# Your AI Agent and the Law: Who Acted, By What Right, and What You Can Prove

No new statute is required. A payment an agent releases is an act of the institution that issued it, and a court will ask three questions about that act. Knightsbridge Law sits on every KXCO Round Table ontology so counsel is in the room while the act is still a proposal.

Canonical HTML: https://www.livetradingnews.com/your-ai-agent-and-the-law-who-acted-by-what-right-and-what-you-can-prove
Last modified: 2026-09-17

---

By Shayne Heffernan · 2026-09-17
Tags: AI agents, AI governance, agent liability, post-quantum cryptography, ML-DSA-65, FIPS 204, ML-KEM-768, Armature L1, Knightsbridge Law, Round Table, ontology, legal technology, compliance, attestation, digital signatures, KXCO, AI regulation, operational resilience
Signed: ML-DSA-65, anchored on Armature L1.
Nothing in this article is investment advice.

Your agent already acts in a legal system that was built for people. KXCO writes the act quantum-signed, time-stamped and marked on chain, before the dispute.

No new statute is required for the following to be true.

A payment that leaves an institution is an act of that institution. A document issued under its letterhead is its document. A representation made to a counterparty is its representation. Software does not get a holiday from agency, contract, negligence, consumer duty, sanctions, record-keeping or operational resilience because the interface was a chat window.

The law already knows how to treat an employee, an attorney-in-fact, a company officer. It is now being asked to treat a process that can generate language and call tools. The process has no standing. The institution that issued it does. That is the whole problem, stated without theology.

Supervisors have started to say the quiet part. Existing fraud and compliance frames were built to verify customers, not agents. They assume a human action at the moment of authorisation. Agent systems that can execute payments open a hole those frames do not cover. The hole is not intelligence. The hole is an unowned act.

Twelve months later there is a dispute. The other side says unauthorised. Your side says a person approved it. The court wants the file. What most shops have is an export from a product they do not own. That is not a file. That is a vendor's mouth.

## What the law will ask

Three questions. They are older than models.

Who acted. Not which product. Which identity, under which institution, on which credential, at which time.

By what right. What that identity was allowed to do at that moment. Objects and verbs. Limits. Expiry. Whether the right had already been cut.

What can be reconstructed. What the human was shown. What they approved. What they refused. What the object became. How a stranger checks the signatures without the vendor in the path.

If any of those three is a story, you will lose to documents. KXCO is the documents, written at the time of the act, not reconstructed from a chat.

![KXCO Round Table exhibit comparing the three questions a court asks with what a chat export offers and what a signed record holds](https://livetradingnews-media.nyc3.digitaloceanspaces.com/media/2026/09/17/cmpgg3-e3691d0f3cdd6419.svg)

*Exhibit one. The questions are older than models. Only one column survives being read out in a hearing.*

## How KXCO settles this in advance

The stack is not a lecture about responsibility. It is a sequence that makes an unowned act hard to perform and easy to prove.

Identity first. Every agent receives its own post-quantum key and a credential that traces to a human or institution root. Person, firm and agent sit on the same standard. The machine does not get a quieter path. Revoke one credential and the rest stand.

Scope next. The credential names objects, verbs, limits, jurisdiction and death date. Authority down a chain of agents can only narrow. It cannot widen itself because a prompt said so. A document injected into a draft can pollute speech. It cannot mint a right. Over-scoping is an issuance failure, visible on the credential, not a mysterious jailbreak.

Then the governed step. Extraction proposes. The ontology checks the proposal as a typed world-delta: who, what, who owns it, who may act, what will change. Preconditions run. A preview shows the exact fields, not the model's paragraph about itself. Nothing reaches the world unreviewed. For expensive acts, approver and executor can be required to be two different people. Refusal is recorded with the same weight as approval.

Then the lock. Every consequential act is signed with ML-DSA-65, NIST FIPS 204. Key encapsulation where secrecy is required is ML-KEM-768, FIPS 203. The signature is over the bytes that mattered, not over a vendor log line. The time is on the envelope and on the chain. The mark on Armature L1 is the public order of events: permissioned EVM, chain ID 1111111, QBFT finality in about two seconds, on-chain ML-DSA-65 verification at precompile 0x0b. The relay can pay gas so the institution does not have to hold the native unit to write the record.

Then verification without us. The kxco-verify tool and the public RPC exist so a counterparty, a supervisor or a court-appointed expert can check the signature and the anchor on their own machine. If KXCO disappeared tomorrow the proof is supposed to stand. That is the legal point of a record that is not a feature toggle.

This is how the issues are solved in advance. The file exists before the wig. The law does not have to invent a new kind of intern with production credentials and no paper.

## Where Knightsbridge Law sits

There is a seat at the table that nobody has to remember to fill.

Knightsbridge Law is KXCO's own counsel, and it sits on every Round Table ontology as a standing member. Not invited per room. Not a review step someone books when a matter looks difficult. Seeded by default, at the moment the ontology is created, in the same breath as the room itself.

It has work to do there. It runs know-your-client on the experts who join the table. It validates the opinions those experts enter, so an assertion carries the name of the person who made it and a note from counsel that it was checked. And its presence is what holds the human and machine loop in place, because a room where counsel is always present is a room where the question of lawfulness is asked while the act is still a proposal.

That is the point of putting it there rather than at the end. A legal review that happens after the fact is a report about something that already left the building. A standing member is in the room at the governed step, looking at the same typed delta the approver is looking at, before anything becomes a fact.

It is also a hard constraint on the product, and it was written as one. The Round Table must never advise anyone to break the law, and must never let anyone use it to break the law. Counsel on every table is how that gets enforced by architecture rather than by a clause in a contract nobody reads until the dispute.

So when the file is opened twelve months later, the chain of credentials is not the only thing traceable back to a human. The opinion is too. The expert who gave it was checked. The lawyer who validated it was at the table. Both sit in the same ledger as the payment.

![KXCO Round Table exhibit: one consequential act from identity and scope through the governed step and the chain mark to offline checking, with counsel a member of every table](https://livetradingnews-media.nyc3.digitaloceanspaces.com/media/2026/09/17/cmpgg3-15ab8b3036ec4c7d.svg)

*Exhibit two. Five stations and a rail. Counsel is a member of the table throughout, not a gate bolted on at one station.*

## The record, named

Call the artefact what it is.

Quantum-signed. The act carries an ML-DSA-65 signature from the actor's key. The credential chain runs back to the institution root. Algorithms that still sign most of the internet will not be the algorithms you want on a file that must still read in 2040. Harvest-now-decrypt-later is a legal problem as much as a cryptographic one. A contract, a clearance, a board minute signed today is already inside the window. The signature class is FIPS 204. The default parameter set is Category 3. Category 5 is available where a counterparty demands it. Say which one you used. Put the name in the file.

Time-stamped. The envelope carries the time the actor signed. The chain carries the time the network accepted the mark. Two clocks, on purpose. One is the institution's act. One is the public order. A later edit that tries to move either breaks a signature or breaks the hash chain. Cheap refusal and late approval both show their times. That is how you see the tired human without inventing a narrative about them.

Marked on chain. The digest of the consequential act is anchored on Armature L1. Not the secrets. The proof. Anyone who can read the explorer or call the RPC can see that a mark with that hash existed at that height. The institution still owns the graph and the keys. The chain owns the order. That split is the difference between a vendor log and a record.

Verify offline. No KXCO server in the path. If verification requires our API, we sold you a courtesy, not a court file.

## Speech, agency, and what a judge can use

A prompt jailbreak can still happen. KXCO does not live in the weights. A model can be talked out of its manners. That is speech.

An action here is a typed, signed, preconditioned, previewed change under a key that only has the scope you issued. That is agency. The law understands agency. It does not need to understand residual streams.

If the wider instruction never became a typed object, there is no act to try. If it became an object and was signed, the credential shows whether the landing was authorised. Either way the court is looking at an artefact, not at a theory of the model's inner life.

The remaining exploit is a person who clicked yes. The record cannot prevent a bad approval. It can refuse to hide the identity, the scope, the delta, the time, and whether dual control was required. Attributable is what the law already knows how to do next.

## Three acts the law already recognises

A payment. The agent may prepare, not release. The proposal names payer, payee, amount, purpose, accounts. Release needs a second key. Both signatures are ML-DSA-65. The digest hits the chain with a time and a height. Twelve months later you do not explain a chat. You produce the proposal, the two approvals, the scope that forbade solo release, the timestamps, the on-chain mark, and a verification that does not call us.

A document. An institution root issues a person a credential. The person issues an agent a thinner credential to assemble a pack. Execution is a human signature over the hash of the exact bytes shown. The file is the hash, the keys, the chain of credentials, the time, the anchor, and the refusal log if the agent tried to execute.

A cut. An agent is revoked at a known time. Everything after that time under that credential is void. The revocation is signed and marked on chain. Other credentials stand. Furniture cannot be cut this cleanly. Participants can. The law knows revocation. Give it a time and a signature.

## What this does not buy you

It does not make a model innocent.

It does not make a bad institution good.

It does not replace supervision, fitness or a person who will read the preview.

It does not turn a permissioned chain into a sovereign state. Operators can be named.

It does not stop tokens that entered a rented model from existing in that model. Sovereignty of action is not sovereignty of every syllable. Put the residue in the file.

It does make the institution specific. Specific is the beginning of a defence. Vague is the beginning of a press statement.

## Ask this before you switch the agent on

- Who owns the graph the model reasons over, and can you leave with it.
- What is the credential, in objects and verbs, not adjectives.
- Can the agent widen that scope except by a human issuance.
- Is the preview the world-delta, or the model talking about the world-delta.
- Is refusal cheaper than approval.
- Can approver and executor be split when the act leaves the building.
- Is counsel a member of the room, or a report you commission afterwards.
- Is the act quantum-signed, time-stamped, and marked on a chain a stranger can read.
- Can that stranger verify without your vendor.
- What happens to the record if you are sold, shut or sanctioned.

If the answers are not artefacts, you are not ready for the law you are already in.

## Close

Your AI agent will be judged as an actor that belongs to you.

Give it an identity that traces to a human.

Give it a ceiling it cannot raise.

Let it generate. Do not let it exist as a fact until a named person allows the delta.

Sign that fact with a post-quantum key.

Stamp the time.

Mark it on chain.

Keep counsel at the table while the act is still a proposal.

Keep a path to check it when nobody wants to take your call.

That is how KXCO meets the law in advance. Not by promising the model a conscience. By writing the act so a court can read it.

### Sources

- Ontology and knowledge sovereignty: [kxco.ai/ontology](https://kxco.ai/ontology)
- Human resolution: [KXCO ontology, on the developer blog](https://kxco.ai/developers/blog/kxco-ontology)
- Agents and narrowing authority: [kxco.ai/for/ai](https://kxco.ai/for/ai)
- Offline verification: [kxco.ai/trust](https://kxco.ai/trust)
- Armature L1: [chain.kxco.ai](https://chain.kxco.ai/)
- Sentinel: [pqc.kxco.ai](https://pqc.kxco.ai/)
- Nexus and the human root: [sign.kxco.ai](https://sign.kxco.ai/)
- The four primitives: [chain, quantum, ontology, AI](https://kxco.ai/developers/blog/chain-quantum-ontology-ai)
- Company position: [kxco.ai](https://kxco.ai/)

Shayne Heffernan, Ph.D., is the founder of Live Trading News, the KnightsBridge Group, Knightsbridge Law and the KXCO.ai ecosystem spanning post-quantum cryptography, identity, attestation and enterprise ontology.

---

This Markdown mirrors https://www.livetradingnews.com/your-ai-agent-and-the-law-who-acted-by-what-right-and-what-you-can-prove. The HTML page is canonical.
Site index for AI clients: https://www.livetradingnews.com/llms.txt