Legislating Human Agency: The Investment Case for the AI AGENT Act
How new federal regulations are tackling tech's walled gardens and creating the next massive wave of startup opportunities in the agency economy.
As America celebrates its 250th anniversary of independence this month, a new fight for autonomy is quietly taking shape in our digital world. Last week, Senator Mark Warner released a discussion draft of the AI AGENT Act. This will fundamentally define who holds the power in our future agentic economy. The core philosophy of the draft bill is entirely about scaling and protecting consumer agency in an increasingly automated digital world. The bill’s main emphasis is how these agents will remain working for users through Custodial User Agents (CUA). Below I summarize the proposed mechanics of CUAs and how this provides a clear framework for investing in the human agency economy.
A Custodial User Agent acts as the user’s authorized representative to manage the user’s online interactions, purchase decisions, user-generated content, and account settings on a large online platform on the same terms as a user. While the text of the bill focuses heavily on technical and regulatory mechanisms, its stated goal is to ensure that “consumers deserve a real choice in the marketplace” and that “AI agents must be accountable to the people they serve”. Fundamentally, the bill recognizes that agents will be able to act and make decisions on behalf of users and wants to ensure there are agents that will truly work for users and not just platforms.
Here is how the bill seeks to both increase and protect user agency:
Increasing Agency Through Delegation
The legislation gives users the legal right to designate agents to navigate online environments on their behalf. Whether an individual wants to manage their social media, book travel, or make personal finance decisions, they can use “trusted custodial agents” to execute those tasks. By forcing large online platforms to accept commands from these third-party agents on the exact same terms as a human user, the bill prevents tech giants from trapping users in walled gardens and ensures consumers have real, competitive choices in how they interact with the internet.
Protecting Agency through Duty of Loyalty
To ensure this technology actually serves the user’s will, the bill builds strict safeguards around how the agent makes decisions. The legislation demands that these agents act with a “duty of loyalty” and strictly in the user’s best interest. To protect user autonomy, an agent is legally prohibited from taking actions that benefit the agent provider to the user’s detriment, and it cannot act in ways that are “inconsistent with the directions or reasonable expectations of the user”.
Ensuring Ultimate Human Control
The bill treats user agency not just as a principle, but as an engineering requirement. It ensures humans retain ultimate control over their digital representatives through several mechanisms:
Explicit Consent: Any authority granted to the agent must be express, specific and revocable.
The Power to Revoke: Platforms and agents must build clear and easy methods that allow users to instantly revoke an agent’s access credentials.
Audit Trails: To ensure an agent isn’t secretly subverting a user’s goals, agents must maintain real-time, auditable records of every action taken on the user’s behalf
In essence, the bill uses regulation to guarantee that when you deploy an AI to act for you, it functions as a true extension of your own agency, rather than a tool for a platform or developer to exploit your data and decisions. Applying this bill back to my previous essay about agentic ordering on DoorDash, this means that DoorDash can have an agent it offers that works for them and also maintain open doors for CUAs that work their users.
Custodial User Agent Providers
Custodial agents are managed by custodial user agent providers. These providers operate or offer one or more CUAs and fit into two main categories. The first are commercial entities and startups that build, host and offer agents to consumers. These entities can monetize their services through direct fees, contextual advertising or affiliate links.
The second category of providers are individual users. The bill explicitly includes an individual user who operates a CUA solely on their own behalf and not for anyone else. This ensures that technically savvy individuals who want to run their own local or open-source AI agents are legally recognized as their own providers.
Within the bill’s framework, the provider is the entity legally responsible for the agent. Before an agent can access large online platforms, the provider must register with the Federal Trade Commission (FTC). The provider is also legally obligated to ensure that any agent it operates complies with the strict fiduciary-like duties outlined in the bill, such as protecting user data and acting strictly in the user’s best interest. If an agent repeatedly violates these duties, the FTC can deregister the provider.
The Next Wave of Investment Opportunity
The draft bill explicitly aims to create a competitive market where agentic AI startups can compete on equal terms with the biggest tech companies, which opens up several distinct investment categories. Because the bill forces large platforms to grant access to registered third-party agents, it removes the barrier of walled gardens and allows investment capital and talent to build specialized services.
Developing Consumer Facing AI Agents
Startups can build and operate “custodial user agents” (CUAs) designed to manage specific consumer needs. The bill highlights high-potential areas such as e-commerce, social media management, online personal finance, travel booking, scheduling and email management. The next wave of consumer applications will abstract away the work to realize user demands and interests.
B2B Agent Infrastructure and Compliance Tooling
Because the draft bill turns concepts like token scoping, secure delegation, and consent user experience (UX) into legal statutory requirements rather than just design choices, there will be a significant need for compliance tooling. There are strong opportunities for teams to build agent orchestration layers and connector infrastructure. These B2B companies would help other developers build the required “auditable consent flows” and provide the standardized credential metadata needed to prove “valid authorization” to large platforms.
Traffic Management and Monetization Systems for Large Platforms
While large platforms are legally required to allow agent access, they are not required to provide unlimited free computing power. The bill permits large platforms to establish “reasonable thresholds” regarding the frequency, nature, and volume of requests a custodial user agent (CUA) can make. If an agent exceeds these thresholds (e.g., checking a product price thousands of times an hour), the platform can assess fees. This creates a massive B2B opportunity to build the API gateways, rate-limiting software, and billing infrastructure that large platforms will need to track, manage, and charge third-party agents.
Specialized Cybersecurity and Threat Detection
Large platforms must protect their networks and are authorized to set strict privacy and security standards for agent access. They have the right to deny access to agents that repeatedly facilitate “fraudulent or malicious activity” or fail to meet security standards. Because platforms must also report suspected violations to the FTC, there is an opportunity for cybersecurity firms to develop threat-detection systems specifically designed to evaluate AI agent behavior, monitor for malicious actions, and automate the denial-and-reporting process for large platforms.
FinTech and Highly Regulated Agents
The bill specifically targets complex sectors like personal finance and electronic commerce. Because the legislation requires the FTC to establish an interagency working group with the Consumer Financial Protection Bureau (CFPB), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC), there is a distinct opportunity for FinTech companies. Startups that can navigate both the new CUA fiduciary duties and existing financial regulations will be uniquely positioned to build specialized agents capable of autonomously managing consumer wealth, banking and investments.
Operating as an Independent Certification Body
To accelerate the vetting of agents, the legislation allows the Federal Trade Commission (FTC) to authorize independent certification bodies. This creates a business opportunity for auditing and compliance firms to evaluate CUAs, test their security mechanisms, and grant certifications that create a legal presumption that the agent complies with FTC rules.
Shaping the Foundational Protocols and Standards
The bill directs the National Institute of Standards and Technology (NIST) to identify or develop model technical standards and open protocols within 180 days of enactment. These standards will govern critical functions like verifiable delegation, identity verification, and real-time revocation across the internet. Because these protocols must be free from licensing fees and patent restrictions, tech consortiums, open-source communities, or engineering firms that can rapidly build and propose these protocols have the opportunity to architect the foundational plumbing of the agentic internet.
How to Shape Our Future Economy
Of all the opportunities an agentic economy presents, the most timely is shaping the foundational protocols and standards that will define the rules of the new game. That is because this bill is an initial draft, meaning it is open for public comments.
Warner’s office is collecting responses through a public feedback form, and no deadline has been set, which is the best reason to move now rather than wait. You can submit your feedback directly on his site here, https://www.warner.senate.gov/submit-your-ai-feedback/. You can also send it directly to AI_Feedback@warner.senate.gov.
Lastly, I am forming a small consortium to provide a more detailed thought piece focused specifically on the protocols and standards to be considered. Please reach out to me directly if you have an interest in participating.