Can you prove your AI was allowed to do that?

A wire story put a sharp question in front of a lot of readers last month, one that ran on local news stations across the country: an AI agent can spend your money, and proving you authorized it is suddenly the hard part. The occasion was a bill. On July 21, Senator Mark Warner unveiled the AI AGENT Act, which defines an agent acting for you as one whose authority is “transparent, documented, limited and revocable,” and which would make it keep real-time records of what it did. The draft puts NIST on a 180-day clock to find or write the protocols that make all of that provable.

Warner is not the only one. Back in February, NIST opened a standards initiative whose first named gap was agent identity and authorization, the plumbing that decides which agent is allowed to do what. And Google’s Agent Payments Protocol, now backed by Mastercard, PayPal, and American Express, wraps every agent purchase in a signed mandate that spells out the spending limit, the allowed sellers, and how long the permission lasts.

Three different rooms. A senator, a federal lab, a payments consortium. All of them reached the same idea in the same year. An AI agent’s authority cannot be a vibe. It has to be written down, scoped to one job, revocable on demand, and provable after the fact.

That principle is aimed at agents that move money across the open web. It describes something smaller and far more common just as well. The AI answering email at a support desk. Most of those systems cannot answer the wire story’s question at all. Ask what the bot was allowed to do and the honest reply is a prompt, a paragraph of instructions the model was told to follow. A prompt is not a record. It is a wish. When something goes wrong, there is nothing to hold up.

We built Celeste the other way, and we did it before any of this was law.

Her authority is a real state, not a paragraph. Each topic she handles is either graduated to live or it is not. Refund status can be on while cancellations are still in practice. That switch is a fact in the system, set by the owner, that you can look at and flip. Turn a topic off and it is off, the same afternoon. That is the “limited and revocable” the bill is reaching for, already sitting on a settings page.

Every tool she can touch is classified by risk before she is allowed to use it. The owner decides which actions are safe to take on their own and which get held. Nothing that writes or spends runs on the model’s say-so alone.

And the line we never cross is that the AI proposes and hard code decides. Celeste drafts, but an answer that touches money, or crosses a boundary the owner drew, is stopped and handed to a person instead of sent. Every one of those stops leaves a record. So when someone asks what she was allowed to do, and what she actually did, there is a log with a straight answer, not a prompt that everyone hopes was followed.

The pattern the standards are chasing is the pattern already worth having. Give the AI a narrow, explicit grant. Make the grant easy to pull back. Enforce it in code, not in wording. Keep the receipt.

A small business owner does not need to wait for S.5051 to clear the Senate, or for NIST to publish a protocol, to run a desk this way. The point of earned autonomy is that trust gets granted one topic at a time and can be taken back the moment it stops being warranted, and the record of what the agent was cleared to do is the graduation itself, not a promise. That is how the product works today.

The law will catch up to the agents that move fast and cannot show their work. The desks that can already show theirs will not have much to change.