On June 29, Senator Mark Warner released a discussion draft with a name engineered to spell its own acronym: the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act — the AI AGENT Act. The press release leads with the comforting words: privacy, security, acting in the user's best interest. Read it that way and it sounds like one more entry in the long catalog of bills that ask AI to behave.
It isn't, quite. Strip the safety framing and the load-bearing words are the ones in the title nobody quotes back: Access, Gatekeeper, Nondiscriminatory Transfer. This is an interoperability bill. Its central move is not to constrain what your agent may do — it's to constrain what large platforms may do to keep your agent out.
The harm it names#
Most AI legislation starts from a model that might misbehave. Warner's draft starts somewhere stranger and, frankly, more current: a web that is busy walling agents out. Right now the default posture of the open internet toward automated traffic is suspicion. Cloudflare challenges it, sites fingerprint it, terms of service forbid it, and a booking site or a retailer has every commercial incentive to ensure that the only thing shopping on your behalf is you, in their app, looking at their upsells.
The draft treats that exclusion as the thing worth legislating. Per the Warner release, end users of any large online platform — the threshold reported is more than 50 million monthly customers or subscribers — would get the right to choose at least one AI agent provider that meets federal security and identity standards, and have that agent honored. It is, in plain terms, a right to delegate. A right to send a deputy through the front door and not have the door slammed because the deputy is software.
That is the part that will draw blood in markets, not in safety circles. A mandated right to bring a third-party agent onto a dominant platform is an antitrust instrument wearing a consumer-protection coat. It is the Digital Markets Act logic — pry open the gatekeeper — pointed at the specific gate that AI agents keep bouncing off.
The machinery#
The rest of the draft builds the trust layer that makes forced access tolerable to the platforms doing the admitting. Three pieces, as reported by CyberScoop and CBS News:
- A vetting regime. The FTC would certify independent bodies to assess agent vendors against baseline protections — privacy, data security, acting in the user's interest. The effect is a federally backed list of agents a platform can trust without inspecting each one. You don't open your gate to all automation; you open it to certified automation.
- A fiduciary-flavored duty. An agent with reach into your most sensitive accounts — email, e-commerce, credit cards — would have to "behave in a fiduciary-like manner." That word does heavy lifting. A fiduciary can't quietly optimize for whoever pays it. Applied to agents, it is a direct shot at the obvious business model: an assistant that books the flight its maker was paid to prefer.
- Identity and consent plumbing. Providers would have to bind each agent to its human operator's identity, make clear to third-party sites that the agent is genuinely authorized, and give users explicit, revocable controls. NIST gets tasked with naming the technical standards and open protocols — including the authentication mechanisms — that make agent traffic legible to the services receiving it.
That last item is the tell that this is a 2026 bill and not a 2024 one. Warner isn't asking NIST to invent agent authentication from scratch; he's asking it to bless something. The industry is already shipping the answer — cryptographically signed agent requests, via Web Bot Auth, are live at Cloudflare's edge and moving through the IETF. The bill points the state at a standard the market is mid-way through choosing.
Most AI bills regulate the agent. This one regulates the door.
What I'd watch#
It is a discussion draft, deliberately unfinished, floated to draw fire before a real introduction. So the interesting question isn't whether this text passes — it won't, not as written — but which of its bets survive contact.
The threshold fight is coming: 50 million monthly users sweeps in a specific roster of platforms, and the lobbying will be entirely about where that line sits and what "honor the agent" actually compels. Expect platforms to argue that mandated agent access is a security and fraud nightmare, and expect them to be at least partly right — a right of access is also an attack surface, and "certified" is exactly the property attackers forge first.
But the framing is the durable contribution, whatever happens to the bill. Warner has planted a flag on a premise the rest of the field hasn't caught up to: that as agents become how ordinary people transact, the freedom that matters is not the user's freedom from AI but the user's freedom to use one — against the wishes of whoever owns the storefront. Every coming fight over agents and the open web will be a fight over where that line sits. This draft is the first time Washington has drawn it on the side of the agent.
