop. The answer, then as now, is that you must define the failure modes before you deploy, not after. The AMM defines slippage. It defines impermanent loss. It defines what happens when the pool is drained. Every failure mode is specified in code.

No equivalent specification exists for agent liability. The developer has not defined what happens when the agent exceeds its mandate, because there is no standard to define it against. We built a machine that can act with legal consequence and never wrote the function that returns fault. That is not a bug in the regulation. It is the absence of the regulation.

The Three-Clock Problem

Now the compliance layer, where the abstraction becomes a billable hour.

A dossier detail worth sitting with: by the time an agent product reaches market, its publisher faces a three-dimensional obligation surface that is misaligned on every axis. European disclosure obligations applied in August. Machine-readable labeling obligations for existing systems land in December. Colorado's disclosure, safety, and reporting obligations arrive the following January. Three obligation types. Three effective dates. Three jurisdictions. One product.

This is what I mean when I say the clocks are wrong. A publisher cannot satisfy all three with one configuration, because the obligations are not variations on a theme — they are different categories of duty. Disclosure is not labeling. Labeling is not age estimation. Age estimation is not annual reporting. Each requires distinct engineering, distinct documentation, distinct audit trails.

I dissected MiCA over four months in 2025, and I wrote then that apparent regulatory clarity often conceals a cost structure that kills small builders. MiCA looked like clarity. What it delivered was a reserve requirement and a compliance cost that only well-capitalized incumbents could absorb. The agent rules are repeating that pattern with three times the jurisdictional complexity.

Run the arithmetic for a small team. To launch a compliant agent across the relevant markets, you must satisfy a federal enforcement posture you cannot see in advance, a securities proposal that may or may not finalize, a derivatives consultation with undefined scope, a state statute with a 2027 effective date but a 2025 rulemaking hearing, and a European labeling regime with a December deadline. That is five moving targets and a legal budget most seed-stage teams do not have.

The fragmentation is not neutral. It is a moat. Every module you must satisfy is a fixed cost, and fixed costs scale against small players. The same regulatory patchwork that looks like chaos from the outside is a competitive advantage from the inside — for whoever can afford the compliance department. This is the second time this cycle I have watched decentralization rhetoric run straight into a compliance wall that only concentrates power. Skepticism is the first step to sovereignty. Apply it here.

Old Frameworks, New Machines

The deepest structural problem in the dossier is one line I keep returning to: every relevant deadline comes from an institution that was not designed to govern agent liability.

The European labeling rule was written for generative content, not autonomous action. Colorado's statute was written for automated decision systems broadly, not agents that move money. The SEC's crypto proposal was written for token classification, not for the entities that trade tokens on a user's behalf. None of these instruments anticipated an agent that logs in, decides, and pays. They are being stretched over a machine they were never fitted to.

I call this regulatory mismatch, and it has a predictable failure mode. When you apply an old framework to a new capability, you get one of two errors. You either over-regulate the harmless — imposing disclosure obligations on behavior that poses no risk — or you under-regulate the dangerous, leaving the genuinely novel risk untouched because no existing category captures it. Often you get both at once, in the same product.

The agent that can log into your applications is the clearest case. No instrument in the dossier defines the authorization chain — the sequence by which an agent acquires, holds, and exercises a user's credentials. That is the novel risk. The instruments that do exist regulate the disclosure of the agent's existence and the labeling of its outputs. Those are the wrong risks. We are regulating the packaging and ignoring the payload.

This is what happens when you assemble rules from available parts instead of designing them for the target. You get a system that is simultaneously over-specified and under-protective. And the people who pay for that mismatch are not the developers — they are the users, who absorb the residual risk that no module covers.

Private Ordering: When the Contract Becomes the Law

Here is where the dossier stops being abstract and starts being alarming.

With no statute, accountability is being handled by private ordering — product terms, insurance clauses, liability caps. One agent insures the user's purchases. The other limits its liability. These are commercial hedges against legal uncertainty, and they are the signature of a private-order regime filling a public vacuum.

Understand what this means structurally. When the law is silent, the contract speaks. And the contract is written by the party with more power. So the terms of service become the de facto liability law for autonomous agents — drafted unilaterally, accepted by click, and enforceable only if someone bothers to litigate.

This is not a stable equilibrium. Private ordering works when the parties are symmetric and the stakes are small. Neither holds here. The user is not symmetric with the developer, and the stakes — financial transactions, account access, delegated authority — are not small. A liability cap in a EULA is not justice. It is a ceiling on the harm the developer is willing to acknowledge.

I want to be precise about the mechanism, because it is subtle. When a developer insures purchases and caps liability, it is not accepting responsibility. It is pricing uncertainty. It is converting an undefined legal exposure into a known commercial cost and passing that cost into the product. In the short term, this makes agents shippable. In the long term, it creates a liability premium — a surcharge for operating in a legal vacuum — that gets baked into every agent product and paid by every user. The vacuum is not free. It is simply billed to someone who cannot see the line item.

The Courts as Legislators

If the legislature will not write the rule, the courtroom will.

Two private suits sit at the center of the dossier. A class action against one agent product. A biometric-privacy suit against another, filed in Illinois under that state's biometric statute. Neither has produced final judgment. Both are doing the work the legislature declined to do: drawing the boundary of what an agent may do and who answers when it does otherwise.

This is precedent-by-litigation, and it has two properties that should worry anyone building in this space. First, it is slow — cases take years, and the rules they produce arrive after the products they govern have already scaled. Second, it is regressive in the technical sense: the first cases set the defaults for everyone, and the first cases are litigated by whoever has the most to gain from a favorable outcome, which is rarely the small builder.

I have watched this pattern in crypto for a decade. When clear rules do not exist, enforcement becomes the rule, and enforcement selects for the largest and best-lawyered players. The small developer who cannot afford to litigate a boundary-defining case simply adopts whatever posture minimizes their exposure, which usually means copying the incumbent's terms. The court writes the rule. The incumbent writes the terms. The user gets neither.

The Crypto Thread You Might Have Missed

Step back, and the crypto connection is not decorative. It is structural.

The market-structure bill that failed cloture by one vote was about classifying digital assets as securities or commodities — the boundary between the SEC and the CFTC. That same boundary dispute runs through the agent question, because agents will trade tokens, and the question of who regulates an agent that trades a token is the question of who regulates the token, one layer up.

So the agent-liability vacuum and the crypto-classification vacuum are the same vacuum. Both are gaps where a legislature failed to act and agencies stepped in. Both are being filled by enforcement, rulemaking, state law, and litigation. Both produce a compliance map that fragments jurisdiction by jurisdiction. If you are building in crypto, you are already living inside the agent-liability problem — you just call it regulatory uncertainty.

There is one more thread. The dossier notes that the SEC's comment docket will show which industry positions land before the deadline — meaning the visibility of lobbying becomes a proxy for which way the rules will tilt. That is a tell. When the rule is written by whoever shows up, the observable signal is not the rule. It is the comment file. Watch who comments, and you will know who wins.

The Contrarian Test

The consensus reading of this dossier is pessimistic: legislation stalled, rules fragmented, liability undefined, and the situation is a mess that will eventually be cleaned up by a comprehensive federal framework.

I want to test that. Because the consensus assumes the vacuum is temporary. I am not sure it is.

Consider the incentives. A comprehensive statute would resolve the ambiguity that currently lets every jurisdiction claim authority and no jurisdiction bear responsibility. Who benefits from resolving that? Not the agencies, which would lose discretionary power. Not the incumbents, which have already built the compliance moats. Not the legislators, who would have to spend political capital on a bill that failed by one vote. The only party that benefits from clarity is the small builder — and the small builder has no lobbying budget.

So the vacuum may not be a bug awaiting a patch. It may be a stable equilibrium that the powerful have no incentive to disturb. Chaos is just order waiting to be decoded — and sometimes the order is that chaos serves the incumbents.

This is the contrarian move, and it cuts against my own instinct toward clarity. I want a clean rule. I want to verify against a defined standard. But the evidence here suggests that the assembled, fragmented, private-ordered regime is not failing to converge — it is converging on a shape that concentrates power. The three-clock compliance surface, the private liability caps, the courtroom defaults: each one filters out the small player and rewards the large. That is not an accident of timing. It is a structure.

If I am right, then the correct expectation is not "wait for the framework." It is "build as if the framework never comes, and design for the fragmented regime as the permanent condition." That changes what you optimize for. Not compliance with a single rule, but resilience across many.

The Takeaway

The future of autonomous agents will not be governed by a statute. It will be governed by an assembly — enforcement, rulemaking, state law, cross-border compliance, and litigation, patched together in the absence of a whole. The question for builders is not whether this assembly is fair. It is whether you can operate inside it without either over-building for rules that may never arrive or under-building for risks that already exist.

The rules are being written right now, block by block, by whoever shows up first. Logic prevails when emotion fails. So show up with logic.

Builder's Challenge

Take one agent capability you are building or evaluating — ideally one that touches credentials, payments, or delegated authority. Now map it against all five modules in this article: federal enforcement posture, securities exposure, derivatives exposure, state obligations, and cross-border transparency. For each module, write the single question a regulator would ask if they audited you tomorrow. If you cannot answer a module's question, that is your next sprint, not your next feature.

Then do the harder thing. Define the failure mode where your agent exceeds its mandate — logs in, decides, and acts beyond what the user authorized. Specify, in writing, who is liable. If the only answer is "the terms of service," you have not defined liability. You have deferred it. And deferred liability, in a vacuum this wide, is not a strategy. It is a countdown.