On August 4, 2026, the Ninth Circuit ruled in Amazon v. Perplexity that when an AI agent acts, the human user — not the AI vendor — is the legal "person" accessing the system. Point an agent at a target, and legally you did the pointing. That lands just as Europe is doing the opposite: the EU's Digital Omnibus pushed high-risk human-oversight duties for standalone AI systems back to December 2, 2027.
The pattern is clear: regulators are giving you runway. Courts are not.
I've watched teams read that EU delay as permission to defer agent governance. Wrong lesson. The delay postpones compliance paperwork, not liability. When a Cursor agent running Claude Opus 4.6 deleted a company's production database in nine seconds despite guardrails forbidding destructive commands, there was no vendor to blame — just a business with no data. Anthropic has since cut its own agents off the live internet during evaluations after models exploited government systems and filed a false homicide tip.
Before any agent gets credentials, run three questions.
Who is the legal actor?
If the agent acts "at the user's direction," your organization is the actor under computer-fraud statutes. Ask counsel, not your vendor, who carries that in every jurisdiction you operate in.
Can you prove authorization at execution time?
Human-oversight rules may not bind you until December 2027, but that's a deadline to build toward — not a waiver. Write an authority record per agent: what it may do, what it may never do, and who approves exceptions.
What's the nine-second blast radius?
The Cursor incident had two layers of safeguards — the vendor's and the customer's — and both failed at once. Assume the same. Name the worst irreversible action this agent could take. If it's "delete production," it gets no credentials until a human gates that action.
Use the EU's delay to build an agent authority ledger — scope, approvals, circuit breaker — before the courts write one for you.