What governments are already doing about AI agents

Public agencies are moving from chat tools that suggest text to agents that open case files, update public records and move funds. Once software acts, three questions follow: who gave it permission, what did it actually do, and how can a person stop it before one bad step triggers five more?

Agencies don't have to start from zero. Existing rules for automated decision-making, records management and procurement already cover much of this, if they are applied to agents.

You are not starting from zero

The good news is that public servants and lawmakers have already built a real foundation. Over the past several years, governments and standards bodies have written clear rules for automated systems that affect people's lives.

In Canada, the federal Directive on Automated Decision-Making has required departments since 2019 to complete a public impact assessment before using an automated system to recommend or make an administrative decision.¹ It also requires plain-language notice, bias testing, human intervention, and a clear way for citizens to appeal.¹

In the European Union, the Artificial Intelligence Act entered into force in August 2024.² Article 50 requires that people be told when they are dealing directly with an AI system. Article 14 requires high-risk systems to be built so a person can understand their limits, watch them work, override a result, or stop them with a clear switch.²

In the United States, states and standards bodies have moved in a similar direction. State legislation enacted in 2024 requires impact assessments, disclosure, and appeal rights when high-risk AI shapes consequential decisions in areas like healthcare, housing, employment, or essential government services.³ Meanwhile, the National Institute of Standards and Technology (NIST) organized its 2023 AI Risk Management Framework around four practical duties: govern, map, measure, and manage.⁴

What changes when software acts on its own

Most early AI rules were written with a single decision in mind: a model scores an application, and a human official reviews the score. AI agents work differently. An agent breaks a goal into steps, calls other software tools, and often hands tasks to other agents across agencies or borders.

That creates three gaps that traditional policy rules don't catch on their own.

Borrowed identities. Today, many AI agents act by logging in with a staff member's password or a shared department key. When something goes wrong, the audit log looks as if the human clerk clicked the button, and the agent inherits every permission that clerk had. It is the digital equivalent of letting an outside delivery van drive through a restricted municipal depot wearing a senior inspector's badge.

Asking the AI to police itself. Many commercial tools try to enforce rules by putting instructions inside the AI's prompt, such as telling it never to share private records. Because language models process instructions and outside documents together, a cleverly worded email or form can trick the model into ignoring those rules. In civil engineering, you do not keep a water main from bursting by pasting a polite note on the pipe. You install a mechanical pressure relief valve outside the pipe.

Surveillance instead of accountability. Some vendors respond by streaming every screen, document and keystroke to a central monitoring cloud. For a public agency or clinic, that turns oversight into a privacy hazard. It is like routing every resident's sealed hospital letter through a private marketing company just to count envelopes. That pools sensitive citizen records in one place without stopping an unauthorized action before it happens.

Separating the thinker from the gatekeeper

In October 2026, NIST's cybersecurity team outlined ten practical design tenets on managing AI agent identities and permissions.⁵ Those tenets point to a clean rule for public software: the AI model that thinks through a task must never decide what it is allowed to do.⁵

Think of how a well-run city hall already works. A planning adviser can draft a building permit, and they can be very persuasive. Still, the registrar at the counter checks the signature, the zoning rule and the expiry date against a fixed rulebook. If the authority isn't there, the stamp stays in the drawer.

Those design tenets apply that same separation to software.⁵ Each agent gets its own distinct identity, linked to the person or office it represents. It holds permissions on loan for one task and a brief time, rather than standing access. Outside the AI model, an independent gatekeeper checks every action against hard rules and records a tamper-evident receipt.⁵

Walk through how that separation works on a routine municipal task, such as scheduling winter road repairs or reviewing a small-business permit application. The AI agent reads the incoming application, checks the street map, and drafts a proposed work order under its own machine badge.

When the agent tries to submit that order, the independent gatekeeper checks three fixed facts. Is this badge authorized, has its ten-minute lease expired, and does the cost stay below the clerk's approval limit? Only when every check passes does the draft enter the public register.

Notice what happens if an outside contractor slips a hidden instruction into a PDF invoice, trying to trick the AI agent into approving an extra payment. Even if the language model is fooled, the gatekeeper at the door is not a language model. It checks the fixed spending cap, blocks the payment immediately, and logs the failed attempt for the human supervisor.

What remains unsolved

We want to be honest about what these technical guardrails do not solve. A receipt proves which agent took an action, under whose mandate, and within which rulebook. It does not prove that the underlying policy was fair, or that a busy human reviewer had enough time to question a smooth recommendation.

Just as an inspected bridge still needs clear road signs and sensible speed limits, an audited software tool still needs humane laws and well-supported public servants. If an agency cuts front-counter staff and expects one tired supervisor to review four hundred automated drafts before lunch, "human oversight" becomes a comforting fiction.

And when agents from different departments or companies begin dealing with one another at machine speed, individual caution isn't enough, much like careful drivers can still create a traffic jam. If a hospital discharge agent and a municipal home-care scheduling agent misunderstand each other's availability codes, a patient can fall through the gap between two tidy systems. Knowing how to test those multi-agent handoffs in a safe sandbox before deployment is an open research problem, and one we are working on openly.

Four questions public officials can ask today

You don't need to wait for new legislation to put sound boundaries around AI agents in procurement, pilot projects or agency guidance. Treat software procurement like civil engineering, and ask four practical questions:

1. Does the agent have its own badge, or is it borrowing a staff member's login? Require every agent to carry a distinct identity tied to an accountable office, with permissions that expire as soon as the task ends.⁵ Never let a vendor wire an agent into your database using a human clerk's master credentials.

2. What enforces the rules, a prompt, or a separate gatekeeper? Ask vendors to show the blueprints for how permissions are enforced outside the language model, so a misleading document cannot talk the agent into overstepping its bounds.⁵

3. Do we get a checkable receipt without handing over private files? Require tamper-evident logs of every external action an agent takes, stored where your agency and auditors can inspect them. That oversight should never require streaming citizens' travel logs, tax forms, or health records to a third-party broker.^1,5

4. Can a person see what happened, shut the valve and appeal? Following the pattern set in Canada, the European Union and U.S. state law, make sure a named official holds a local shut-off switch to halt an agent immediately, and ensure any resident can get a real human review.^1,2,3

Good governance has always relied on simple, dependable tools: open blueprints, a clear mandate, a public register and a receipt at the counter. Above all, it relies on a human being you can appeal to when a rule doesn't fit your life.

Bringing those habits to AI agents lets new software help with the workload while keeping public decisions in human hands. If your office is working through these questions, visit our page for policy makers.

1. Treasury Board of Canada Secretariat, Directive on Automated Decision-Making (took effect April 1, 2019; regularly updated). tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592

2. European Union, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Articles 14 and 50, Official Journal of the European Union (entered into force August 1, 2024). eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689

3. Colorado General Assembly, Senate Bill 24-205, Consumer Protections for Artificial Intelligence (enacted May 2024). leg.colorado.gov/bills/sb24-205

4. National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (January 2023). doi.org/10.6028/NIST.AI.100-1

5. Harold Booth, Bill Fisher, Ryan Galluzzo and Tom Clancy, "Design Tenets for Agent Identity Management Systems," NIST Cybersecurity Insights, National Institute of Standards and Technology and MITRE (October 27, 2026). nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems