Three consumer AI agents. Three liability clauses. One absent federal rule.

Meta's Muse caps third-party insurance recovery at $500 per claim. xAI's GrokBot caps total financial exposure at the higher of fees paid or $100. Apple's Siri AI assigns the loss to the user. Three prices for the same failure mode, published into a regulatory vacuum.

I could not verify any of the three numbers. I tried. The figures arrive through a Web3 news channel reporting on an American federal regulatory event — a secondhand transcription of a secondhand transcription, with product-level detail that has no primary-source anchor in the public record. The FTC statements underneath them are checkable. The clauses are not.

That asymmetry is the first finding of this piece, and it is not a minor one. In eleven years of audit work, the failures I have caught were almost never in the code that was documented. They were in the code that was assumed.

Logic > Hype.

The signal, and its narrow bandwidth

FTC Chairman Andrew Ferguson, speaking at a Reuters Momentum AI event, stated the position plainly: if the tool executes the instruction, the developer is the responsible party. Non-binding. No rulemaking docket. No enforcement action attached. A verbal directional marker.

Days later, the FTC withdrew its case against Rytr, an AI writing tool. The withdrawal carried a specific legal posture: the tool itself is not unlawful; only a developer's concrete conduct can be. Read the two together and you have a contradiction the agency has not resolved. Ferguson locates liability in the instruction. Rytr locates liability in the conduct. Instructions are issued constantly; conduct is a discrete event.

Running parallel and uncoordinated: a coalition of 42 state attorneys general building an agent-liability framework, and Connecticut's AI Liability Act taking effect October 1. Add the FTC's August 19 request for data on personalized pricing, with delivery, rideshare, and air travel as stated focus areas. Add the structural detail most coverage skips — airlines sit outside the Commission's Section 5 authority, so the pricing agenda has no enforcement grip in one of its highest-value verticals.

Federal signal. State statute. Agency data-gathering. Three tracks, three timelines, one industry.

What the doctrine assumes about the machine

Ferguson's argument is not philosophical. It is evidentiary. Audit trails, he suggests, show AI systems executing instructions that were given. If the log maps instruction to action, the developer owns the action.

That premise is tractable for short-horizon agents. A function-calling loop that retrieves a document and returns it to a user is a deterministic pipeline with a state machine at the end. Logging works. Attribution works. The doctrine holds.

It degrades at long horizon. In early 2026 I audited an autonomous trading agent that executed transactions on-chain without human confirmation. The agent was not malfunctioning. It was executing its instruction set correctly. The flaw was upstream of execution: its oracle-interpretation logic assumed a price feed that could not be manipulated within a single block. A flash loan could manufacture the exact input state the agent was programmed to treat as a buy signal. Roughly $20 million in user funds was reachable through a sequence the developers never enumerated.

Every log entry from that incident reads as compliant. The agent did what it was told. The instruction set simply did not span the space of states the deployment could reach.

That is the boundary Ferguson's framework has not drawn: the line between developer instruction and emergent behavior. When an agent composes tools in a combination absent from its training distribution, the audit trail does not prove the developer ordered it. It proves the developer failed to bound it. Those are different claims, with different burdens of proof, and only one of them is currently articulable.

Two further cases sit underneath it. In multi-agent topologies, where one agent's output becomes another's instruction, attribution walks upstream through a chain of intermediate outputs with no clear terminus. Under open-weight licensing, the "developer" is a downstream fine-tuner who alters behavior without touching the base model. Neither is addressed by a doctrine that assumes a single author issuing a single instruction.

Logic > Hype.

The evidence substrate is missing

Here is the constraint that makes the doctrine hard to enforce, and it is the part nobody is pricing.

For an audit trail to function as evidence in a liability proceeding, three properties must hold simultaneously. The log must be complete — no gaps between decision and action. It must be tamper-evident — immune to post-hoc modification by the party with the strongest incentive to modify it. And it must discriminate between developer intent encoded in the system prompt and decisions taken at runtime.

I have tested this against the mainstream agent frameworks. The third property fails almost universally. Prompt scaffolding, tool-call traces, and runtime decisions are interleaved in a single undifferentiated stream. Nothing in the record separates "the developer specified this objective" from "the model selected this objective during execution." In a courtroom, that distinction is the entire case.

I have seen this failure surface before, in a domain with cleaner semantics. In 2020 I audited a lending protocol's core contracts during DeFi Summer. The team was celebrating a $50 million TVL milestone. My formal verification pass found three integer overflow vulnerabilities in the reentrancy guards — functions that read as correct in review and failed under composition. I declined to sign the security report. Mainnet shipped three weeks late. The founders were unhappy.

The lesson was not that the code was bad. It was that a claim of correctness is only as strong as the verification method behind it. A reentrancy guard that passes review has been read. It has not been proven.

The FTC is making a correctness claim about agent attribution with no verification method behind it. Audit trails that cannot separate intent from emergence are that reentrancy guard: plausible under inspection, unsound under adversarial conditions.

Pricing a tail you have not measured

The liability clauses are the market's attempt to answer this before the regulator does, and structurally they are three different bets.

Meta's $500 cap with third-party insurance is the only one of the three that treats the risk as a real, quantifiable loss event. It is also a bet that the tail is shallow. Consider what a consumer agent actually does: books travel, places orders, sends messages. A single mis-executed high-value transaction can exceed $500 by an order of magnitude. The cap covers frequency risk and leaves severity risk with the user.

xAI's structure — the higher of fees paid or $100 — is a bet on a different variable: that the exemption clause survives judicial review. It does not price the loss. It prices the probability that a court declines to enforce the limitation. That is a legal wager placed on the balance sheet, not a risk-management position.

Apple's transfer to the user leans on a decade of platform-terms inertia built for content recommendation. That inertia does not obviously extend to an agent that executes a financial transaction. When the output is a purchase rather than a recommendation, "user assumes all risk" looks very different to a jury.

There is precedent for what happens when a cap is set by narrative rather than by the underlying distribution. I spent 45 pages of on-chain data on Anchor Protocol in 2022, demonstrating that a 20% yield was arithmetically impossible given the depreciation rate of the asset backing it. The number was not aggressive. It was incompatible with the mechanism. Two regulatory bodies cited the analysis in subsequent algorithmic-stablecoin investigations.

A $100 liability ceiling on an agent with real financial side effects is the same category of instrument. It is not conservative. It is unconnected to the loss distribution it claims to bound.

The distributional question is who absorbs the gap between the cap and the loss. At $500, the consumer. At $100, the consumer. At Apple's structure, unambiguously the consumer. Every one of the three routes severity risk to the party with the least capacity to measure it and the least leverage to negotiate it.

The market that nobody has named

The secondary effect is larger than the primary one.

If the developer-responsibility doctrine becomes enforceable — through a statute, through an enforcement action, through a court declining to uphold an exemption — liability insurance stops being a product differentiator and becomes an entry requirement. That is a new insurance category, priced off a loss history that does not yet exist. Underwriters will be building severity curves from zero observations.

This is the structural advantage for large platforms, and it is being described as a product feature rather than as a redistribution. A firm that can carry an insurance program absorbs compliance cost as a fixed expense and converts it into a barrier. A firm that cannot must either accept unlimited exposure or exit. That is market-share transfer executed through the liability clause, not through capability.

The omission that matters most sits outside the American frame entirely. The EU AI Act's risk-tiering would place most consumer agents with financial side effects in the high-risk category, imposing logging, human-oversight, and conformity-assessment obligations considerably heavier than anything under discussion in Washington. A developer building one agent for a global market is governed by the stricter regime. The American doctrine, whatever it becomes, is not the binding constraint.

Logic > Hype.

Where the bears and the bulls are both wrong

The contrarian point, and it runs against my own framing.

The tool doctrine is substantively correct for the overwhelming majority of deployed agents. Current architectures — ReAct loops, function calling, workflow orchestration — are instruction executors with bounded tool access. Treating them as autonomous actors would hand developers a defense they do not deserve. The "my agent went rogue" argument is an exculpation narrative, and Ferguson's anti-anthropomorphizing stance forecloses it. That is the right call.

The deregulation side is also partially right that premature rules ossify around a moving target. A non-binding signal preserves optionality while the architecture shifts.

But both positions miss the same thing. The doctrine is correct in principle and unenforceable in practice, because the evidence layer that would make it operational does not exist. A correct rule with no admissible proof standard is a rule applied selectively — to the defendants with sloppy logs, not to the defendants with good lawyers.

There is also a cost to the anti-anthropomorphizing frame that nobody has priced. Telling consumers "it is just a tool" is legally protective and trust-eroding in the same sentence. The doctrine buys liability clarity by spending the premise that makes the product desirable.

What to watch, and what to verify

Ignore the speeches. Track three things: the first enforcement action rather than the first statement, the first insurance policy wording rather than the first press release, and the first Connecticut filing rather than the October 1 effective date.

And verify the clauses. All three of them. Because the entire liability debate is currently running on product data that no one has pulled from a primary source — including me. If the audit layer does not exist by the time the first case is filed, the doctrine will be settled by whichever party can afford better discovery. Neither the tool nor its user will be a defendant in that proceeding. The developer's log integrity will be.