Artificial-intelligence regulation is getting better at asking whether an agent can be stopped. It is less developed on a logically prior question: when should an old instruction stop counting as authority?

An AI agent can remember exactly what a user told it, retain technical access to the relevant service, and execute the instruction exactly as requested — while still acting after the legal or operational basis for that instruction has changed. A delegation can be revoked. Consent can be withdrawn. A contract can be amended. A case status can change. A bank transaction can become disputed. A production environment can acquire a new access policy. The instruction remains in memory; the authority does not.

This is a temporal-authorization problem. It cannot be solved by memory, audit logging, or a stop button alone.

The legal frameworks already contain half of the answer

The EU Artificial Intelligence Act requires high-risk AI systems to support effective human oversight during use. Article 14 requires measures proportionate to risk and autonomy and, where appropriate, enables overseers to understand system limitations, monitor operation, disregard or reverse outputs, intervene, or stop the system. Those are important controls. They assume, correctly, that high-risk systems must remain governable while operating.

But an agent can be fully stoppable and still be operating under stale authority. If a human once authorized a payment and later disputed the invoice, the oversight question is not merely whether a person can interrupt the payment agent. It is whether the agent should recognize that the state under which the payment was authorized has been superseded before execution begins.

A parallel issue appears in U.S. policy development. Sen. Mark Warner’s June 29, 2026 AI AGENT Act discussion draft is not enacted law and, as Warner’s office emphasizes, was released for stakeholder feedback before formal introduction. Among other things, the proposal would require agents to protect privacy, operate transparently in users’ best interests, and make clear to third-party sites and online services that the agent has valid authorization.

That phrase — valid authorization — should be read temporally. An authorization is not valid merely because it once existed and has not disappeared from an agent’s memory.

The regulatory problem becomes clearer if authorization is represented as a state rather than a permanent property.

Bind the instruction to the state that made it valid

A consequential agent instruction should carry more than a command and an identity. It should be bound to the material state under which it was authorized. That state might include a contract version, account-permission version, case status, transaction status, policy version, user-consent state, or another context-specific control.

Before execution, the system should compare the authorization state with the current state. If nothing material has changed, the agent proceeds. If the state changed in a way that affects authority, the instruction should be re-evaluated, suspended, or renewed according to an explicit rule.

INSTRUCTION + AUTHORITY STATE + MATERIAL DELTA = EXECUTION DECISION

This does not require every AI interaction to become a miniature administrative hearing. Risk-sensitive design can define which changes are material. A dinner-reservation assistant changing a table time may need only ordinary confirmation rules. An agent moving money, disclosing personal data, changing legal status, modifying production infrastructure, or representing a person to an institution deserves a higher threshold.

The key point is that “same instruction” does not imply “same authority.”

Five fields are enough to make the problem legible

A minimum state-lineage record for consequential agent action can be compact:

  • Instruction: what the agent was authorized to do.
  • Governing state: the relevant record, permission, contract, policy, consent or configuration version when the instruction was issued.
  • Authority: the user, role, workflow or legal/organizational basis that made the instruction operative.
  • Delta: any material change between authorization and execution.
  • Disposition: whether the original authority remains valid, has expired, was revoked, was superseded, or is uncertain.

These fields also improve auditability. A log that says an agent acted at 14:03 and cites a three-day-old instruction tells an investigator what the agent did. A state-lineage record tells the investigator why the agent was still entitled — or no longer entitled — to do it.

That distinction matters for accountability. Technical capability is not legal authority. An API credential may continue to function after the business permission supporting its use has been withdrawn. A model can retain a user preference after consent has changed. A workflow can still expose a button after the policy basis for pressing it has been superseded.

Human oversight should include authority drift

Article 14 of the EU AI Act is expressly about high-risk AI systems, not a general statute governing every consumer agent. Its human-oversight structure nevertheless demonstrates a useful regulatory principle: oversight must be effective during the period of use, not merely established once at deployment.

For agentic systems, one implication is that oversight design should include authority drift. The human or organizational state that justified an instruction may change while the agent waits, retries, schedules, delegates, or continues a multi-step task. A meaningful oversight system should make those changes visible to the agent and to the person responsible for supervision.

Warner’s proposed AI AGENT Act points in the same direction from the consumer/platform side. If agents must represent that they possess valid authorization, technical standards for agent authentication should eventually be able to express not only who authorized the agent, but whether the relevant authorization is still live for the action being attempted.

The policy opportunity is narrower than a new universal rule

Legislatures do not need to prescribe one universal state-lineage schema. The immediate opportunity is to make temporal validity an explicit design and standards question.

NIST work on agent authentication and authorization could distinguish durable identity from action-specific, revocable authority. Sector regulators can ask when financial, health, employment, governmental, or infrastructure agents must re-check the governing state before action. High-risk AI conformity and oversight processes can test whether systems recognize material changes that invalidate previously authorized operations. Contracting and procurement rules can require vendors to expose revocation, supersession, and state-transition hooks rather than treating an instruction as permanently valid until manually deleted.

The test is simple: can the system tell the difference between “I was once authorized to do this” and “I am authorized to do this now”?

Memory should preserve the path, not preserve permission forever

The policy debate around agentic AI often treats memory as either a capability or a privacy risk. It is both, but memory also creates a governance obligation. The more faithfully an agent remembers, the more important it becomes to distinguish historical instruction from current authority.

A person who says “pay this on Friday” on Monday has created an instruction. If the invoice becomes disputed on Wednesday, a well-governed agent should not congratulate itself on perfect obedience Friday morning. It should recognize that the world in which the instruction was issued no longer exists in the same state.

The second execution is not the first event repeated. The interval matters.

AI agent law is beginning to build the machinery of oversight, authentication, privacy and accountability. The next step is to make authority itself state-aware.