When 10,000 Agents Act

An enterprise that deploys ten thousand autonomous economic agents must answer four questions about every one of their actions: who authorised it, who bears the consequences, what legal standing the mandate has outside the system that issued it, and what evidence would let the action be contested afterwards. This note argues that the first three questions are being answered — unevenly, but visibly — by a commercial agent-governance layer that reached general availability during 2026, while the fourth is not being answered by the same layer, and that the asymmetry between them becomes constitutive rather than merely inconvenient at population scale.

The argument rests on documented absence as much as on documented presence. Primary vendor documentation for enterprise agent identity governance specifies, in detail, how an agent acquires a distinct identity, how its permissions are scoped through templated blueprints, which human sponsor is accountable for it, which approver must clear its access requests, and when that access lapses. The same documentation specifies sign-in and authentication logging. It does not specify a retained record that links a particular executed action to the particular mandate, scope and approval under which it was taken, across delegation hops — what this note calls mandate provenance. Independently and from inside the standards process, an Internet-Draft states that the governing token-exchange standard permits nested actor claims but defines no interoperable rules for preserving, extending, disclosing and validating a delegation path across successive exchanges, leaving chain continuity and audit evidence to private convention; that draft is an individual submission and has not been adopted by a working group.

Three propositions follow. First, the authorisation layer and the evidence layer are being built at different rates and by different actors, and only the first is converging. Second, this asymmetry is tolerable at small numbers and corrosive at large ones, because the cost of reconstructing an authorisation after the fact rises with the number of concurrent, short-lived, interacting mandates while the expected value of any single reconstruction falls. Third, neither the international instrument track nor the converging private standards body is currently building the missing layer: the UNCITRAL working group that produced the Model Law on Automated Contracting has completed that work and moved to other subjects, and the standards body now consolidating the commercial agent-payment stack has published no specification and makes no claim about legal recognition.

The note gives full weight to the strongest objection: that absence from a documentation page is not absence from a product, that enterprise platforms carry extensive audit machinery not described on the pages consulted, and that evidence law already allocates the risk of unproducible records through burdens of proof, business-records doctrine and adverse inference — so that what looks like an institutional gap may be an ordinary allocation of litigation risk requiring no new institution at all. That objection is not defeated here. It is made falsifiable, and the conditions under which this note's propositions should be abandoned are stated in Section 15.

Three propositions are defended. Each carries a claim-class tag in the programme's notation, where [FACT] marks what a primary source states, [DOCUMENTED PRACTICE] marks what a primary source shows a named actor doing, [INFERENCE] marks what follows from the convergence of such facts, [HYPOTHESIS] marks what requires empirical or institutional testing, and [NORMATIVE] marks a proposal about what ought to be done.

Proposition RN-1 — the authorisation–evidence asymmetry

[INFERENCE] In the enterprise agent-governance layer that reached general availability during 2026, the controls that confer authority on an autonomous actor are specified in substantially greater detail than any retained record that would allow the exercise of that authority to be reconstructed and contested afterwards. Authentication logging is documented. Mandate provenance — the reconstructable lineage linking a specific executed action to the specific mandate, scope, blueprint inheritance and human approval under which it was taken, across delegation hops, together with the validity state of that mandate at the moment of execution — is not specified in the governance documentation consulted, and the standards work that would make it interoperable across systems is an unadopted individual submission.

Primary support. The identity platform describes agent identity blueprints as templates with parent–child relationships, so that one policy applies to many agents, and names sign-in and audit logging for agent authentication and activity (L1-01). The governance documentation specifies human sponsors "accountable for making decisions about its lifecycle and access", access granted through entitlement-management access packages with requests routed to designated approvers, OAuth 2 delegated scopes inherited from the parent blueprint, three distinct request pathways, expiry-based lapse of access, and automatic transfer of sponsorship to the sponsor's manager on departure (L1-02). The same governance page makes no statement about audit logs or evidence of agent actions, and the release-notes page does not cover audit and logging (L1-02, L1-03). Separately, draft-mw-oauth-actor-chain-01 states that RFC 8693 permits an act claim to carry nested prior actors but defines no interoperable rules for preserving, extending, disclosing and validating a delegation path across successive exchanges, leaving implementations to invent their own conventions for chain continuity, disclosure control and audit evidence (L1-04).

What the proposition does not assert. It does not assert that the products concerned lack audit capability. It asserts that the documented governance surface specifies conferral in more detail than provenance, and that the interoperable form of provenance is unadopted. The distinction matters and is pressed hard against this proposition in Section 13.

Proposition RN-2 — scale changes the economics of contestability

[HYPOTHESIS] The authorisation–evidence asymmetry is tolerable at small numbers of agents and corrosive at large ones, not because reconstruction becomes impossible but because its economics invert. As the number of concurrent, short-lived, interacting mandates rises, the cost of reconstructing any particular authorisation rises with the volume of candidate records and the number of hops, while the expected value of reconstructing it falls with the declining share of total harm attributable to any single action. Beyond some threshold, rational parties stop contesting individual actions and contest only aggregates — and aggregates are precisely what dyadic doctrine is least equipped to adjudicate.

This is a hypothesis about cost structure, not a claim about current practice. It is testable: Section 15 states what measurement would support or defeat it, and the research agenda sets out the studies that would produce it.

Proposition RN-3 — neither track is currently building the missing layer

[FACT] The UNCITRAL working group whose work produced the Model Law on Automated Contracting has completed that subject and is now mandated to work on data provision contracts, followed by consolidation of e-commerce texts and paperless trade; its 70th session (March 2026) had data provision contracts as the sole agenda topic (L1-05).

[FACT] The standards body into which the commercial agent-payment stack is converging formed its Agentic Authentication Technical Working Group on 28 April 2026, received the Agent Payments Protocol from Google and the Verifiable Intent framework from Mastercard, has published no specification, and says nothing in its announcement about legal recognition or regulation (L1-06).

[INFERENCE] The layer that would make mandate provenance both interoperable and legally cognisable is therefore not currently the active work programme of either the international instrument track or the converging private standards track. The one place it is being worked on in public is an individual Internet-Draft that no working group has adopted (L1-04).

Principal–agent theory and the law of agency were both built around a relationship: one principal, one agent, one grant of authority, one act whose attribution is disputed. The economic literature studies the relationship's incentive problem; the legal doctrine studies its attribution problem. Both scale by repetition — a firm with a thousand employees is analysed as a thousand relationships, with organisational structure as an overlay.

The question this note asks is whether that repetition remains adequate when the agents are machine actors created from templates. Three features of the documented architecture bear on it, and each cuts partly against the idea that anything fundamental changes.

Templated authority. Agent identity blueprints act as templates with parent–child relationships so that a single policy applies to many agents, and new agent identities inherit OAuth 2 delegated scopes from the parent blueprint (L1-01, L1-02). [INFERENCE] This is organisationally familiar — it resembles a role or a job description — but it has a property that a job description lacks: the inheritance is machine-evaluated at authorisation time, so a change at the blueprint level propagates to the whole population without any per-agent act. The unit at which authority is actually set is the blueprint, while the unit at which action is attributed remains the agent. Analytically, the relationship is no longer the natural unit; the population under a blueprint is.

Accountable humans, but not necessarily. Governance documentation identifies sponsors as "human users accountable for making decisions about its lifecycle and access" and calls the assignment of a delegated human one of the most important parts of governing agent identities, while not stating that a sponsor is mandatory or enforced; expiry notifications reach the sponsor only if one is set (L1-02). [INFERENCE] The architecture therefore anticipates, without excluding, the orphaned agent: an actor with live permissions and no accountable human. Whether orphaning occurs in practice is an empirical question, and the agenda proposes the study that would answer it. It is worth noting that the documented mitigation — automatic transfer of sponsorship to the departing sponsor's manager — addresses departure, which is the easy case, and not abandonment, which is the hard one.

Two kinds of authority, separated by design. The platform distinguishes an "On behalf of agent access policy" for agents acting on behalf of users from an "Autonomous agent access policy" for agents without user context (L1-03). [FACT] This is a significant piece of architecture for the programme's purposes, because it is the vendor's own recognition that delegated action and autonomous action require different authorisation treatment. [INFERENCE] It also means that the question "on whose behalf did this agent act?" has, at the level of policy, a machine-readable answer — which is a point in favour of attribution being easier than the programme has sometimes assumed, and is recorded as such.

What this does not establish. None of this shows that agency doctrine fails. The Model Law on Automated Contracting attributes the output of an automated system to the person on whose behalf it is used (L2-01), and that rule is indifferent to how many systems there are. The honest summary is that population scale changes the unit of control without, on current evidence, changing the unit of attribution — and that the interesting problems live in the gap between those two units, not in the failure of either.

The programme retired, in Ledger entry 2, the claim that recursive delegation is novel as computer science; certificate path constraints, capability systems and attenuable tokens have implemented it for years. In Ledger entry 15 it reframed what survives: what the protocol layer externalises at hop N is not a legal problem of attribution but an evidentiary residue. RN-001 can now state that residue with a named primary source rather than as an inference.

[FACT] draft-mw-oauth-actor-chain-01 states that RFC 8693 permits an act claim to carry nested prior actors, but does not define interoperable rules for preserving, extending, disclosing and validating a delegation path across successive exchanges, with the result that implementations invent their own conventions for chain continuity, disclosure control and audit evidence (L1-04).

[DOCUMENTED PRACTICE] The draft's response is instructive for the programme's purposes because of how it decomposes the problem. It defines six profiles from two evidence models — declared and verified — and three disclosure modes — full, subset and actor-only — and, for verified profiles, actor-signed step proofs with cumulative commitment state and a stable workflow identifier (L1-04).

[INFERENCE] Three observations follow, and they are the analytical core of this note.

First, evidence is now explicitly a design parameter rather than a by-product. The distinction between a declared chain and a verified one is the distinction between a record that asserts what happened and a record that can demonstrate it. That these are offered as alternative profiles means the strength of the evidentiary residue is a configuration choice made by the deploying party — which is to say, by the party most likely to be the defendant.

Second, disclosure is a separate axis from evidence. A chain may be fully verified and disclosed only as "actor-only". The capacity to prove and the obligation to reveal are orthogonal, and a system can be designed to be provable to its operator and opaque to a counterparty. This is the precise technical shape of a contestability problem.

Third, and most important for the programme's claim about the sovereign boundary: this work is unadopted. It is an individual submission on the Standards Track, not endorsed by the IETF, with no working group behind it (L1-04). The gap has been identified from inside the standards process by authors at Oracle, JPMorgan Chase, Telefónica and Aryaka — which is evidence that practitioners in payments and infrastructure regard it as real — and the response to it has not been institutionalised.

Counter-consideration, given its full weight. An unadopted draft is weak evidence of anything except that four engineers thought the problem worth writing up. Many Internet-Drafts expire unread. The draft's own statement that implementations invent their own conventions is simultaneously evidence that the gap exists and evidence that it is being filled privately, case by case, which may be perfectly adequate. The honest reading is that the draft establishes the absence of an interoperable standard, not the absence of working practice, and RN-001 claims only the former.

Attribution is the part of this field where existing law is strongest, and the note says so.

[FACT] The Model Law on Automated Contracting attributes the output of an automated system to the person on whose behalf the system is used (L2-01). [DOCUMENTED PRACTICE] The platform architecture independently distinguishes on-behalf-of from autonomous operation at the level of access policy (L1-03), which means the "on whose behalf" question has a machine-readable answer in at least one major deployment pattern.

[INFERENCE] Attribution to a principal is therefore not, on current evidence, the hard problem. The hard problems are adjacent to it:

• Scope, not identity. Agency doctrine turns on whether the act fell within actual or apparent authority (L2-03). Where scope is inherited from a blueprint and evaluated dynamically, the question "was this within scope?" is answerable only against the state of the blueprint at execution time — which is a records question, returning the analysis to Proposition RN-1.

• Revocation and in-flight action. Access ends automatically at an assignment's expiry if the sponsor takes no action (L1-02), and the documentation consulted does not state that disabling an agent revokes its access. What happens to commitments already initiated by downstream agents at the moment authority lapses is, on the documents consulted, not specified. Scenario D of SE-001 develops this.

• Intermediaries. Where a platform operator evaluates the authorisation and a scheme operator defines the mandate format, both have made a contribution to the action without being its principal. Existing law has several frames for this — intermediary liability, negligent provision of a service, scheme-rule contractual allocation — and no settled choice among them.

[NORMATIVE — flagged as proposal, not finding] Nothing in this note supports creating a new liability subject. The programme's default remains principal-default: consequences attach to the principal through the mandate chain. Proposals to attach liability to the agent itself, or to create patrimonial shells, are recorded in the programme's earlier documents as institutions to be studied, not recommended.

Who controls the infrastructure through which agents acquire permission to transact is the programme's standing question about rents, and RN-001 contributes two verified data points without asserting any market outcome.

[FACT] Extending the platform's security features to agents requires a specific licence, licensed per user (L1-01), and the platform's release notes state that agent registries are converging under a single product (L1-03). [FACT] On the payments side, two major contributors donated their agent-payment and intent-verification frameworks into one standards body, which has published no specification (L1-06).

[INFERENCE] Both movements are toward consolidation of the permission layer — in one case commercially, within a vendor's identity estate, and in the other case institutionally, within a standards body. Consolidation of a permission layer is the precondition for permission rents; it is not evidence that rents exist. The programme has already retired the claim that permission-rent economics is theoretically novel, and the analytics remain Coasean rights, delineation costs, two-sided access pricing and capture theory applied to a new object (L2-08).

[HYPOTHESIS] The economically interesting variable is not the price of permission but the cost of switching the authority that recognises you. An agent population whose identities, blueprints and inherited scopes are expressed in one vendor's constructs has a migration cost that rises with the population and with the depth of blueprint inheritance. If that is right, the rent accrues to lock-in rather than to pricing, and is invisible in any price series — which has an uncomfortable methodological implication for the programme's proposed authority-price index.

Bearing on WP-001. WP-001 develops recognition costs and permission rents as an empirical-methodological programme oriented to price formation. The switching-cost hypothesis suggests that a price-based index may measure the wrong thing. Recorded as an open issue for a future controlled revision of WP-001; not applied here. See Ledger supplement entry S-06.

Avoided. No claim is made about market size, concentration ratios, transaction volumes or revenue. No verified figure was available and none is asserted (L3-03).

SE-001 is a structured conceptual instrument, published in full as a separate document and summarised here. It posits a hypothetical enterprise operating ten thousand autonomous economic actors and develops six scenarios: a valid internal mandate whose legal effect a counterparty disputes; a delegation chain extending beyond the principal's intended scope; thousands of individually lawful transactions producing a harmful aggregate; a mandate revoked while dependent agents are still acting; a cross-border action accepted technically but disputed legally; and an automated decision with incomplete evidence of authorisation.

Each scenario states its parties and assumptions, the economic or legal mechanism engaged, at least two rival explanations, the evidence that would discriminate between them, and — required in every case — what the scenario cannot establish. No real deployment of this size has been studied. The case generates hypotheses and tests their coherence; it is not evidence for any of them.

What follows is internal critique produced within the programme's own method. It is not independent external scholarly review and must not be represented as such. Two separated passes were conducted: the first against the propositions as drafted, the second against the surviving forms after revision.

Pass I — against the propositions as drafted

C1. Absence from a documentation page is not absence from a product. (Against RN-1.) Overview pages are written for orientation and defer detail to linked articles; the governance overview explicitly does so. A platform of this scale has extensive audit infrastructure, and the what-is page does name sign-in and audit logging for agent authentication and activity. Inferring an evidentiary gap from the silence of two pages is weak method, and the programme has previously had to correct exactly this failure mode.

Response, and the revision it forced. The criticism is substantially correct and RN-1 was narrowed because of it. The original drafting implied that audit capability was absent; it now asserts only that the documented governance surface specifies conferral in more detail than provenance, that the pages consulted do not describe what is retained, and that the interoperable form is unadopted. The verified negatives in the register are explicitly scoped to named pages at a named date. Residual exposure: high. A single vendor document specifying retained mandate-provenance records would defeat RN-1 in its current form, and the author has not read the entire documentation set.

C2. Evidence law already solves this by allocating risk. (Against RN-1 and RN-2.) Legal systems do not require that records exist; they decide who loses when they do not. Burden of proof, business-records doctrine, spoliation and adverse inference, and discovery obligations together create a strong commercial incentive to retain provenance without any institutional innovation. An enterprise that cannot prove authorisation simply loses, and will build the records to avoid losing.

Response. This is the strongest objection and it is not defeated. Three qualifications are offered, none decisive. First, risk allocation works where a forum is reached; Proposition RN-2 is precisely the claim that at scale the forum is reached only for aggregates. Second, adverse inference disciplines destruction more reliably than it disciplines never having recorded. Third, the incentive argument predicts that provenance will be built where the expected litigation cost justifies it, which is an argument for uneven provision, not universal provision — and unevenness across a cross-border population is itself the research object. Standing: RN-1 survives as a claim about documentation and standardisation; the claim that this constitutes an institutional gap is downgraded to hypothesis.

C3. The Internet-Draft proves nothing. (Against RN-3.) Individual submissions are cheap. An unadopted draft by four authors is not evidence of an institutional gap; it is evidence that four people wrote a document. The programme has been burned before by treating unadopted drafts as load-bearing — Ledger entries 16 and 23 record exactly this.

Response. Accepted in part. The draft is relied on for two things only: its description of what RFC 8693 does and does not define, which is checkable against RFC 8693 itself and is not a matter of the authors' opinion; and its adoption status, which is a fact about the IETF process. It is not relied on as evidence that the gap matters, that the proposed profiles are good, or that anyone will implement them. The affiliations of the authors are noted as weak corroboration that practitioners regard the problem as real, and are given no more weight than that.

C4. "Population scale" is doing rhetorical work. (Against RN-2.) Ten thousand agents is a number with no analytical content. Enterprises already operate far more than ten thousand automated processes — every scheduled job, every integration, every RPA bot — and the institutions have coped. The note does not establish that agents differ from scripts in any way that matters to the argument.

Response, and the revision it forced. Largely accepted, and it is the reason Section 3 concludes that scale changes the unit of control rather than the unit of attribution. The distinguishing feature offered is not autonomy or number but dynamic scope inheritance with machine-time evaluation — a scheduled job's permissions are static and inspectable; a blueprint-inherited scope evaluated at authorisation time is neither. Whether that distinction carries the weight placed on it is unresolved, and it is listed as a falsification condition.

C5. The note does not prove its own novelty. Records management, evidence preservation and identity governance are mature disciplines with large literatures. The claim that provenance is underspecified may simply be unfamiliarity with that literature.

Response. Conceded as a limitation. RN-001 makes no novelty claim. Its contribution is the pairing of two independently verified observations — a documented conferral/provenance asymmetry in one vendor's governance surface, and an acknowledged absence of interoperable delegation-path evidence in the standards layer — and the question that pairing raises. If prior literature has made this pairing, the contribution reduces to a dated observation, which is still worth recording.

Pass II — against the surviving forms

C6. RN-1 has retreated into unfalsifiability. Narrowed to "the documented governance surface specifies conferral in more detail than provenance", the claim is nearly tautologous and no longer interesting: documentation is always incomplete.

Response. The claim is falsifiable and the falsifier is stated in Section 15: a primary specification of retained mandate-provenance sufficient to reconstruct authorisation lineage for an arbitrary executed action, whether from a vendor or a standards body. It is also non-trivial in one respect — the asymmetry is directional. Conferral is specified to the level of approval pathways and inheritance semantics; provenance is not specified at all on the pages consulted. A symmetric incompleteness would not support the proposition.

C7. RN-2's threshold is unmeasurable in principle. Both of its terms — reconstruction cost and individually attributable harm — are counterfactual and unobservable before a dispute, so the threshold cannot be estimated.

Response. Partly accepted. Reconstruction cost is measurable directly in a controlled setting, and the agenda proposes that study: instrument a synthetic agent population, then measure the time and records required to reconstruct authorisation for a randomly selected historical action as a function of population size and hop depth. Attributable harm is indeed counterfactual, so the threshold is estimable only up to that term. RN-2 is downgraded accordingly: the cost half is testable, the threshold is a conjecture.

C8. The single-vendor evidence base is too narrow for a general claim. One vendor's documentation cannot support a proposition about "the enterprise agent-governance layer".

Response. Accepted. This is the principal limitation and it is stated in Section 14. The proposition should be read as: documented in one major platform and in one standards track, unexamined elsewhere. Replication across at least two further platforms is the first item in the agenda's track four.

Resulting standing

The note should be weakened or abandoned under the following conditions.

RN-1 fails if a primary specification — vendor documentation, a published standard, or a regulatory record-keeping rule — specifies retained mandate-provenance records sufficient to reconstruct, for an arbitrary executed action, the mandate, inherited scope, approving party and validity state at execution time; or if examination of the fuller documentation set shows such a record was specified elsewhere and the pages consulted were simply not the right ones.

RN-1 also fails, in its "directional" form, if comparable examination shows conferral and provenance are specified at similar levels of detail and the asymmetry was an artefact of page selection.

RN-2 fails if controlled measurement shows reconstruction cost approximately flat in population size and hop depth — which would mean record design, not scale, governs contestability and the population framing is idle.

RN-2 also fails if disputes over agent actions at scale are in fact resolved individually at normal rates, with no observable shift toward aggregate-only contestation.

RN-3 fails if a working group adopts delegation-path evidence work, or an international instrument track opens a work programme on machine principals, or the converging standards body publishes a specification addressing legal cognisability.

The note as a whole is substantially weakened if the first significant population-scale incident is resolved under existing evidence and agency doctrine without any party reporting difficulty in reconstructing authorisation — which would support C2 directly.

Positive evidence that would strengthen the note: a documented dispute in which a party could not reconstruct mandate provenance and bore the consequence; an insurer pricing provenance quality explicitly; a regulator requiring mandate-provenance retention; or adoption of delegation-path evidence work by a standards body, which would convert RN-3's gap from unattended to attended.

Primary sources verified for this note are listed with retrieval details in the Source and Citation Register (RN-001), which forms part of this publication. Sources are cited above by register identifier (L1-nn, L2-nn, L3-nn).

Level 1 sources: Microsoft Entra Agent ID platform documentation; Microsoft Entra ID Governance, "Governing agent identities"; Microsoft Entra Agent ID release notes; Prasad, Krishnan, Lopez & Addepalli, "Cryptographically Verifiable Actor Chains for OAuth 2.0 Token Exchange", draft-mw-oauth-actor-chain-01 (15 June 2026); UNCITRAL Working Group IV session record; FIDO Alliance announcement of 28 April 2026.

Level 2 sources are incorporated from the Revision & Evidence Ledger v0.3 and are not restated here in stronger terms than the Ledger records.