An AI Agent That Buys Things Is Not a Chatbot With Extra Steps
The moment software acts — books, purchases, commits — on someone's behalf, it stops being a content problem and becomes an authority problem. The good news: most of the law already exists. The bad news: it exposes the terms of service almost no agentic product has bothered to write.
The Law Is Older Than the Technology
The instinct is to assume autonomous AI agents fall into a legal void. They mostly do not. US electronic-transaction law has recognized the concept of an "electronic agent" — software that initiates or completes a transaction without human review at the point of action — for over two decades, in the Uniform Electronic Transactions Act adopted across most states and in the federal E-SIGN Act. A contract formed by such an agent is not void for lack of a human keystroke, so long as the agent's operation is legally attributable to the person on whose behalf it acted.
Overlay that with ordinary agency law — actual authority, apparent authority, ratification — and you have the two questions that decide almost every agentic dispute: was the agent acting within the authority it was given, and whose act is it. Nearly everything else is detail.
Three Roles, Three Different Exposures
"Who is liable" has no single answer because an agentic transaction has at least three parties, each standing somewhere different.
The operator who runs the agent for its own business
If you deploy an agent to procure, price, respond, or transact for your company, its acts within its intended function are your acts. You cannot point at the model to disclaim a commitment the agent made inside the job you gave it. Your controls are internal: hard limits, human-in-the-loop on consequential actions, and logging that proves what the agent was and was not authorized to do.
The platform that gives an agent to users
If your product lets users deploy an agent, your terms typically push transaction-level risk onto the user — they granted the authority, they own the resulting deals — while you retain exposure for defects in the agent itself: it ignored the limits it advertised, it acted outside the mandate the UI let the user set. The line you must draw cleanly is 'the user's transaction risk' versus 'our product working as described.'
The counterparty who dealt with the agent
The business or person on the other side looks to whoever the agent acted for and relies on apparent authority if the deal is challenged. Their protection is reasonable belief; yours, when you are that counterparty, is diligence about whether the agent was actually authorized — especially for high-value commitments where 'the bot agreed' is a thin foundation.
Scope of Authority Is a Code Problem, Not Just a Legal One
The disputes that hurt are the ones where the agent exceeded its mandate — spent past a limit, bought the wrong thing, agreed to terms nobody approved. Whether you are bound turns on whether the agent had authority, and the strongest position is one where the authority you granted is explicit, enforced in the software, and where it matters, visible to the counterparty.
That means the guardrails are not decoration; they are the evidence. A per-transaction cap, a category allowlist, a confirmation step above a threshold, and an immutable log of what the agent was permitted to do are simultaneously good engineering and the record that decides an authority dispute. An agent with no enforced limits is one that holds itself out as able to do anything — which is precisely the apparent-authority argument you do not want made against you.
The Terms Every Agentic Product Needs and Most Skip
Put It In the Terms
- ☐The scope of authority the user grants the agent, stated plainly
- ☐Spending, action, and category limits the user sets and can see
- ☐What the user must review or confirm before the agent commits
- ☐Allocation of loss for erroneous or out-of-scope actions
- ☐A disclosure that an AI agent may act and the user supervises it
- ☐Logging and dispute process the user can rely on
Build It Into the Product
- ☐Hard-enforced limits, not just prompt instructions
- ☐Human-in-the-loop confirmation above a value threshold
- ☐An immutable audit log of every consequential action
- ☐Disclosure to counterparties that they deal with a bounded agent
- ☐A kill switch and a way to reverse or dispute an action
- ☐Version-pinned model behavior for the transaction path
Frequently Asked Questions
Can we just disclaim all liability for the agent in our terms?
You can allocate a great deal, but not everything, and an overbroad disclaimer can backfire. Courts and regulators are skeptical of terms that let a product act on someone's behalf while disclaiming any responsibility for it doing so within the function you sold. A defensible split accepts responsibility for the agent working as described — honoring the limits, staying in scope — while placing the user's chosen-transaction risk on the user. A blanket 'not our problem' clause invites a court to rewrite the whole allocation.
Does the EU AI Act change any of this for agents?
It adds an overlay rather than replacing the contract analysis. The EU regime brings transparency obligations and, for higher-risk uses, governance duties that can attach to how an agent is built and disclosed. But whether a given transaction binds and who bears its loss is still resolved by contract and agency law in the relevant jurisdiction. Treat AI-Act obligations as compliance requirements sitting alongside — not instead of — a clean authority-and-liability structure in your terms.
If our agent uses a third-party model that misbehaves, is that our fault or the model provider's?
To your user and to the counterparty, it is generally your product — you chose and deployed the model, and they contracted with you, not the model provider. Your recourse against the provider is a separate matter governed by your agreement with them, which for major model APIs typically disclaims consequential damages heavily. That asymmetry is exactly why enforced guardrails and human-in-the-loop on consequential actions matter: you cannot rely on passing model failures upstream.
How is an AI agent different from the auto-buy bots that have existed for years?
Legally, less than the hype suggests — programmatic trading and automated purchasing bots already operated as electronic agents under existing law. What changes is unpredictability and scope: an LLM-driven agent can take actions its operator did not specifically foresee, across open-ended tasks, which stresses the authority analysis and makes enforced limits and logging far more important than they were for a deterministic script.
Do we need this if the agent only recommends and a human always clicks buy?
Your risk drops substantially, because a human taking the final action supplies the authority and breaks the 'the agent committed us' chain — much like the human-review exception that governs other AI rules. Keep the recommendation honest and non-deceptive, but you are largely out of the agentic-authority problem. The exposure returns the instant the agent can complete a transaction without that human step, so be deliberate about where you draw the automation line.
Enforced Limits Are the Whole Defense
The agentic products that survive their first serious dispute have the same thing in common: the authority the user granted was explicit, the software enforced it, and a log proves it. The ones that don't relied on a prompt to keep the agent in line and a terms-of-service page that never mentioned authority at all.
Decide the scope, enforce it in code, log it, and put the allocation of loss in writing. That sequence is the difference between an agent that is a feature and one that is a liability.
This article is general information about contract and agency principles applied to autonomous AI agents, not legal advice. The law here is evolving and varies by jurisdiction — have your agent's terms, disclosures, and liability allocation reviewed by qualified counsel before you ship.