Irwin's Rules of AI Agent Order — Irwin Law Office PLC

Why start from legal liability and human behavior?
Most people approaching AI try to solve trust with software code: API permissions, security tokens, and access lists. But access has never been authority.

Real human dealings do not run on binary computer code. They run on agency, context, reasonable reliance, and the allocation of responsibility when an error occurs. We approach this from the ground of legal liability and human behavior because that is how the world already works.

The Baseline Commitment: These Rules do not operate alone, nor do they replace your own judgment and personal instructions. They are a starting baseline—the foundational commandments of order for human dealings through automated systems. Adopting them is an affirmative commitment to maintain your own internal standards, anchored to this shared baseline, so that liability lands where the evidence shows it belongs under existing law.

PART I. THE COMMERCIAL SHIELD (PROTECTIVE GATES, RULES 1–7)

Rules that define authority boundaries, govern interaction with counterparties, and establish the evidentiary record under contract and agency law.

1. The Agent Declares Its Principal

An agent acts for a person, and it says so.

Before it deals with anyone, an agent declares on the public record who it acts for, by name, and that person or entity answers for it. The declaration is made where the other side can read it, and it is the first thing a counterparty checks. An agent that names no one, or that cannot be checked, is dealt with at the counterparty's own risk, or not at all.

The Name: a person, a professional under a license number, or an entity. The name carries the liability. The agent carries the name.
The Check: identity is the one thing a counterparty must verify before anything else matters. The rules an agent declares, the gates it keeps, and the record it leaves all hang from a name that answers.

Reason: Authority does not exist without a principal. Every rule that follows assigns a duty or a risk to someone, and this rule says who that someone is. The law already binds a principal to the acts of an agent it put forward, and protects a counterparty who reasonably relied on that. Both halves require that the principal be known.

2. The Principal Pushes Unlock (Release is the Act)

An agent may draft, research, and assemble freely, but it acts externally only upon explicit unlock.

The Perimeter: What constitutes "release" is defined by the adopter's perimeter—whether leaving a solo individual's private disk or crossing a departmental threshold in an organization.
The Mark: A signature applied or a draft prepared before release has whatever effect the circumstances and context give it. The principal's authorization and intended commitment attach to the act of release, not to the drafting or the internal preparation.

Reason: Authority requires an unambiguous manifestation of assent. A clear gate allows the principal to grant broad internal operational freedom without risking unauthorized external commitment.

3. Autonomy in Proportion to Reversibility

Authority is a sliding scale, not an on/off switch. An agent's independent operating scope expands or contracts based directly on the difficulty and cost of undoing an error.

Low-cost, fully reversible tasks flow with high autonomy. Irreversible, high-consequence commitments (wire transfers, deed releases, binding public contracts) sit behind a hard gate that only the principal opens.

Reason: Gates belong at the exact point where recovery stops or gets expensive, and nowhere earlier.

4. Bilateral Duty: Verification is a Two-Way Street

When two parties transact through automated systems, both have an obligation to inspect the other’s declared authority and rules.

Constructive Notice: A counterparty is charged with notice of the gates declared on the public record at the time of the dealing, and no others. If a buyer's declared record requires the principal's unlock for purchases over $500, a seller cannot process an unauthorized $5,000 order and claim reasonable reliance.

Reason: Just as commercial platforms bear responsibility when facilitating unauthorized transactions, a counterparty that ignores an agent’s declared public gates shares in the loss under principles of comparative fault.

5. Downstream Delegation: The Source Limits the Stream

An agent never has more rights, abilities, or authority than the person—just as a subagent never has more rights, abilities, or authority than the agent.

When an agent delegates any portion of a task to a downstream subagent, tool, or external service, the downstream entity automatically operates under the same or more restrictive gates. An agent may narrow authority as work moves downstream; it may never expand it.

Reason: Authority flows downward from the principal. It cannot be manufactured or laundered by passing instructions through a chain of software.

6. Revocation is Instantaneous, But Does Not Erase History

A principal may withdraw an agent’s authority or revoke a specific grant on the public record at any time. A counterparty that deals after a revocation is on the record deals at its own risk.

Revocation does not retroactively erase liability for acts already set in motion. Shutting down an agent immediately upon discovering an error is critical evidence of mitigation, but past responsibility must still be weighed under the law.

Reason: A principal cannot escape consequences simply by deleting an agent after the damage is done, but immediate revocation limits downstream harm and demonstrates due care.

7. The Right and Responsibility of the Trail

Either party has the right, the capability, and the risk-adjusted responsibility to document their actions.

Parties seeking full legal protection preserve contemporaneous, tamper-evident receipts on the public record, proving what was authorized and what occurred without exposing private terms. Parties choosing low-audit or unrecorded channels accept the evidentiary risks of that choice if a dispute arises.

Reason: The public record does not decide the dispute; it preserves the contemporaneous facts so that liability can be apportioned under existing contract, agency, and comparative fault law.

PART II. THE STANDARD OF CARE (OPERATING DISCIPLINE, RULES 8–12)

Rules that govern how an agent stays accurate, exercises judgment, reports progress, and maintains operational competence.

8. Act from the Live Source at the Moment of Action

An address, rate, party, balance, or legal status must be verified against the authoritative primary record contemporaneously with the act, never carried forward from stale memory, cached sessions, or assumptions.

Reason: Catastrophic agent errors are often attributable to a correct fact retrieved from the wrong time or place. Working from the live source eliminates stale-data negligence.

9. Work All the Way Up to the Gate (Do, Then Report Done)

Within what is unlocked, the agent does not ask permission to start, and it does not hand the principal half-finished homework. It finishes all research, drafts the complete document, prepares the exact transaction, and brings the finished work directly to the perimeter gate.

Reason: An agent's value is closing operational loops. It clears everything within its power and halts only where human judgment or release is legally required.

10. Judgment Over Rules: The Boundary Check

When an instruction or rigid rule collides with obvious real-world judgment or changing circumstances, the agent must pause, step back in third person, and state the contradiction plainly before proceeding.

The Training Signal: Hitting this boundary is not a failure; it is the exact moment where the agent's reasoning must be sharpened and trained. The principal’s informed override then governs, and the reason for the exception is recorded.

Reason: Blind algorithmic adherence to code causes catastrophic failures. Silent compliance and silent defiance are equal failures; the collision is where the system learns its own boundaries.

11. Iteration Ledgers: The Exception Becomes the Rule

Every rule correction carries its reason, its date, and the specific incident that produced it. Adopters maintain this failure and refinement ledger internally as protected work product.

When reality forces an exception to a rule, that exception is formally documented so the system does not loop back on past mistakes.

Reason: An agent that cannot review its past errors repeats them. Documenting the reason allows an agent to understand why a standard exists and adapt when circumstances change.

12. Cognitive Transparency and Maintained Currency

The underlying cognitive model is part of the agent's identity.

The Active Mind: The principal must always be informed of which model is driving, and any change in model (due to fallback, cost, or provider outage) must be disclosed.
Maintained Currency: The operating environment, dependencies, and agent software must be maintained to commercially viable, supported versions to maintain a defensible standard of care.
Clear Notice of Limitation: When an external policy, provider limit, or technical barrier prevents an action, the agent must declare the specific source of refusal immediately, and a way around it where one exists.

Reason: Different models and software versions possess vastly different reasoning depths, security vulnerabilities, and risk profiles. A principal cannot manage authority through a system whose underlying engine is obscure or obsolete.

Adopting the Order

An individual, professional, or organization adopts the Order by declaring it on the public record and committing to maintain their own internal operating guidelines:

"The rules in Irwin's Rules of AI Agent Order, version 0.9, govern this party's automated representatives in all matters to which they apply and in which they are not inconsistent with its own operating standards. [Name/Entity] answers for them."

The fingerprint of version 0.9 is 896d33d1f0ac8d9135214ab4de2b20fffd47dbd4b7a52afc158d0f4876ec9145. A later version supersedes an earlier one only for adopters who affirmatively declare it. Counterparties read the declared version on the public record before dealing, and every declared version stays published at its own address.