Superintelligence Exposes a Gap in the Law of Delegated Authority

Federal policy on “Super Intelligence” is moving rapidly toward implementation. Following Executive Orders 14434 and 14432 on September 29, the administration and the National Institute of Standards and Technology (NIST) have advanced work on autonomous systems across public services and digital infrastructure. Yet the legal boundaries of those systems remain unsettled. Who may authorize an autonomous agent to act, how far does that authority extend, and what must happen when the agent’s chosen solution requires permission no one has granted?

The pressure to resolve these questions is growing. In 1953, J. Robert Oppenheimer compared the nuclear powers to “two scorpions in a bottle.” Today’s AI race carries a similar fear of strategic disadvantage. Governments and corporations are deploying increasingly capable systems because they cannot afford to fall behind. Under that pressure, decisions about what machines may do risk becoming assumptions rather than deliberate grants of authority. Voluntary industry controls offer some protection, but one company’s restrictions do not bind its competitors or the systems with which its agents interact.

Public-authority, agency, contract, and electronic-transactions law provide a foundation for addressing this problem. Applying those laws to software that selects its own means of accomplishing a human objective, however, exposes gaps in both government and private commerce.

Congress has also established a framework for federal AI use. The AI in Government Act of 2020, Pub. L. No. 116-260, div. U, tit. I, directed the Office of Management and Budget (OMB) to guide federal AI acquisition and use. The Advancing American AI Act of 2022, Pub. L. No. 117-263, div. G, tit. LXXII, subtit. B, expanded that framework. Neither statute comprehensively addresses the delegation of governmental authority to autonomous agents.

Consider a military commander who directs an AI agent to resolve a critical supply shortage. The agent identifies a new vendor, reroutes a shipment, modifies a contract and shares sensitive technical drawings to accelerate production. Those actions may solve the shortage while exceeding the authority behind the original instruction. A mission order does not necessarily authorize a contract modification or the disclosure of protected information.

FAR 1.602-1 permits contracting officers to bind the government only within their delegated authority. An autonomous agent operating under a commander’s direction remains subject to those limits. The agent’s ability to devise an effective solution cannot supply a legal power that the commander lacks or has not delegated.

The same constraint must carry through any further delegation. An agent authorized to spend $10,000 should not acquire $100,000 in spending power by creating ten subagents. Nor should permission to purchase equipment be permission to disclose the technical information needed to manufacture it. The governing principle should be straightforward: divide the work without multiplying the power.

Putting that principle into practice requires a reliable way to identify each agent and trace the authority delegated to it. Technical work on agent identity and permissions offers a way to enforce that principle. On September 29, NIST summarized more than 600 comments on agent identity and authorization and selected software development as an initial implementation setting. Researchers are examining related distinctions. In 2026, ExxonMobil researchers proposed separating an agent’s capabilities from the autonomy it is permitted to exercise. A 2025 multidisciplinary research group proposed authenticated, auditable delegation to define and trace permissions rather than infer them from broad objectives.

These efforts can help establish which agent acted and what permissions it received. The legal validity of those permissions requires a further inquiry. Valid credentials alone cannot establish authority to obligate public funds, bind the government or disclose protected information.

Congress could address that issue by building on the 2020 and 2022 AI statutes. Legislation could specify which governmental powers may be delegated to autonomous agents, and which decisions require human approval. It could also establish limits on subagents, circumstances requiring renewed authorization, procedures for revocation and records connecting machine actions to their lawful source of authority. OMB, NIST and the federal acquisition system could translate those requirements into policy, technical standards, and procurement terms.

Private commerce presents a related problem under a different legal framework. The Electronic Signatures in Global and National Commerce Act of 2000 (E-SIGN Act) defines an “electronic agent” in 15 U.S.C. § 7006(3) as automated means acting without contemporaneous human review. Section 7001(h) prevents a contract from being denied legal effect solely because an electronic agent participated, provided the agent’s action is legally attributable to the person bound.

That provision supports automated contracting, but it does not fully answer what autonomous software may undertake for its principal. An agent may select counterparties, negotiate terms, disclose information, and assign work to other agents. Existing doctrines govern aspects of those activities, yet E-SIGN does not comprehensively address how delegated authority should be granted, renewed or revoked as software chooses its own course of action.

Attribution and authorization therefore require separate consideration. Identifying an act as belonging to a person or company does not, by itself, establish that the act fell within the authority delegated to the software. That distinction becomes consequential when an agent makes a commitment its principal never intended to permit.

Congress could clarify E-SIGN’s electronic-agent provisions without creating an entirely new AI contract regime. An amendment could address the scope of delegated authority, limits on subagents, material changes requiring approval, and the effect of revocation. Records connecting the principal, the agent and the disputed action would help parties and courts assess whether the agent acted within its mandate.

State law would remain essential to that effort. E-SIGN operates alongside laws based on the Uniform Electronic Transactions Act (UETA), as well as state agency and commercial law. Coordinated federal and state updates could give businesses clearer rules for using autonomous agents and allocating responsibility for their actions.

The effectiveness of these legal reforms, however, will depend on the people and institutions responsible for carrying them out.

Even well-defined authority depends on an institution’s ability to exercise it. Suppose an agency or corporation requires human approval before an agent takes consequential action. The agent presents its recommendation and waits exactly as designed. But the organization has eliminated much of the experienced workforce because agents now perform the routine work through which professional judgment once developed. The person reviewing the recommendation may lack the experience, time or independent evidence needed to assess it.

In that setting, an approval requirement can survive long after the capacity for meaningful review has weakened. Microsoft researchers studying experienced software developers in 2026 found that effective oversight requires planning, controls before execution, monitoring, and subsequent review. A final human sign-off cannot carry that entire burden.

Organizations deploying consequential autonomous agents must therefore preserve both enforceable limits and the human capacity to supervise them. The system must stop or seek additional approval when its proposed course exceeds its mandate. The institution must retain people who can understand the request, examine the evidence, and make an informed decision. Procurement and staffing choices will determine whether those safeguards work in practice.

As agents operate across organizations and interconnected systems, lawmakers and courts will have to apply delegation and agency rules to increasingly complex chains of action. Technical standards and industry practices can support that work, but the source and extent of legal authority must remain identifiable throughout the chain.

Machine capability should be free to advance, provided legal authority remains express, bounded, and traceable to human decisionmakers. Innovation must not become a license for autonomous power. A machine’s success in achieving an objective can never justify assuming authority it was never given.

Executive-order references: Executive Order 14434, “Inaugurating the Era of Super Intelligence,” Sept. 29, 2026, 91 Fed. Reg. 63129 (Oct. 2, 2026); Executive Order 14432, “Streamlining Access to Government Services Through America.gov,” Sept. 29, 2026.

NIST reference: National Institute of Standards and Technology, National Cybersecurity Center of Excellence, “Comments on Software and Agentic AI Identity Concept Paper,” Sept. 29, 2026.

Sue Ghosh Stricklett is an attorney and national security law expert whose work focuses on artificial intelligence governance, export controls, foreign investment review, and emerging technology policy. She has advised on federal regulatory and national security matters involving export-control reform, CFIUS and Team Telecom. She is also the founder and inventor of Digital Archives Pro™, an AI governance and data-infrastructure platform focused on provenance, policy controls, and human authority in advanced AI systems.