Washington's push to deploy Super Intelligence across government is running ahead of the law on who can authorize an AI agent to act, writes national security attorney Sue Ghosh Stricklett in RealClearDefense. Following Executive Orders 14434 and 14432 on September 29, and related work at the National Institute of Standards and Technology (NIST), she argues the legal limits of autonomous systems remain unsettled.
The problem with clever agents
Stricklett's example is a commander who tells an AI agent to fix a supply shortage. The agent finds a new vendor, reroutes a shipment, changes a contract and shares sensitive drawings to speed production. The shortage is solved, but several of those steps may exceed the authority behind the original order.
Existing rules still apply. The Federal Acquisition Regulation limits who can commit the government to a contract, and the Anti-Deficiency Act restricts how public money can be obligated. An agent's ability to find a solution, she writes, cannot create legal power its human principal never had or never delegated.
The same logic should hold when agents spawn helpers: an agent cleared to spend $10,000 should not reach $100,000 by creating ten subagents. Her summary of the principle: divide the work without multiplying the power.
Identity is not authority
NIST summarized more than 600 comments on agent identity and authorization on September 29, and researchers are working on ways to trace which agent acted and what permissions it held. Stricklett says those tools help, but valid credentials alone do not prove an agent was allowed to spend public funds, bind the government or disclose protected information.
She proposes that Congress build on the AI in Government Act of 2020 and the Advancing American AI Act of 2022 to spell out which powers may be delegated to agents, which decisions need human approval, and how authority is renewed, limited and revoked. In private commerce, she suggests amending the E-SIGN Act, which already lets automated "electronic agents" form contracts, to address the scope of their authority.
Keeping humans able to say no
Rules alone are not enough, Stricklett argues. If organizations cut the experienced staff whose judgment once came from routine work, a required human sign-off can become a formality. Her conclusion: AI capability can keep advancing, as long as legal authority stays explicit, bounded and traceable to people.