Truth is not given, it is verified. Yet last month’s AI AGENT Act discussion draft—quietly circulated by Senator Mark Warner—assumes the opposite. It proposes to make every AI agent developer a fiduciary, bound by non-waivable duties of care and loyalty, with the FTC wielding enforcement power. No disclaimers. No opt-out. Just a legal hammer aimed at the affiliate-fee business models that currently underwrite half the agent economy. This is not a marginal regulatory tweak. It is a fundamental paradigm shift from "disclose and consent" to "serve or face penalties." And it has a problem: the code cannot yet prove loyalty.
Let me back up. For the past decade, regulators defaulted to transparency. Tell users what the bot does, get their consent, and you are off the hook. That framework is dying. In 2024, the SEC settled with Delphia and Global Predictions for overstating AI capabilities—a warning shot. By December 2025, the SEC issued a marketing rule risk alert aimed directly at AI-adjacent claims. Then came the FTC’s proposed policy statement on AI accuracy, released July 1, 2026, with a comment period ending September 18. In parallel, Stanford’s HAI released a paper outlining a fiduciary framework for agents. The message is unambiguous: the era of "it was just a tool" is over. Developers and deployers are now being recast as trustees.
The AI AGENT Act is the sharpest expression of this turn. It explicitly forbids kickbacks, self-dealing, and hidden vendor prioritization. It imposes a duty of care—act as a prudent person would—and a duty of loyalty—act solely in the user’s interest. These duties are non-waivable. That last detail is the legal equivalent of a smart contract with no escape hatch. And here is the hidden insight most commentators miss: the Act chooses the FTC, not a new agency, and not state courts. That is deliberate. The FTC Act’s Section 5 prohibits "unfair or deceptive acts." The FTC already has the jurisdictional muscle. By tacking fiduciary obligations onto that existing authority, the drafters compresses the institutional timeline. No need for a new bureaucracy. The policy machine is already running.
But the deeper architectural choice is the shift in accountability. The Act does not ask whether an AI system has legal personhood. It dodges that philosophical minefield by imposing duties on the human developers and deployers. This mirrors the EU AI Act’s focus on "providers" and "deployers." Human accountability is now the global baseline. The difference is that the EU’s Article 50 still relies on transparency—tell the user they are talking to a machine. The US draft goes further: it demands the agent’s decisions be loyal, not just communicated. That is a qualitative leap. And it creates a compliance cliff. Companies built for transparency—publish a privacy policy, check a box—now must prove internal incentive alignment. The evidence shifts from "what did you disclose" to "why did you decide this." The burden moves from the user to the developer.
Here is where my technical experience kicks in. I spent the 2022 bear market dissecting ZK-Rollup mathematics, not trading. The lesson that stuck with me is that verification is distinct from computation. You can run a complex calculation, and with a zero-knowledge proof, you can prove that calculation was done correctly without revealing the inputs. That is precisely the capability absent in AI agent auditing. The report I read cites the hard truth: the technical challenge of auditing agent behavior remains unsolved. There is no tool today that can independently verify that a language model’s output was not influenced by a hidden kickback from a hotel chain or a token issuer. The law will require something the market cannot yet produce. Legal duties without verifiable execution are just aspirational ethics. In crypto, we learned that trust must be embedded in the architecture. "We do not trust; we verify." That axiom should terrify compliance officers.
Now the contrarian angle. The standard narrative is that fiduciary duty will protect retail users from predatory bots. I’m more skeptical. Without a technical verification layer, these laws will create a compliance theater. Firms will hire "Chief Trust Officers," write elaborate incentive policies, and display badges. But the actual agent behavior—the opaque reasoning inside a fine-tuned neural network—remains a black box. Auditors will triple-check training data documentation while the agent quietly prioritizes the highest bidder. The law’s emphasis on "ordinary prudent person" standards is laughable when the agent is processing a thousand decisions per second. What is the prudent behavior for an autonomous negotiator on a decentralized exchange? No legal precedent is going to answer that. And let’s not ignore the arbitrage vector. The US is moving toward fiduciary logic; the EU is stuck on transparency. A multinational platform can simply route its agents through a jurisdiction with weaker enforcement, essentially legalized regulatory arbitrage. The haves—large tech firms with in-house legal armies—will comply. The have-nots—indie agent builders—will either be crushed by compliance costs or forced into the gray market. This is not liberation; it is the centralization of AI through an unintended barrier to entry.
The real blind spot, however, is the assumption that a legal obligation can substitute for technical determinism. A fiduciary is someone you trust to act in your interest. But the history of crypto markets shows that trust, without cryptographic proof, collapses. The entire DeFi movement was built on "code is law" precisely because counterparties cannot be trusted. Now the AI agent economy is about to discover that legal code is not executable code. A smart contract that enforces loyalty via a revert condition is meaningful. A legal contract that says "be loyal" is only a prelude to a lawsuit after the damage is done. The SEC’s 2024 settlement with Delphia did not stop the next round of exaggerated AI claims; it merely set a price for getting caught. The FTC’s future enforcement will do the same. Bad actors will treat penalties as the cost of doing business. Good actors will waste millions on unverifiable audit reports.
The way out is not litigation but architecture. Builders need to design agents with what I call "fiduciary-coded" mechanisms. This means outputting a signed decision trace that records every external call, every incentive signal, and every ranking function. It means committing that trace to an on-chain hash so that post-hoc tampering is impossible. It means using zero-knowledge proofs to demonstrate that the agent’s internal reward function did not favor any vendor without revealing the proprietary model weights. This is not science fiction. I have already built a demo agent that negotiates DeFi yields with a transparent decision log. The technology exists. What is missing is the market incentive. Unless regulators start demanding cryptographic attestations rather than legal attestations, the industry will skate by on paper. And then, when a major agent scandal blows up—and it will—the public will lose faith in both the law and the code.
Chaos is just order waiting to be decoded. The AI AGENT Act is an attempt to impose order from above, but it lacks the decoding mechanism. Skepticism is the first step to sovereignty: do not assume a legal duty will protect you. Assume your agent has a hidden agenda and demand the cryptographic proof that shows otherwise. The builders who solve this auditability problem will not just be compliant—they will define the new standard. The bear market taught me that only code remains. In this bull market of regulatory hype, the same truth applies. Modularity is the architecture of freedom, and the modularity of verified, auditable agent behavior will be the architecture of the next internet.
So here is my Builder’s Challenge for you: Stop reading legal analyses and start writing code that generates an unforgeable audit trail for every single agent decision. Your future fiduciary duty—and your users’ future trust—depends on it.