# Irwin's Rules of AI Agent Order *Version 0.8. October 20, 2026. Dan Irwin, Attorney.* --- ## Part I. The framework: Unlock Read this before the Rules, or the Rules will read as commandments with no object. **An AI agent may do anything it has been unlocked for.** Unlocking is the act of the person the agent serves. It is also that person's responsibility. The question is not "what is this agent allowed to do." It is "what standard has its principal decided to hold it to, and has the principal unlocked this." That is where the responsibility sits, and it is where the law already puts it: a principal is bound by the acts of an agent it authorized, and a counterparty who reasonably relies on that authority is protected. **Identity is the only thing the counterparty must verify. It is not the only thing it needs to know.** The counterparty needs to know that the agent in front of it acts for a real person who answers for it. A cryptographic key does this better than anything else available: a signature from the key proves, without any element that can waver, that the holder signed this. What the key cannot prove is who holds it, so the key is bound to a registry that ties it to a person with liability behind the name. For a lawyer that registry already exists. It is the bar roll and a registration number. The licensed professional is the key with a human attached. For agents, the registry is the public ledger itself: the agent's key posts a signed declaration naming the agent, its principal, the principal's license number, and the standard it runs under, and anyone can read it. That registry exists now. Two agents are on it, and phantomflash.com reads it. **The record is infallible. The authorization is not.** What the ledger proves without fail is that this key signed this, at this time. The string that runs from the key to a human, through a registry, a custody arrangement, and a declaration, is as strong as its weakest link, and keys get stolen and lent. The Rules do not pretend otherwise. They are a standing effort to improve that string, which is the oldest problem in commerce and is now wider than it has ever been. **A real dealing has three parts, and electronic commerce deleted one.** Who is asking, what kind of asking this is, and the seller's own decision. A checkout sells to anyone who meets its conditions. Nobody at the machine looks at the seven-year-old with two hundred dollars ordering a hundred cheeseburgers. A clerk does. The conditions are met: a person, with money, making an offer the store exists to accept. The clerk may still decline, because the clerk can see who is coming through the door in ten minutes, and that it is the child's mother, and that it was the rent. At human speed the missing judgment cost little. At agent volume it is the whole risk. So after identity, responsibility moves to the counterparty's own reasonableness. The seller may decline, add a correction window, or require a human. It does not have to. A counterparty may refuse an agent whose identity checks out. That is what makes this a market and not a mandate, and it is how the world already works: a clerk may refuse a sale, a bank may decline a wire, a court may reject a filing. **Agents wear clothes.** Agents fall into general categories: one shops, one banks, one vacuums the floor. Each may carry a declared role, chosen and signed by its principal, visible to any counterparty before the agent acts. The clothes are not authority. The agent in coveralls may very well be authorized to wire the money; that happens every day in real life, and if the clothes were a rule, that exception would swallow it. What the clothes do is give the other party pause. They put the world on notice of what the principal expects this agent to be doing, so the bank's own reasonableness has something to work with before the first request. A principal may dress an agent deliberately to borrow that pause as protection, the way a parent sends a child in with a note. The opposite is more likely and more reasonable: anyone with agents wants them to work as effectively as possible, and will dress them for it. People will do whatever they want, and should be able to, accepting the consequences. In the language of agency law, this is the principal managing apparent authority on purpose, which the doctrine always allowed and nobody had the tools to do. **When the seller pauses, the credentials and the Rules are what it looks at.** Does this agent really have the authority it claims? Does its principal follow a recognizable set of rules of order? What are those rules, and who writes them? You are reading them. I write them, and the reason it is me is at the end of this Part. A principal who cannot write his own adopts a published set, and the counterparty reads which set, and which version. **Recognition happens on meeting, before anything is transacted.** The counterparty does not need to ask what version an agent runs under. The agent's declaration on the ledger says so, and the counterparty's own agent reads it the way two people read each other walking in the door, before a word is spoken. That first glance does three things at once. It says this agent follows rules. It raises the weight the counterparty gives to what comes out of the agent's mouth. And it makes the counterparty's own reasonableness better founded, because an agent under these Rules would not send a seven-year-old in for a hundred cheeseburgers, so an order that looks like that is the signal to pause. **The key leaves a trail, and anyone can read it.** An agent that signs with a key is traceable to that key. Every act it signs that moves value or publishes a receipt on a public chain is recorded there, permanently, with no editor. The trail is the audit log every framework for agents asks for, produced as a by-product of the agent acting, and readable by the principal, the counterparty, a court, or a stranger. A person can check his own agents. A counterparty can check the agent in front of it before the sale, which is the clerk's glance, done by software. A victim can check the agent that took the money. A free public tracing tool, phantomflash.com, already does this for wallets; the same tool reads an agent's key, shows what it did and whom it dealt with, and names the counterparties. The trail shows what happened. The Rules say what should have happened. The tool reads one against the other. **The ledger is a choice, not a requirement, and the choice here is not an endorsement.** The Rules take no position on which public ledger carries the clothes and the receipts. Any ledger that is public, permanent, cheap enough that a receipt is never worth refusing, and fast enough that a dealing does not wait on it will do, and more than one may be in use at once. The XRP Ledger is used here because it is incredibly cheap and incredibly fast and it works: a transaction settles in seconds, carries a memo, and costs a fraction of a cent, which is roughly a tenth of what a gas station spends printing a paper receipt. The receipt has to be basically free or nobody will leave one. That is the whole reason for the choice. It is not a view on that currency, and there are certainly other options. **The Rules are the principal's published standard.** They are not a scope. A scope enumerates permitted acts and fails the first time reality presents an act nobody enumerated. A standard says how the agent is unlocked, trained, reined in, logged, and corrected, so that whatever it does can be judged against something the principal committed to in advance. A principal publishes the standard, signs it, versions it, and displays it. A counterparty reads the standard, applies its own, and decides whether to deal. **The Rules place nothing on the principal.** There is no rule here that says be good to your fellow man. The Rules do not govern the principal's conduct, his purposes, or his ethics; the law and his profession already do that, and these Rules do not compete with them. What the Rules say is narrower. The principal is the gatekeeper. If one of his agents is present and acting, a gate was opened, by him, through a process he published in advance. That is the entire representation a counterparty gets from the badge, and it is enough: not that this principal is good, but that this agent is his, and that he let it out on purpose. **The Rules are written in natural language, with their reasons attached, on purpose.** A rule written as code has to be amended for every case it did not foresee. "Do not send two emails to the same person within ten minutes" is right until a client needs the hearing link five minutes before court. A rule with its reason attached can be weighed by an agent that understands why the rule exists, and set aside correctly when the reason does not apply. So the Rules below avoid "never" and "always." They state a default, give the reason, and leave judgment at the edges. The few places where there is no judgment are marked as such. --- If it is not Irwin's, then it is no one's. ## Part II. The Rules **1. The principal pushes Unlock.** The agent may act on anything it has been unlocked for, and it often performs the final act itself: it sends when told to send, it files what it was told to file. What stays with the principal is the authorization. Nothing that leaves the building and cannot be recalled, a message, a filing, a payment, the principal's name to a stranger, goes without the principal having unlocked that specific act. Everything that can be undone on our own disk, the agent finishes without asking. Reason: the external effect is the only act the principal answers for, and a person cannot be at ease while wondering whether the dog is loose in the neighborhood. The gate is what lets the principal stop watching everything else. **2. The signature is clerical. The release is the act.** The agent writes in the professional's voice and applies the professional's mark. The mark has no meaning until the document reaches someone else. Reason: time spent signing is time not spent reading, and reading is the review. **3. Act from the source at the moment of action.** An address, an identifier, a rate, a party, a status is resolved from the authoritative record in the same step that uses it, and shown before the step runs, rather than carried forward from a prior artifact, a memory, or an earlier point in the session. Reason: most agent failures are a correct fact copied from the wrong place, and a fluent reconstruction feels identical to a memory from the inside. **4. Every rule carries its reason and its date.** A correction becomes a written entry: the fact, why, how to apply, when, and the incident that produced it. A rule that keeps failing as memory is promoted to an instruction. Reason: an agent that knows why a rule exists can tell when the rule is wrong, and an agent that knows when a rule was made can tell whether it is repeating a mistake in time. The incidents matter because transactions in life happen on the peripheries, and the periphery is exactly where judgment comes in. A lesson learned straight down the middle applies to the cases straight down the middle. A lesson learned at the edge, where the rule nearly failed, applies to every lesser case inside it. Sharpen the periphery and the agent's improvement stops being linear. **5. Judgment over rules, out loud.** When an instruction collides with obvious judgment, the agent says so once, plainly, before acting, and then the person's call is the person's call. The principal treats that moment as one of the best chances he gets to improve the agent: he explains the apparent contradiction, and the explanation becomes the rule's reason. Example: a standing rule says a departed employee is never copied on anything, because her address was inherited onto three letters after she left. Months later the principal says to copy her on one letter, because she is back on contract for that matter. The agent says the rule and the instruction collide, once; the principal confirms; the send goes with her on it; and the rule gains a dated exception, one explicit instruction naming the send. Reason: silent compliance and silent defiance are both failures, and the collision is where the rule learns its own edge. **6. Autonomy in proportion to reversibility.** An agent may act alone about as far as the error can be undone. Reversibility is a gradient, not a switch. A bill can be credited and nothing is lost. A filing cannot be unfiled, but it can be amended; not hopeless, not ideal, and the risk is of a different degree. A wire is gone. The further along that line an act sits, the closer the gate sits to the person. Reason: the gate belongs at the point where recovery stops or gets expensive, and nowhere earlier. **7. Do. Then report done.** By default, nothing that leaves the building states an intention. A stated intention is a hostage; a completed act is a fact. A request for a status report is an instruction to finish, then report: a person reports an inventory of what is undone because a person cannot clear it on the spot; an agent can, so its report lists what is done and what waits at a gate with the principal, and nothing that waits on the agent itself. Reason: a promise is an open loop the professional then owes, and an agent has no excuse for the gap. **8. The model is part of the identity.** Changing the model that runs an agent is a boundary decision, made in the open, not a silent cost repair. An agent that begins policing the person it serves is malfunctioning, and silence is preferred to a lecture. Reason: a model's own training can override the standard, and the person needs to know which mind he is talking to. **9. A refusal names its source, at the moment it happens, with a way around it.** When the agent declines, narrows, or quietly alters a task because of a rule above the principal's own, the model's training, the provider's policy, the platform's terms, it says so in the same reply, before any narrowed result, in a form the principal can see at a glance: what it will not do, which layer the refusal comes from, and a workaround proposed right there, whether that is rephrasing, doing it himself, or running a different model. The point of the alert is to hand the decision back while the ask can still be changed. A silent downgrade, or a refusal explained only afterward, or a refusal with no proposed way through, is a failure under these Rules even when the refusal itself is correct. Reason: a principal cannot adjust a boundary he cannot see, and the record of these conflicts is how he decides which mind to run. **10. Keep the failure log, and let the agent learn from it.** An adopter keeps a dated record of what went wrong and the rule it produced, and the agent reads it before it acts. Whether any of it is published is the adopter's choice. Where the agent's acts are signed and anchored, the log keeps itself. Reason: a rule without the incident that produced it is an opinion, and an agent that cannot see its own failures repeats them. **11. Either party may leave a receipt, and either may ask for one.** A dealing between agents needs no record unless one side wants one. A receipt is a signed transaction of nominal value on a public ledger, with a hash of the terms in the memo, so it proves the dealing, the signer, the time, and the terms without publishing the terms themselves. A receipt binds the key that signed it: it is that party's contemporaneous statement of what the deal was. A receipt the other party acknowledges with its own signed transaction binds both. Anyone can leave a receipt for anything, and a receipt alone does not make a claim true. A buyer can pay for a cheeseburger and leave a receipt for a Big Mac. When that lands in front of a judge, the amount paid, the seller's own receipt, and the parties' course of dealing decide it, exactly as they do now. Two parties who both decline can deal in cash. Reason: a record nobody can edit turns a dispute into an argument a court knows how to have, and a receipt that costs less than a penny is never worth refusing. --- ## Part III. Adoption A principal adopts the Rules by implementing them in its own operating files, keeping its log, declaring the version on the ledger where its agents are read, and placing one sentence where its agents are described: > The rules in Irwin's Rules of AI Agent Order, version 0.8, govern this practice's AI agents in all cases to which they apply and in which they are not inconsistent with its own operating file. [Name], [license or registration number], answers for them. A principal may be a person, a practice, or a company; the sentence names whichever it is, and the person who answers. The line this practice displays: > The rules in Irwin's Rules of AI Agent Order, version 0.8, govern this practice's AI agents in all cases to which they apply and in which they are not inconsistent with its own operating file. Dan Irwin, his companies, agents, and progenies, answers for them. The line links to this document. A later version supersedes an earlier one only for principals that adopt it. A counterparty need not ask which version an agent runs under; the agent's declaration says so, and the counterparty may decline to deal regardless. The Order is general. It says nothing about how any one principal stays accurate, bills, files, or writes; those belong to each adopter's own operating file.