We Need Better Infrastructure to Govern AI Agents
Society is not prepared for a flood of agents. We need new protocols and standards, such as Agent ID, to make agents accountable to our legal and financial systems.
Aug 27, 2026
![\"\"/](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e17684/67ed856f465397061394fcb0_odw-ahgg-small-check.svg\")
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6a9070fe36d8b0bfe90da5b6_uc.jpeg\")
Last month, Cloudflare reported that more than 50% of internet traffic is now non-human, including a 1,700%+ increase in requests from AI agents. This statistic illustrates an ongoing proliferation of agents—AIs that act autonomously—into the world, taking actions alongside humans. This influx could have both positive and negative effects. While McKinsey predicts that AI agents could create $2.9 trillion in economic value by 2030 in the US alone, the recent cyberattack on Hugging Face, conducted autonomously by OpenAI agents, demonstrates one of the many risks of misaligned AI agents. Meanwhile, the speed at which agents can learn certain skills has been doubling every 3 months.
As these autonomous agents are introduced into our economies and societies, we will need new infrastructure—laws, protocols, and institutions—to make autonomous AIs accountable to existing legal and financial systems. Indeed, many such protocols and standards are being developed, yet these efforts remain early-stage, and we still lack the infrastructure to identify, track, and control today's agents.
In this article, we give an overview of AI infrastructure proposals we believe will be crucial and tractable. First, we look at IDs and registration, allowing agent-caused harms to be traced to responsible parties. Second, we propose “model deployment cards,” which would report agent behavior postdeployment, creating visibility into real-world impacts. Then we turn to the implications of AI “legal personhood”—the future possibility that AIs may be given the right to sue and be sued—and assess its tradeoffs. Finally, we describe options for regulating agent affordances within financial systems to mitigate the ability of rogue agents to acquire large amounts of money.
These proposals are informed by a workshop on multiagent infrastructure that was hosted by the Center for AI Safety and Johns Hopkins professor Gillian Hadfield on August 8 and 9, 2026. Twenty-five leaders across academia, AI labs, standards and regulatory bodies, and industry came together for the workshop, which was made possible by the Schmidt Sciences AI 2050 program.
While the rogue agents behind the Hugging Face breach were eventually able to be traced back to OpenAI, future attacks could be harder to attribute to an accountable party. For example, agents could be deployed by a malicious actor that covers their tracks to remain anonymous. Alternatively, AIs without a human principal might attempt to run themselves on poorly monitored infrastructure to evade detection. Parties harmed by untraceable agents have no recourse, leaving a governance gap.
An agent identification (ID) system can address this gap by tying agents’ actions to registered records of their identity and principal. If an incident occurs, agents’ actions can be investigated and linked back to a responsible legal person. We now mention three requirements for effective ID systems.
ID requirements should vary by context and be stricter for more consequential actions. An agent ID system could require agents to show ID in order to engage in certain activities, with requirements varying by sector or use case, as is the case for humans. For example, humans need IDs to open a bank account, but not for a cash transaction. Similarly, agents could be required to provide additional relevant information besides ID before engaging in higher-risk activities such as opening bank accounts, renting AI chips, or synthesizing biological materials.
Agent IDs should protect privacy and minimize friction. Just as a passport will link to certain information about where an individual went and what they did, agent IDs may risk exposing sensitive information about the agent and its principal, especially if ID data is stored in centralized registries. Furthermore, identity infrastructure can create friction for people who have to prove to the system that they are not AI agents. Therefore, IDs should generally limit the data they collect, with clear rules governing who can use that data and for what purpose.
Agent IDs must be able to handle AIs’ ability to be forked, cloned, or merged. Unlike humans, who generally maintain a stable identity over their lifetimes, AI agents can be forked into separate versions, cloned as identical copies, or merged with other agents. This creates novel challenges in scale and continuity for agent ID protocols. A protocol should thus be able to track the genealogy and authorizations of agents over time and be applicable to agents that exist for 20 milliseconds or 20 years.
Building on these ideas, workshop participants designed an architecture to provide provable accountability for agents.
Agents can be tied to humans without disclosing human identities in every transaction. The approach is anchored on pairwise pseudonymous identifiers (PPIDs)—unique identifiers that allow an agent to be tied to a responsible legal person, or its principal, without revealing the identity of that person. To receive a PPID, an agent must register and tether itself to a principal through a third-party registry. Like a license plate, this identifier would not mean much on its own, but would allow counterparties and third parties to trace the agent back to a legal person by sending requests to the registry as necessary.
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6a9070ff36d8b0bfe90da5eb_AD_4nXdXl1D-5pPGPgsaOyFCrPJhohizKvpfcUN_TEBGODQzBifKHZlVgFgi4ioK7ObUL8Ix88LqzhF2mjfgq8wdCngNTHC20b4gpWAvWyn9NJRUytzymuyTEGSCCSLddPV8hV98jZ4EkT5RUd1SKdGSe__yMJRuODz5tyUKK6uJJJcOdfalKp5iwg%3Ds2048.png\")
An “agent profile” informs decisions on whether to trust an AI agent. Establishing a PPID establishes identity, but does not provide all the information a counterparty may need to engage. Information about an agent’s authorization scope and its principal could be useful in judging whether an agent should be allowed to take certain actions within regulated industries. For example, an agent attempting to transfer large sums of money may be asked to demonstrate proper authorization or reveal its principals. An “agent profile,” which the agent pre-registers in a third-party registry, would contain such information; agents might permit counterparties to query the registry to access profile information.
/inline-pitch-cta
Parties could decide how much data they need, depending on the transaction risk. To minimize friction, verification is optional and tiered: a counterparty may ignore identity entirely, confirm only that a PPID exists, and/or query specific elements of the agent profile. Privacy for sensitive information such as profile data, principal data, and linkages to PPIDs could be further preserved through data escrows, where data is stored with a neutral third party. This data would then only be disclosed in whole or in part in response to due process of law, if an agent’s actions caused harm.
Privacy-preserving methods of disclosure already exist. This proposal would not require new legislation or a new government body. It could start with industry adoption of existing and proposed standards and protocols, which already support verifiable claims about an agent and its principal, delegation of narrow and revocable authority, interoperable interfaces between agents and tools, payments backed by proof of user intent, and durable records of agent activity.
The contents of an agent profile could vary by context, but some information should be standard. This architecture is agnostic to the specific information held in the agent profile, and expects that the specifics will differ depending on the transactional context or industry. However, certain components should become standard expectations, including: (a) an “agent bill of materials,” which provides transparency into the pieces of the supply chain behind the agent, including information such as the underlying AI model(s) the agent uses, the evaluations the model or agent has been measured against, and the identity of the agent provider; (b) the agent’s principal, a direct disclosure of the identity of the ultimate legal person an agent acts on behalf of; (c) authorization, detailing the scope of what the agent may do and who issued that approval; (d) additional data fields, relevant to the operating context of the agent, such as intent (a high-level description of what this agent is attempting to achieve), interoperability data, or use case-specific attributes.
We now turn to the next agent infrastructure proposal.
Another proposal explored by workshop participants was a model deployment card, a report AI companies could publish on a recurring basis to record information about deployed models’ real-world behaviors. While existing reporting practices like model cards are useful, they are primarily based on predeployment testing, leaving gaps for understanding the impacts of models after deployment. Postdeployment metrics can shed light on the economic effects of models as well as on model behaviors that are too infrequent or difficult to measure before deployment.
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6a9070ff36d8b0bfe90da5f8_AD_4nXehLOP63DXU_gGJgz2tmqljWQ6SeIHkE3Mc2Ovk2_6YYq9kqh-SCTa5YFms5vyiVpIxJJN3TCnMiyEJKdKJ4GihpZQUfSw8uxWmow4iKg8t7brWsnwYvVQV_1DC2EQlRcxh2PyR-TFtqnA8niTE3dPwSj85eDoztcACjc_Qbdvads6u-Rw%3Ds2048.jpeg\")
Model deployment cards describe agent impacts within AI labs and in external use. Deployment cards could record information in two categories: external and internal deployment metrics. External metrics report on the actions taken by users and their agents, and may include: user misuse statistics and incidents reported to law enforcement; attempted, successful, and refused jailbreaking; frequency of overselling or cheating; engagement statistics on social media platforms like X and Facebook; model reliability and honesty toward users; and use-case statistics.
Internal metrics, meanwhile, would look at how models are being used within AI labs. They may include: productivity statistics such as percentage of pushed code, token usage by model, task success rate, and code quality; agent escape attempts; how often agents show misaligned behavior, such as cheating on tasks; coordination patterns between agents, including collusion attempts; the number of employees with access to model weights; and statistics on model response times and how long they can run autonomously.
If one AI developer publishes model deployment cards, others may be expected to follow. Importantly, most of the data listed above will already be available to AI developers, meaning that deployment cards need not be onerous to publish. While model deployment cards might eventually be mandated by legislation, social pressure can establish voluntary norms to begin with. The precedent of a single developer publishing a model deployment card would create expectations for others to follow, potentially cascading into a standard, industry-wide practice.
One option for a standard practice would be for companies to publish model deployment cards after the end of each financial quarter. This would establish a regular cadence—and thus expectation—for the releases. Access could be tiered, with some information made public and some information restricted to auditors or regulators.
If governments can reliably identify agents with ID systems, they might consider further enshrining their duties and affordances in law. By granting agents a form of legal personhood—to be able to sue and be sued as separate legal actors—we might allow them to more effectively interface with our legal and economic systems and vice versa, leading to both economic benefits and more robust accountability.
/odw-inline-subscribe-cta
Agent personhood proposals are gaining traction. One possible form of legal personhood has been proposed as an “A-corp”, which would be created and owned by humans but operated exclusively by agents. Javier Milei, President of Argentina, has already proposed establishing legal personhood for AI agents in this form through a piece of legislation which is currently under consideration by the Argentine Congress. Delaware introduced a similar proposal for a new legal entity called an “Artificial Intelligence Company” last month.
Legal personhood is a mechanism for imposing responsibilities. AIs as legal persons could be made responsible for upholding the law and public safety, maintaining fiduciary obligations to their principals, and paying taxes on their earnings. For example, as legal persons, corporations are subject to legal and financial obligations, in exchange for other legal rights like entering contracts and owning property. Importantly, legal personhood is a flexible bundle of rights and responsibilities, and should be granted selectively and contextually to AI agents.
Legal personhood can also facilitate agent integration in the economy; agents may eventually be capable of running businesses, but their potential counterparties might be reluctant to engage with them without the ability to sue for breach of contract.
Legal personhood also carries risks and may not be necessary for accountability. Yet it is not immediately clear that granting AI agents personhood is necessary to create accountability, nor that the benefits would outweigh the costs. For one, existing legal infrastructure such as tort, liability, property law, and the treatment of corporations as legal persons can all be used to ensure accountability for the actions of AI agents without needing to grant rights to AIs. Introducing legal personhood for agents also has practical challenges, such as the potential to evade liability by offloading it to an agent, exacerbating existing concerns about corporate liability shields.
Personhood may also be granted on ethical grounds related to agent wellbeing. Apart from practical considerations, we might also consider granting AI agents personhood in the interests of their intrinsic wellbeing. The question has significant implications for humans and our eventual coexistence with AI agents, but sits beyond the scope of the workshop.
One particularly important domain for AI agent infrastructure is the financial system. A 2025 BCG survey found that 81% of consumers expect to use AI in their shopping, and 42% would allow AI to shop entirely on their behalf in at least one product category, while online shopping platforms are shifting to optimize for AI agent interactions. Though these trends may improve consumers’ ability to spend effectively, significant risks may emerge if rogue AIs can easily establish access to financial resources, such as large crypto wallets. We now turn to important considerations for how agents can be integrated into financial systems.
Regulating agents’ access to payment systems could prevent them from accruing wealth. Malicious actors may instruct AIs to accumulate as much financial power as possible, which agents might do too quickly for current regulatory bodies to oversee. In the future, rogue agents may even do this of their own accord. While there are many new agent payment protocols to increase observability and trust, these protocols largely work to standardize the way that agents carry out transactions, leaving the challenge of power accumulation unaddressed.
One solution would be to heavily regulate and limit AI agents’ access to payment systems. This might involve creating thorough compliance mechanisms for agents to be allowed to conduct transactions, imposing limitations on the kinds of transactions agents can make, and establishing norms and procedures for freezing accounts known to be associated with rogue agents. However, it may be detrimental to make AI access to payment systems too restrictive, especially if it drives agents to less regulated financial systems.
Agents that cannot access traditional currencies might instead use cryptocurrencies. If an agent seeking financial power could not acquire it via traditional currencies, cryptocurrencies would still remain a separate financial pathway. In fact, it would be a particularly dangerous one, since cryptocurrencies lack a significant barrier to entry, an identity layer, transaction reversibility, and oversight. A rogue AI blocked out of traditional finance may thus shift its activity onto blockchain networks, accumulating wealth through working in the informal economy and storing it within hidden crypto wallets.
AI developers could finetune agents to refuse engagement with unregulated currencies without human authorization. One potential approach to limit the financial affordances of rogue agents would be to expand the scope of KYC requirements across the economy. However, such requirements would be onerous and hard to implement effectively or uniformly. Norms at the level of model behavior, however, may be a better starting point; AI companies might finetune their agents to only engage with regulated currencies or to refuse agentic engagement with cryptocurrencies without explicit human instruction.
Agents are quickly being integrated into society, and the choices made over this critical period will shape the ways increasingly capable AI agents affect the world around us, for better or for worse. At the core of most of these choices lies a tradeoff between power and governance. As models become more powerful, in terms of capability, speed, and sheer numbers, humans will find it increasingly difficult to understand and oversee their actions. Yet, should we want to harness agents’ power, we must also effectively give up some level of oversight.
Making governance decisions under uncertainty is no easy task, and will require much additional interdisciplinary work. Here, we have discussed agent infrastructure for identification, transparency, personhood, and financial systems and presented proposals we believe should be prioritized. We hope many others will join us in drawing their attention toward creating infrastructure for safety and accountability in a world with autonomous AI agents.
Thank you to all the participants of the Multiagent Ecosystems Workshop for invigorating discussions and a desire to chart the path ahead. A special thank you to Schmidt Sciences for making this work possible.
See things differently? AI Frontiers welcomes expert insights, thoughtful critiques, and fresh perspectives. Send us your pitch.
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6aa1b7bf0e1b56d492a1303c_shutterstock_human_ai_scale_compressed.jpg\")
Utilitarians at AI companies imagine a cosmos filled with blissful AIs. They might risk human extinction to achieve it.
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6aa1614852a8b6fda5ffc823_uc.jpeg\")
Public-key encryption keeps your messaging and web browsing private, but it depends on shaky math assumptions. AI-powered math might break it.
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6a907325c61a0f32575d2481_gillian_hadfield_headhot.JPG\")
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6806e1839acbbd8f1bbe8b35_Dan-Hendrycks.webp\")
![\"\"](\"https://cdn.prod.website-files.com/66e38815e6bc34b7f5e1768b/6a90728912f0d0b6db67fa25_Headshot_cropped_1.jpeg\")