When an AI Agent Acts for You: The Contract Clauses Nobody Has Yet

What changed between "AI in the product" and "AI as an actor"

For the first few years, AI in commercial software meant a feature: summarize this, draft that, classify these. A person asked, the model answered, the person decided. Contract risk was mostly about output quality and data handling, which is what our guide to AI clauses in contracts covers.

Agentic systems changed the shape of the problem. An agent is given a goal rather than an instruction. It plans, calls tools, reads and writes to systems, and continues across steps without returning for approval. In 2026 that means agents placing purchase orders, reconciling and paying invoices, managing inventory replenishment, responding to customers in the company's name, and screening job applicants.

Every one of those is an act with legal consequence. And the contracts governing them were, in most cases, signed for a product that could not do any of it. Vendors have been shipping agentic capability faster than anyone renegotiates a master services agreement, which is precisely where a liability gap opens: the risk allocation that both sides agreed to no longer matches what the software does.

Clause 1: Granted authority — the numeric limit

This is the clause to write first, because it is the only one that limits the size of a bad day. It defines what the agent is permitted to do, expressed in numbers rather than adjectives.

A usable authority clause covers four dimensions:

• Permitted action types. An enumerated list — issue purchase orders, initiate payments, send external communications, modify records in named systems. Anything not listed is outside authority. Draft it as a whitelist; a blacklist will never be complete.
• Monetary ceilings. Per transaction, per counterparty, and per rolling 24 hours. Three numbers, because a per-transaction cap alone does not stop a thousand small transactions.
• Counterparty scope. Approved vendors only, or any counterparty; new counterparties gated behind human approval.
• Duration and revocation. When authority expires, and how it is withdrawn immediately — including who at the counterparty must be notified for a revocation to be effective against them.

That last point matters more than it looks. Between you and your counterparty, revocation is only effective once they know about it. If your agent has been placing orders with a supplier for six months and you disable it, the supplier can reasonably continue to treat orders in the established pattern as authorized until told otherwise. Say in the contract how revocation is given and when it takes effect.

Clause 2: Attribution — whose act is it?

The tempting clause here is a disclaimer: Company is not responsible for actions taken autonomously by the AI system. Do not write it. It will not work, and in some jurisdictions it now affirmatively hurts you.

An AI system has no legal personality. It cannot be an agent in the legal sense, cannot hold authority, and cannot be sued. When it acts, the law looks for the person who put it in a position to act — the deployer. U.S. electronic transaction statutes explicitly contemplate contracts formed by electronic agents with no human review, and courts have enforced them. California has gone further, enacting a rule that forecloses defendants from arguing that an AI system autonomously caused the alleged harm. A June 2026 executive order directed the Department of Justice to prioritize enforcement against those using AI agents for unlawful ends, and federal cybersecurity and national security agencies have issued guidance signaling that companies are expected to govern, monitor and explain what their agents do.

So write attribution the honest way, and get something for it: acknowledge that actions taken by your agent within its granted authority are your actions, and pair that with an express statement that actions outside granted authority are not binding — which is only credible if you actually published or disclosed the limits.

Agent Authority. Each party may perform its obligations through automated systems, including AI agents. Actions taken by a party's automated systems within the authority granted in Schedule B are the acts of that party. Actions exceeding those limits are not authorized and do not bind that party, provided that the limits in Schedule B were disclosed to the other party prior to the action and any modification is effective only upon written notice. Neither party may assert the autonomous operation of an automated system as a defense to its obligations under this Agreement.

Clause 3: Human-in-the-loop checkpoints

Oversight only means something if it names the actions it gates. "Company maintains appropriate human oversight" is worth nothing in a dispute and nothing to a regulator.

The categories that consistently deserve a checkpoint:

One caution about how you word it. If you promise a client that "all deliverables are reviewed by a qualified human," make sure that is operationally true, because it is a warranty you can breach. Promise the review you actually perform.

Clause 4: Logging, explainability and incident notice

When something goes wrong, the dispute is about what the agent did and why. If you cannot answer that from records, you lose the argument by default — and if the records live in your vendor's infrastructure, you need a contractual right to them.

Ask your AI vendor for four specific things:

1. Complete action logs covering inputs, tool calls, outputs and the identity of any approving human, retained for a stated period that comfortably exceeds your limitations period.
2. Export rights in a usable format, available during the term and for a defined window after termination. Logs you can only view in a console you lose access to are not evidence.
3. Incident notification within a stated number of hours when the vendor becomes aware of agent behavior outside documented parameters — not only for security incidents, which is all most templates cover.
4. Change notice before material changes to model behavior, tool access or default permissions. Silent capability upgrades are how your agent quietly acquires authority you never granted.

Clause 5: Liability, indemnity and the cap that eats everything

Here is the structural problem with buying agentic AI. The vendor's liability is typically capped at fees paid in the preceding twelve months. If you pay $40,000 a year for a system authorized to move $2 million, the risk allocation is not close to proportionate — and the standard terms will also disclaim any warranty as to the accuracy or fitness of output.

Four negotiable points, roughly in order of how often you will win them:

• IP indemnity for model output. Widely offered by major vendors now, usually conditioned on you using the service as documented and not disabling safety filters. Read the conditions; they are where it is lost.
• Carve-outs from the cap for breach of confidentiality, data protection violations, and gross negligence or willful misconduct. Standard in enterprise deals and worth pushing for.
• A supercap — a higher secondary limit (a multiple of annual fees) for agent actions that exceed documented parameters. Easier to win than uncapped liability because it is bounded.
• Behavioral warranties — the vendor warrants the agent will operate within configured permissions and will not exceed the limits you set. Note the shift: not a warranty that the output is correct, which no vendor will give, but that the guardrails hold, which is a system property they control.

If you cannot move any of it — and with a self-serve subscription you cannot — then the authority limits in Clause 1 are your entire risk control. Size them accordingly, on the assumption that a failure is not recoverable from the vendor.

The client side: what to ask the businesses using agents on you

The mirror image matters too. If a vendor, agency or contractor is running agents against your account, your systems or your customers, three questions belong in the agreement: which of the services are performed by autonomous systems, what authority those systems have over your data and accounts, and who reviews their output before it reaches you or your customers. The AI disclosure and accuracy clauses are the right vehicle; this just extends them from "AI helped write it" to "AI did it and nobody looked."

Where to start today

Take an inventory. List every AI system in your business that can take an action rather than produce a draft — anything that sends, buys, pays, posts, schedules or decides. For each one, write down the largest dollar amount it could commit in a day and whether any human sees the action before it happens. If you cannot answer either question, that is the gap, and it is a configuration problem before it is a drafting problem.

Then fix the contract behind it: authority limits in numbers, attribution written honestly, gated actions listed by name, audit records you can export, and a liability cap you have at least looked at.

This article is general information about how contracts commonly work, not legal advice, and reading it does not create an attorney-client relationship. Laws differ by jurisdiction and change over time. Consult a licensed attorney in your jurisdiction before relying on any agreement.