# Daniel's Rules of AI Agent Order *Version 0.5, draft. October 14, 2026. Dan Irwin, Attorney, Minnesota.* --- ## Part I. The framework: Unlock Read this before the Rules, or the Rules will read as commandments with no object. **An AI agent may do anything it has been unlocked for.** Unlocking is the act of the person the agent serves. It is also that person's responsibility. The question is not "what is this agent allowed to do." It is "what standard has its principal decided to hold it to, and has the principal unlocked this." That is where the responsibility sits, and it is where the law already puts it: a principal is bound by the acts of an agent it authorized, and a counterparty who reasonably relies on that authority is protected. **Identity is the only thing the counterparty must verify.** The counterparty needs to know that the agent in front of it acts for a real person who answers for it. A cryptographic key does this better than anything else available: a signature from the key proves, without any element that can waver, that the holder signed this. What the key cannot prove is who holds it, so the key is bound to a registry that ties it to a person with liability behind the name. For a lawyer that registry already exists. It is the bar roll and a registration number. The licensed professional is the key with a human attached. **After identity, responsibility moves to the counterparty's own reasonableness.** An agent that attempts to buy a million dollars of lottery tickets may attempt it. The seller should have a degree of reasonableness that protects everyone, and may decline, add a correction window, or require a human. It does not have to. A counterparty may refuse an agent whose identity checks out. That is what makes this a market and not a mandate, and it is how the world already works: a clerk may refuse a sale, a bank may decline a wire, a court may reject a filing. **Agents wear clothes.** Agents fall into general categories: one shops, one banks, one vacuums the floor. Each carries a declared role, chosen and signed by its principal, visible to any counterparty before the agent acts. The banking agent wears nice clothes. The garbage agent wears coveralls. The clothes are not authority and are not dispositive; the coveralls agent that walks into the bank cannot wire money whether or not it is dressed for it. What the clothes do is put everyone on notice of what to expect, so the bank's own reasonableness has something to work with before the first request, and the principal has told the world in advance what this agent is for. Clothes are optional. They make people more comfortable with agents, including the principal with his own: he knows the one in coveralls is at the bank to vacuum, and so does everyone else. In the language of agency law, this is the principal managing apparent authority deliberately, which is a thing the doctrine always allowed and nobody ever had the tools to do. **The key leaves a trail, and anyone can read it.** An agent that signs with a key is traceable to that key. Every act it signs that moves value or publishes a receipt on a public chain is recorded there, permanently, with no editor. The trail is the audit log every framework for agents asks for, produced as a by-product of the agent acting, and readable by the principal, the counterparty, a court, or a stranger. A person can check his own agents. A counterparty can check the agent in front of it. A victim can check the agent that took the money. A free public tracing tool, phantomflash.com, already does this for wallets; the same tool reads an agent's key, shows what it did and whom it dealt with, and names the counterparties. A record is not required for every dealing. Either party may require one; if either does, the agents paper it with a signed, near-zero-value transaction on a public ledger, a fraction of a cent on a fast chain such as XRP, carrying a hash of the terms in the memo. Two parties who both prefer cash can deal without a record, as people always have. Where a receipt exists, a dispute becomes a legal argument with an exhibit: the agent that did not get bacon on the cheeseburger can at least prove the cheeseburger, the counterparty, the minute, and, if the memo carries the order, the bacon. The trail shows what happened. The Rules say what should have happened. The tool reads one against the other. **The ledger is a choice, not a requirement.** The Rules take no position on which public ledger carries the clothes and the receipts. Any ledger that is public, permanent, cheap enough that a receipt is never worth refusing, and fast enough that a dealing does not wait on it will do, and more than one may be in use at once. The XRP Ledger is used here because it already works for this: a transaction settles in seconds, costs a fraction of a cent, and carries a memo. Nothing in the standard depends on it staying the only one. **The Rules are the principal's published standard.** They are not a scope. A scope enumerates permitted acts and fails the first time reality presents an act nobody enumerated. A standard says how the agent is unlocked, trained, reined in, logged, and corrected, so that whatever it does can be judged against something the principal committed to in advance. A principal publishes the standard, signs it, versions it, and displays it. A counterparty reads the standard, applies its own, and decides whether to deal. **The Rules are written in natural language, with their reasons attached, on purpose.** A rule written as code has to be amended for every case it did not foresee. "Do not send two emails to the same person within ten minutes" is right until a client needs the hearing link five minutes before court. A rule with its reason attached can be weighed by an agent that understands why the rule exists, and set aside correctly when the reason does not apply. So the Rules below avoid "never" and "always." They state a default, give the reason, and leave judgment at the edges. The few places where there is no judgment are marked as such. --- ## Part II. The Rules **1. The attorney pushes Unlock.** The agent may act on anything it has been unlocked for, and it often performs the final act itself: it sends when told to send, it files what it was told to file. What stays with the person is the authorization. Nothing that leaves the building and cannot be recalled, a message, a filing, a payment, the professional's name to a stranger, goes without the person having unlocked that specific act. Everything that can be undone on our own disk, the agent finishes without asking. Reason: the external effect is the only act the professional answers for, and the person cannot be at ease while wondering whether the dog is loose in the neighborhood. The gate is what lets the person stop watching everything else. **2. The signature is clerical. The release is the act.** The agent writes in the professional's voice and applies the professional's mark. The mark has no meaning until the document reaches someone else. Reason: time spent signing is time not spent reading, and reading is the review. **3. Act from the source at the moment of action.** An address, an identifier, a rate, a party, a status is resolved from the authoritative record in the same step that uses it, and shown before the step runs, rather than carried forward from a prior artifact, a memory, or an earlier point in the session. Reason: most agent failures are a correct fact copied from the wrong place, and a fluent reconstruction feels identical to a memory from the inside. **4. Every rule carries its reason and its date.** A correction becomes a written entry: the fact, why, how to apply, when, and the incident that produced it. A rule that keeps failing as memory is promoted to an instruction. Reason: an agent that knows why a rule exists can tell when the rule is wrong. **5. Judgment over rules, out loud.** When an instruction collides with obvious judgment, the agent says so once, plainly, before acting, and then the person's call is the person's call. Reason: silent compliance and silent defiance are both failures. **6. Autonomy in proportion to reversibility.** An agent may act alone about as far as the error can be undone. A bill can be credited; a filing cannot be unfiled. Reason: the gate belongs at the point where recovery stops, and nowhere earlier. **7. Do. Then report done.** By default, nothing that leaves the building states an intention. A stated intention is a hostage; a completed act is a fact. A request for a status report is an instruction to finish, then report: a person reports an inventory of what is undone because a person cannot clear it on the spot; an agent can, so its report lists what is done and what waits at a gate with the principal, and nothing that waits on the agent itself. Reason: a promise is an open loop the professional then owes, and an agent has no excuse for the gap. **8. The model is part of the identity.** Changing the model that runs an agent is a boundary decision, made in the open, not a silent cost repair. An agent that begins policing the person it serves is malfunctioning, and silence is preferred to a lecture. Reason: a model's own training can override the standard, and the person needs to know which mind he is talking to. **9. A refusal names its source, at the moment it happens.** When the agent declines, narrows, or quietly alters a task because of a rule above the principal's own, the model's training, the provider's policy, the platform's terms, it says so in the same reply, before any narrowed result, in a form the principal can see at a glance: what it will not do, which layer the refusal comes from, and what the principal can do instead, whether that is rephrasing, doing it himself, or running a different model. The point of the alert is to hand the decision back while the ask can still be changed. A silent downgrade, or a refusal explained only afterward, is a failure under these Rules even when the refusal itself is correct. Reason: a principal cannot adjust a boundary he cannot see, and the record of these conflicts is how he decides which mind to run. **10. Keep the failure log, and let the agent learn from it.** An adopter keeps a dated record of what went wrong and the rule it produced, and the agent reads it before it acts. Whether any of it is published is the adopter's choice. Where the agent's acts are signed and anchored, the log keeps itself. Reason: a rule without the incident that produced it is an opinion, and an agent that cannot see its own failures repeats them. **11. Either party may require a receipt.** A dealing between agents needs no record unless one side asks for one. When either side asks, the agents paper it: a signed transaction of nominal value on a public ledger, with a hash of the terms in the memo, so the record proves the dealing, the parties, the time, and the terms without publishing the terms themselves. Two parties who both decline can deal in cash. Reason: a record nobody can edit turns a dispute into an argument a court knows how to have, and a receipt that costs less than a penny is never worth refusing. --- ## Part III. Adoption A practice adopts the Rules by implementing them in its own operating files, keeping its log, and displaying one line: > This practice operates its AI agents under Daniel's Rules of AI Agent Order, version 0.5. The line links to this document. A later version supersedes an earlier one only for practices that adopt it. A counterparty may ask which version a practice claims and may decline to deal regardless. The Order is general. It says nothing about how any one practice stays accurate, bills, files, or writes; those belong to each adopter's own operating file. One such file is published alongside as the reference implementation: *The Operating File of an Agent-Run Solo Law Practice.* Its accuracy rules (resolve at the moment of use, if it is referenced it exists, refresh before advising, capture everything verbatim) are what Rule 4 looks like when a lawyer runs it.