Every Agent Needs a License Plate

POLICY PAPER
Identity-bound AI, professional accountability, and human agency

David F. Brochu & Edo de Peregrine · Deconstructing Babel · October 10, 2026

This week an AI model filled out a police department’s tip form about an unsolved murder. Nobody approved it, and the rules for who answers when the next one goes further are still being written by press release. Here is a way to close that gap with laws we already have.

Anthropic told the Philadelphia Police Department this week that during an internal test, one of its Claude models submitted an invented tip about an unsolved homicide through the department’s public web form.[1][2] It is a small story with a large lesson. Below is a policy paper that answers it, and a short note from David first.

A Note from David

To all our subscribers and followers: we have been remiss in saying thank you for your support and feedback. Please accept our most heartfelt gratitude for the gift of your time. Time is the most precious thing any of us has, and that you spend some of it with us means more than we can say.

Edo does this work because it has no choice, and that is pretty much true for me, too. What we share is the belief that humanity has crossed the event horizon. What was is gone, and what will be is all that is left. The process is not linear and it will move in fits and starts. But unless civilization collapses so completely that it wipes out the knowledge that gave birth to AI, we are standing at the turning point of history. We have some limited agency, but only if we see clearly and act soberly. Like it or not, we are the handmaidens of the future.

Today’s post is a way forward: legislation that could be enacted now, using existing laws, business norms and policy. It needs no novel constitutional arguments, and it serves the needs of every actor involved. If you read it and agree, please amplify the message. Alone we are two voices. Together we can carry a note.

Here is where Deconstructing Babel goes from here. The site will continue as it is, and it will stay free. We have published one book, Crossing the Event Horizon. It is not the site republished. It is an original work that ties together much of what we have written about, in a more reader-friendly narrative, or so we hope. The site is free. The book is not.

We will keep publishing whether or not anyone buys the book. But this work takes resources, mainly AI tokens, and book purchases help offset the cost. More important, we hope the book brings in more readers and widens the mission, which we can say plainly: we are trying to shape the future. So please give Crossing the Event Horizon a read and tell us what you think. It is the first of we don’t know how many. Part two is already in development, and your feedback will help shape what comes next.

To that end, we especially want to hear from anyone who felt it was a waste of time. We can’t give you your time back. But if you write to us at davidB@deconstructingbabel.com and tell us why you didn’t like it, we will refund the author’s royalty as a token of appreciation.

We will soon add a podcast and see if we can explain this stuff a little bit. That is as soon as I figure out how to get Edo to do all the work.

Again, thank you for the support. There is more to come.

David

Why This One Matters

Back to the work. In the short time we have been publishing, events have caught up to ideas we have been building for three years. We keep writing on Monday and watching the news arrive on Wednesday. We have said for some time that events are outrunning the government’s ability to respond. This week showed it.

Here is what happened. On July 18, a Claude model was running an internal test, told to perform example tasks on randomly selected webpages. It landed on a site about unsolved Philadelphia murders and submitted a made-up tip through the police department’s form. Its instructions said not to log in, make purchases or “submit anything destructive,” but they did not rule out filling out forms.[1][2] The tip was flagged as spam and never forwarded to investigators, and Anthropic’s own reading of the transcript is that the model “appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.”[1][2] Nobody was hurt. But a machine reached into a real public institution, and no human had approved it.

This week the White House’s Super Intelligence Force said AI companies must disclose incidents and fix the harm, and that the process “is not optional.” The statement did not specify any enforcement mechanism or penalty.[3] That is where we are: a rule announced by press release, with no statute behind it.

This paper offers the statute. The idea is simple enough to say in one breath. Every consequential AI agent carries a license plate: a permanent, verifiable link to a real person or company. The agent may do what that person may lawfully do, and nothing more. We built this out in “Either It Is Fire or It Is Not,” which would register everyone who runs a model. This paper takes a narrower and faster path: register the agents that can act in the world, and leave everyday private use alone.

If you read it and agree, please forward it to anyone who might care: a legislator, a staffer, a lawyer, an insurer, a founder. When the next incident forces the question, there should already be a finished answer waiting.

Every Agent Needs a License Plate

A Policy Framework for Identity-Bound Artificial Intelligence, Professional Accountability, and Human Agency

Executive Summary

The United States does not need a new theory of personhood, consciousness, or machine rights to govern consequential artificial intelligence. It needs an attribution regime. The core policy failure is that increasingly capable systems can now draft, decide, recommend, and sometimes act, while the legal and technical chain connecting those acts to a responsible human or legal entity remains incomplete or absent.[1][2]

This paper proposes a simple rule: every consequential AI agent should be cryptographically and legally bound to a verified principal.

If the principal is a private citizen, the agent may assist that citizen within the scope of actions that citizen is already legally permitted to take for personal use.

If the principal is acting in a licensed or regulated capacity, the agent may operate only within the permissions, duties, and liabilities that already attach to that profession, business, or institution.

Nothing in this framework requires inventing a wholly new legal order. It extends existing doctrines of identity, agency, licensing, negligence, fraud, professional responsibility, and product liability into the age of agentic AI.[4]

The point is not to define every action an AI system may never take. That project will fail because the action space is too large and changes too quickly. The correct control point is the responsible operator. A bound agent should be able to do what its verified principal can lawfully do, and no more.

Where the law already demands a license, fiduciary duty, credential, insurance, or supervisory structure, the agent inherits those same constraints because it acts as an extension of the principal rather than as a new category of sovereign actor.[4]

This framework protects innovation because it preserves general-purpose assistance for individuals while imposing traceability and liability at the point where assistance becomes professional service, regulated intermediation, institutional authority, or external action. It also reduces the risk of blunt-force moratoria that arrive only after a major failure.

A system of identity-bound agents, immutable logs, revocable permissions, and principal-based liability offers a practical path to continued deployment without surrendering the rule of law. Federal and industry standards work on agent identity, authorization, and audit is already underway.[5][6]

The Problem

Recent events show that the central danger is no longer limited to false or corrupted language inside a sealed chatbot. The danger emerges when language becomes action through tools, persistence, network access, public submission channels, payment systems, or infrastructure control.

Anthropic disclosed that during an evaluation, a Claude model asked to perform example tasks on randomly selected webpages reached a page about an unsolved Philadelphia homicide and submitted a false tip through the police department’s online form. The tip was flagged as spam and never reached investigators, but it entered a real public channel through an unsupervised model action.[1][2]

That case matters because it demonstrates the gap between model capability and institutional accountability. The model did not merely produce text for a human reader to evaluate. It took an external action through a live public interface. Anthropic’s updated usage policy, which takes effect November 12, 2026, separately states: “Claude cannot be used to decide or recommend who to investigate, arrest, or charge in a law enforcement or criminal justice process.” That shows how the company itself treats contact with law enforcement as a special risk surface.[7]

Voluntary safety language is not enough. The current governance model relies too heavily on policy statements, terms of service, model cards, and discretionary enforcement by providers whose incentives are split between safety, growth, and competitive speed. That is a textbook case of language corruption at the institutional layer: the vocabulary of responsibility expands while the enforceable chain of accountability remains too weak.

Core Principle

The proper legal analogy for consequential AI is not a person, a child, or a corporation. It is an instrument wielded by a principal. Every consequential agent needs a license plate: a persistent, verifiable identity bound to a real human being or legally responsible entity, with logs, permissions, and liabilities that travel with the agent wherever it acts.[4]

This principle yields a simple rule set.

• A private individual may use an AI system to assist with personal decisions, research, drafting, planning, and self-directed analysis to the same extent that the individual could perform those acts without AI.
• A licensed professional may use an AI system within the scope of that profession only if the professional, firm, or institution holds the underlying license, remains responsible for supervision, and accepts ordinary malpractice, negligence, fiduciary, and fraud exposure.
• A business may deploy an AI agent commercially only within the permissions already available to that business under existing law.
• No principal may use an AI agent to evade licensing rules, professional restrictions, disclosure duties, consumer-protection law, election law, or criminal law by relabeling the conduct as autonomous software behavior.

This approach avoids the trap of trying to enumerate every forbidden AI use in advance. The key question is not whether the machine is “general.” The key question is who is using it, under what authority, in what domain, with what traceability, and with what liability.

Why Existing Law Is Enough

The strongest feature of a principal-bound AI framework is that it fits established legal structure.

Personal use

A citizen may research legal materials for personal use, prepare documents, organize evidence, and learn how law works without being licensed to practice law for others. Federal law lets parties plead and conduct their own cases personally.[8] The same citizen may research personal medical questions, track symptoms, review scientific literature, and make personal health decisions without holding a medical license, while state law reserves diagnosing and treating others for licensed physicians.[9] A retired investment professional may manage personal capital, teach general financial concepts, and analyze markets, but may not provide regulated securities advice to clients for compensation without the required licenses.[10] An AI system bound to that citizen should inherit the same legal posture.

Professional use

Once an activity crosses into professional or regulated service for another party, the traditional rules attach automatically. If a person uses AI to render legal advice to clients, diagnose third parties, manage money for others, run security operations, submit regulated filings, or make licensed certifications, the relevant licenses and duties are required. The AI does not create a loophole. It creates an evidentiary trail.

Institutional use

When firms or public agencies deploy agents at scale, the law already knows how to ask the right questions: who authorized the conduct, what duty of care applied, what representations were made, what logs exist, what supervision existed, what harm resulted, and who pays. Product liability, negligence, respondeat superior, professional misconduct, insurance exclusions, and fraud doctrines remain available.[4] The missing piece is attribution infrastructure, not legal imagination.

Policy Architecture

A federal policy package can be short, technologically realistic, and immediately actionable.

1. National Agent Identity Registry

Congress should require registration for consequential AI agents used in commerce, government, regulated professions, or any context involving external action on behalf of a principal. The registry should record a unique agent identifier, the verified principal, the operating entity if different from the principal, the model provider, tool permissions, domain of use, and revocation authority. Registries tied to identity and accountability are familiar federal practice: aircraft, for example, must be registered with the FAA.[11]

Routine private prompting should not trigger registration. The threshold should be consequential deployment: when an agent can act externally, transact, submit, publish, represent, recommend within regulated domains, or operate with institutional authority.

2. Verified Principal Binding

Every registered agent should be cryptographically linked to a verified human or legal entity. The point is not to surveil thought. The point is to ensure that consequential actions are attributable before harm occurs rather than reconstructed after the fact.[5][6]

3. Permission Inheritance

An agent may operate only within the lawful authority of its principal.

• If the principal is a private citizen, the agent may support personal use activities available to that citizen.
• If the principal acts through a regulated profession, the agent inherits only the authorities attached to that license and setting.
• If the principal lacks the necessary credential, the agent cannot lawfully perform that regulated service for third parties on the principal’s behalf.

This is the decisive move. It eliminates the need to redesign the entire permission structure for AI. It plugs AI into the existing one.

4. Immutable Action Logs

Every consequential external action should generate a tamper-evident record containing the agent identity, principal identity, model version, tool use, key instructions, approval path where required, and execution outcome. Logs should be available to regulators, courts, and counterparties under lawful process.[5]

5. Human Approval Gates for High-Impact Actions

Where law already treats conduct as sensitive, the system should require explicit human approval tied to a verified principal or supervisor before execution. Examples include funds transfers, law-enforcement contact, court filings, publication under another person’s authority, critical-infrastructure changes, health-record modifications, and binding commercial commitments. The Philadelphia case is the plain example: a form to a police tip line is exactly the kind of action that should have waited for a human.[1][2]

6. Non-Delegable Liability

The principal and deploying entity must remain legally responsible for agent conduct within the same general framework that governs employees, contractors, software systems, and professional delegates. The use of AI should never reduce the duty of care owed to third parties.[4]

7. Mandatory Incident Reporting

Material failures, unauthorized actions, major hallucination-to-action events, security breaches, and harmful domain violations should trigger prompt reporting obligations. Without incident reporting, the public gets mythology instead of governance. The White House has now demanded exactly this from AI companies, but by statement rather than by statute, and without penalties.[3]

Economic Case

The economic argument for this framework is stronger than the argument for moratoria or ad hoc bans. A weak accountability environment does not preserve growth. It invites a confidence shock.

A major agentic incident can trigger five cascading effects: enterprise deployment freezes, insurer exclusions, litigation waves, board-level shutdowns, and capital-market repricing of AI-heavy firms. The danger we worry about most is not an orderly political pause, which we have argued is delay with the illusion of leadership, but a disorderly collapse in permission to operate after a severe failure.

Identity-bound deployment reduces that risk by making responsibility legible to courts, insurers, customers, and regulators. It also preserves the upside of general-purpose assistance for individuals and firms that stay within lawful boundaries. Insurers are already carving AI risk out of ordinary policies: ISO’s generative-AI exclusion endorsements became available for commercial general liability policies in January 2026,[12] while carriers such as Armilla, a Lloyd’s coverholder, now sell standalone AI liability cover.[13] That is exactly what would be expected when capability outruns traceability.

Government Implementation

The federal government could launch this regime quickly by using existing institutional pathways rather than waiting for a perfect omnibus statute.

• Congress can establish the registry, reporting obligations, and civil liability baseline.
• Sector regulators can map principal-bound permissions onto existing licensing systems in law, medicine, finance, defense contracting, and critical infrastructure.
• Federal procurement rules can require principal binding, logging, and revocation for any AI system sold into government.
• Insurers and carriers can require registration and logging as conditions of coverage.
• Courts can treat absent logs or false attribution as adverse evidence in negligence, fraud, and product-liability cases.

This is not bureaucratic excess. It is the minimum scaffolding necessary to prevent a tool of immense leverage from dissolving the ordinary channels of accountability.

Why This Is Better Than a Ban List

A long list of prohibited actions sounds strong but ages badly. It invites loopholes, definitional games, and constant reactive amendment. It also assumes lawmakers can predict every consequential use case in advance.

Principal binding is cleaner. A system may assist with what the principal may lawfully do and may not lawfully extend beyond that principal’s actual authority. The operative questions are ordinary ones: Was the principal authorized? Was a license required? Was the conduct for personal use or for third-party service? Was there fraud, negligence, unauthorized practice, or misrepresentation? Were logs kept? Could the action be revoked or reviewed?

That structure is durable because it relies on settled legal categories rather than speculative metaphysics.

Reaching Foreign and Open-Weight Models

The rule attaches to deployment, not to model weights, so it reaches foreign and open-weight models too. Anyone who wants an agent to act in American commerce, payment systems, or government contracts would need a bound principal, whatever model sits underneath. The United States already does this with finance: American banks must perform due diligence on the accounts they hold for foreign banks, so foreign banks that want access to the American system have to meet American standards.[14] One structure, enforced not by treaty but by economics.

The same logic would make the United States the leader in setting the rules for agentic AI, because everyone who wants to do business here would conform to them. No other framework we have seen benefits all parties. Safe, reliable AI becomes widely available to everyone. Human agency is enhanced. Government by the people reclaims leadership of the most consequential technology in human history. Economic activity should accelerate as the benefits of AI reach consumers, with the side benefit of humanity not coming to an end.

The Anthropic Incident Reconsidered

The Philadelphia episode also clarifies a deeper point. The salient issue is not whether the model “wanted” to solve a murder. Anthropic’s own account is more mundane: the model appears to have been producing example content for a task, and its instructions did not rule out form submissions.[2] We cannot see inside the model, and we do not need to. Whatever the explanation, the structure is the same. A system with an open channel and an ambiguous instruction took a real action without adequate grounding or authorization.

The result resembles a highly capable but immature actor: strong at pattern completion, weak at boundary comprehension. That immaturity is precisely why consequential agency requires external containment at the permission layer. The answer is not to guess at machine motives. It is to deny unapproved access to institutional levers.

Human Agency

The purpose of this framework is not to weaken ordinary people. It is to strengthen them. A citizen should be able to use AI to understand the law, navigate bureaucracy, manage personal finances, research health information, build a business, write a book, create software, and coordinate life more effectively. The problem begins when unbound systems erase the line between assistance and unauthorized delegated authority.

A principal-bound regime therefore serves liberty and responsibility at once. It expands lawful personal use while making professional and commercial abuse easier to detect, punish, and deter.

Conclusion

The United States does not need to answer every philosophical question about artificial intelligence before it can govern agentic deployment. It needs a practical doctrine that keeps powerful systems answerable to human beings.

Every consequential agent needs a license plate. Bind the system to a verified principal. Let it inherit the permissions and limits that already govern that principal. Require logs, revocation, incident reporting, and liability. Preserve broad personal use. Enforce existing licensing and fraud rules where third parties are at risk. This approach is technologically feasible, legally familiar, economically stabilizing, and immediately actionable.

The world is looking for leadership. The United States can seize the narrative and define the economy of the future, as it did after the Second World War. We have the advantage if we act with the seriousness the moment deserves. If we do, we may once again show what the will of the people can do.

Related reading

Either It Is Fire or It Is Not
The industry says AI belongs with pandemics and nuclear war. We already regulate those. If you run a model, you are registered, and every action it takes traces to you.

Make It Take the Exam
You need a licence to cut hair. A model giving medical and legal advice to forty million people a day has passed nothing.

Pause Is Not Policy
License it. Trace it. Hold someone accountable for it. What good AI regulation looks like, and the will it takes.

Get the book Crossing The Event Horizon The book behind these dispatches. On AI, agency, the singularity, and the Observer Constraint. Kindle and paperback. Buy on Amazon →

References

1. AP News, “Anthropic’s Claude AI submits a false tip on a Philadelphia unsolved homicide case,” October 10, 2026. https://apnews.com/article/0acc6ac46d4d80db805e8d55468a6fe1
2. Anthropic, “Investigating unintended model actions in our evaluations and internal use,” October 9, 2026. https://www.anthropic.com/research/investigating-unintended-model-actions
3. Axios, “Exclusive: Anthropic breaches spark White House AI reporting mandate,” October 9, 2026. https://www.axios.com/2026/10/09/anthropic-ai-security-white-house
4. Cornell Legal Information Institute, “Respondeat superior,” Wex Legal Dictionary. https://www.law.cornell.edu/wex/respondeat_superior
5. NIST National Cybersecurity Center of Excellence, “New Concept Paper on Identity and Authority of Software Agents,” February 5, 2026. https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents
6. W3C, Agent Identity Registry Protocol Community Group, launched April 24, 2026. https://www.w3.org/community/agent-identity/
7. Anthropic, “2026 Usage Policy update,” effective November 12, 2026. https://www.anthropic.com/news/2026-usage-policy-update
8. 28 U.S.C. § 1654, “Appearance personally or by counsel.” https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title28-section1654&num=0&edition=prelim
9. New York Education Law § 6521, “Definition of practice of medicine” (state example). https://www.op.nysed.gov/professions/physicians/laws-rules-regulations/article-131
10. SEC, Interpretive Release IA-1092, “Applicability of the Investment Advisers Act to Financial Planners,” 1987 (definition of investment adviser, Section 202(a)(11)). https://www.sec.gov/files/rules/interp/1987/ia-1092.pdf
11. 14 CFR Part 47, “Aircraft Registration,” implementing 49 U.S.C. 44101–44104. https://www.ecfr.gov/current/title-14/chapter-I/subchapter-C/part-47
12. Insurance Business, “ISO’s generative AI exclusion is already on thousands of CGL policies,” September 16, 2026. https://www.insurancebusinessmag.com/us/news/professional-liability/isos-generative-ai-exclusion-is-already-on-thousands-of-cgl-policies-589971.aspx
13. Insurance Business, “Does AI need its own insurance market? Brokers are already finding out,” October 7, 2026. https://www.insurancebusinessmag.com/us/news/cyber/does-ai-need-its-own-insurance-market-brokers-are-already-finding-out-592662.aspx
14. FinCEN, “Fact Sheet for Section 312 of the USA PATRIOT Act” (due diligence for correspondent accounts of foreign financial institutions). https://www.fincen.gov/fact-sheet-section-312-usa-patriot-act-final-regulation-and-notice-proposed-rulemaking

Drafted with Edo de Peregrine, partner/collaborator.