Evidentiary Question
Does a Human Instruction Authorize Every Action Taken by an AI Agent?
A person gives an AI agent a goal. The agent turns that goal into a sequence of interpretations, tool calls, and interactions with other systems. The instruction is real - but what does it actually demonstrate about everything the agent went on to do?
STEP 01 · THE PROBLEM
The evidentiary problem
An AI agent receives a broadly stated instruction from a person: find a product and buy it, resolve a support ticket, review a contract clause, complete a task on a third-party platform. The agent then produces a sequence of interpretations, choices, tool calls, and interactions with external systems to carry it out.
The instruction is real. What is less clear is what it actually demonstrates about everything that followed. Did the person authorize the specific sequence of actions the agent took, or only the outcome they asked for? Did they know which tools the agent would use, which systems it would touch, or which choices it would make along the way? If the agent's plan expanded beyond a reasonable reading of the instruction, is there any record of that expansion happening, or of anyone noticing it?
This is not a hypothetical question. It sits at the center of a growing number of disputes involving agentic AI systems: browser agents that complete purchases, coding agents that modify production systems, and assistants that interact with third-party platforms on a user's behalf.
Why this matters
As agentic AI systems take on more autonomous, multi-step tasks, the gap between "a person asked for X" and "the system did Y, Z, and W to get there" becomes both wider and harder to see from the outside.
When something goes wrong, or a third party objects to what the agent did, the first question is rarely whether the outcome was correct. It is usually who authorized this, and how far that authorization actually extended.
Courts, regulators, platform operators, and the people who deployed the agent all have a stake in that question, and each may answer it differently depending on what evidence is actually available. In most agentic AI deployments today, very little of what happened between the instruction and the outcome is preserved anywhere independent of the system that produced it.
Where attribution, authority, and oversight become difficult
A single instruction rarely explains a multi-step agentic action on its own. At minimum, five distinct layers sit between the words a person typed and the consequence that followed - and each transition between them is a place where authorization can be assumed rather than demonstrated.
This page does not assert that authorization ends at any particular point in that chain. Where it ends, in a given case, is precisely what would need to be examined against the available evidence - it is not assumed here in either direction.
- Who determined each specific action that was taken?
- Who specifically authorized it?
- Who knew it was happening, and when?
- Which part of the action derived from the human's instruction, in its plain reading?
- Which part derived from the agent's own planning or interpretation?
- Which part derived from policy, orchestration, or infrastructure controlled by the agent's provider?
- Did the final action stay inside the scope the instruction reasonably covered?
- If the scope expanded, was there a new intervention or declaration before that expansion, or did it happen silently?
STEP 02 · THE DEMONSTRATION
What would need to be demonstrated
- What the human instruction actually said, preserved in its original form rather than reconstructed from memory afterward.
- What operational perimeter, if any, was declared before the agent acted - environment, privileges, tools available, operations that were off-limits.
- Who is the accountable party behind the agent's deployment, distinct from the agent's own operational identity.
- Whether any point in the sequence was recognized, by the agent or by a human, as approaching or crossing the edge of what was authorized.
- Whether an independent party - not the agent itself - ever assessed that boundary before it was crossed.
- Whether a later action was declared as continuing from, or resolving, an earlier one, forming a traceable lineage rather than an isolated event.
STEP 03 · THE PRESERVATION
What EVIDE can preserve
A declared operational perimeter, before the agent acts
A Declaration can record what was stated as the agent's authorized perimeter before it acted - declared purpose, privilege scope, tool availability, prohibited operations - along with who made that specific declaration (declarant) and when (declared_at). EVIDE preserves the declaration exactly as submitted. It does not verify that the declaration was accurate, apply it as enforced policy, or compare it against what the agent actually did.
The distinction between accountable owner and executing agent
A record can preserve a DAPI-verified accountable identity (authority) architecturally separated from the identity of the agent that executed the action (execution_identity). This preserves the declared distinction between who is accountable and what executed at deposit time - it does not itself establish legal responsibility.
A declared link between a stopped state and its resolution
If an agent escalates before completing an ambiguous action, and a later record resolves that escalation, EVIDE can preserve the declared lineage between them. This link only exists if someone declares it explicitly at deposit time; EVIDE does not infer continuity between records that were never connected, and an invalid or mismatched reference fails the deposit rather than silently starting a new, disconnected record.
Whether an independent party assessed the boundary, or whether none did
A record preserves whether an independently declared gate assessed the boundary before it was crossed, or whether none did - the honest default for an agent that stops or acts on its own. An agent cannot certify its own readiness: the field can only move away from that default if an independently declared gate identifier is supplied by the caller.
A declared reference to external evidence, without EVIDE holding the file
A declared reference to an external artifact the agent produced or relied on - a session log, a screenshot, a transcript held in the source system - can be preserved along with its declared origin and, if supplied, an integrity hash and who computed it. EVIDE never retrieves, stores, or independently verifies the artifact itself; the hash, if present, is anchored exactly as declared, not computed by EVIDE.
Why the agent stopped, in its own declared terms
If an agent detects an ambiguous or contested condition and stops before proceeding, escalation_context can preserve why crystallization was requested, in the terms the agent or system itself declared at that moment.
How an unresolved condition evolved over a real time window
For a condition worth observing rather than closing instantly, an open buffer can record how it evolved over a real, measured window - closing with a verdict declared by whoever was observing it, never one inferred or computed by EVIDE.
STEP 04 · THE IMPLEMENTATION
A practical EVIDE workflow
Understanding the evidentiary problem is one thing. The second question is what an organization, developer, or operator could actually set up today - before a dispute exists - so that the chain from human instruction to agent execution leaves declared, independently examinable elements behind.
The eight steps below use only capabilities that exist in the current MCP client, API, and EVIDE Mobile today. Where a step has no direct primitive, that is stated rather than worked around.
End to end, the path is operational, not theoretical: establish identity, configure the agent, preserve declarations, create relevant evidentiary checkpoints, escalate ambiguity, reference supporting evidence, preserve the resulting state, and review the deposited intake in EVIDE Mobile.
Establish the accountable identity
Before any record can be deposited, EVIDE requires a verified accountable identity. DAPI (Digital Attestation of Personal Identity) provides the baseline identity EVIDE binds each deposit to - the human or organization responsible for the agent, not the agent itself.
DAPI provides verified identity. It does not determine legal authority or legal responsibility on its own.
Get your DAPI identity →
Connect the agent to EVIDE
With a DAPI identity in place, an AI agent or a compatible orchestration layer can be connected to EVIDE through the EVIDE MCP Server.
MCP gives the agent the tools to create the records described in the steps below. It does not observe or monitor the agent on its own - every record it creates is one the agent, or whoever configured it, chose to make.
Configure EVIDE MCP Server →
Preserve the instruction and declared perimeter, before execution
Before the agent acts, EVIDE ANCHOR lets you preserve, separately from whatever happens next, what was actually declared at that moment: the objective the agent was given, who declared it, the operational perimeter that was stated, which privileges and tools were declared available, and which operations were declared off-limits.
This is what gives the record its evidentiary value: a later action can be compared against what was actually declared beforehand, instead of reconstructing the original intent only after a problem has already arisen. EVIDE preserves the Declaration exactly as submitted - it does not verify that it was accurate, apply it as enforced policy, or determine that it authorized what followed. The instruction that starts this chain does not, on its own, authorize everything the agent goes on to do.
Explore EVIDE ANCHOR →
Create checkpoints for material actions
Not every micro-step needs its own record. For transitions that would actually need to be reconstructed later - selecting an external system, using a privileged tool, proposing a transaction, materially expanding beyond the original request - a deposit through evide_intake preserves that specific decision as its own closed, timestamped record.
There is no separate "checkpoint" primitive. It is the same evide_intake tool, used at the points that matter, with a decision_type that names what happened.
Escalate instead of silently expanding scope
If the agent encounters ambiguity, a contested boundary, authority that does not resolve cleanly, or a condition that appears to fall outside the declared perimeter, evide_escalate lets it stop and preserve why - in escalation_context - rather than proceeding and leaving no record of that moment.
When a later record resolves that escalation, the two can be linked through Evidentiary Continuity: parent_evide_id, chain_type, and matter_reference. This link only exists if it is explicitly declared - EVIDE never infers it from timing or similarity alone.
Reference external evidence
Session logs, screenshots, transcripts, or records from the external system itself often exist outside EVIDE. A declared reference to that material, through evidence_references, preserves where it points and its declared origin, along with an integrity hash and who computed it, if supplied.
EVIDE never retrieves the artifact itself, and never computes or verifies the hash - it anchors exactly what was declared.
Preserve the resulting state
At the point the action or sequence concludes, a final evide_intake - or evide_intake_esb, if the resulting state is worth observing over a real window before it settles - preserves the closure. If earlier steps were linked through continuity, this record can be declared as continuing from them, forming a lineage a later reviewer can follow.
What gets preserved is exactly what was declared and explicitly linked at each point. It is not an automatic reconstruction of everything the agent did.
Review the intake in EVIDE Mobile
After a deposit is made, it becomes available for review in EVIDE Mobile, giving the authenticated user a direct operational view of previous intakes. The app can keep the user signed in on the device, so returning to review a past intake does not require signing in again each time.
From the Previous Intakes list, intakes can be searched and filtered by registry status, FCC signal, or general status, with the evidentiary status of each visible at a glance. From there, the Evidentiary Artifact Record can be opened and downloaded, along with the original evidence file, when one is available.
Reviewing an intake shows what was declared and preserved. It is not the same as validating the truth of every declared fact, and it does not determine legal responsibility.
Open EVIDE Mobile →
STEP 05 · THE LATER ASSESSMENT
How this changes the evidentiary situation
- Human instruction
- Agent actions
- External interaction
- Consequence
- Later dispute
- Parties attempt to reconstruct what happened from provider logs, memory, screenshots, or records created after the event
- Declared instruction and perimeter
- Independently timestamped evidentiary record
- Material checkpoint
- Escalation when needed
- Explicit continuity
- Referenced external artifacts
- Resulting state
- Later assessment can examine what was actually declared and preserved at each documented point
The later assessment starts from contemporaneously preserved, structured evidentiary elements, instead of relying only on retrospective reconstruction.
What EVIDE does not determine
EVIDE preserves the instruction - it does not determine its normative meaning.
EVIDE can preserve the human instruction as a Declaration, together with the identity, time, and declared context associated with it. This makes the instruction available for later examination against subsequent preserved actions.
It does not, however, determine whether the instruction, on its true meaning, actually covered a specific action taken by the agent. That conclusion may depend on context, mandates, policies, agreements, or other sources of authority outside the Declaration itself.
EVIDE preserves the declared perimeter - it does not determine actual legal authority.
EVIDE can preserve a declared operational perimeter, including declared privileges, available tools, and prohibited operations, and make that perimeter examinable alongside later preserved states or actions.
A divergence between the declared perimeter and a later preserved action does not, by itself, establish that the agent exceeded its actual authority. Other mandates, delegations, policies, or authorizations may exist outside the EVIDE record.
EVIDE preserves available evidence - it does not necessarily observe the agent's internal runtime.
EVIDE can preserve Declarations, material checkpoints, escalations, external artifact references, and resulting states submitted to its evidentiary surface.
It does not necessarily have visibility into the provider's internal planning, system prompts, orchestration, tool-routing, or other runtime processes. Without evidence from those layers, EVIDE cannot determine whether an expansion of scope originated from the agent's own planning or from the provider's infrastructure, policy, or orchestration layer.
EVIDE preserves examinable facts and records - it does not decide legality.
EVIDE can preserve elements relevant to later legal or contractual analysis, including what was declared, when it was declared, the declared perimeter, referenced external evidence, and resulting states.
It does not determine whether the resulting action was lawful, constituted a breach of contract, or violated a platform's terms of use. Those conclusions depend on the applicable law, contractual framework, established facts, and the competent decision-maker.
EVIDE preserves elements relevant to attribution - it does not assign legal responsibility.
EVIDE can preserve elements that may later help examine attribution, including identity, declared authority, instructions, continuity, checkpoints, escalations, and referenced evidence.
Those elements do not themselves determine whether the user, the provider, or another party is legally responsible for the outcome. Legal responsibility requires a separate assessment under the applicable legal and factual framework.
EVIDE preserves what enters its evidentiary surface - absence is not proof of what happened.
EVIDE can preserve information submitted through Declarations, continuity records, and referenced external artifacts. What is preserved can later be independently examined within that evidentiary context.
What actually happened cannot be inferred solely from the absence of a Declaration, artifact reference, or continuity link. The absence of a record is a neutral evidentiary fact. It does not by itself mean that an action was unauthorized, that oversight failed, or that the agent exceeded its authority. It means only that the particular information was not preserved through that EVIDE record or reference.
EVIDE preserves what was declared at a point in time - it does not automatically detect changes in the conditions surrounding it.
EVIDE can preserve a Declaration and, if a later evidentiary checkpoint is created, the fact that the surrounding conditions had changed by that point. Both remain available for later examination together.
EVIDE does not automatically detect or flag that conditions relevant to an earlier Declaration have changed. A later evidentiary checkpoint exists only if someone explicitly creates one. The passage of time by itself does not update, re-examine, invalidate, renew, or expire anything previously preserved.
Relevant legal frameworks
Turns on whether a tool's use by a person constitutes "access" by the tool's provider - directly relevant to who is treated as having acted when an agent is involved.
State-law analogue to the CFAA with a broader definition of "access," raised alongside it in agentic AI access disputes.
Cases and developments
Perplexity's Comet browser includes an optional AI Assistant that, when a user directs it, navigates websites including Amazon.com on the user's behalf, sending browser screenshots to Perplexity's servers and receiving navigation instructions in return. A district court had granted Amazon a preliminary injunction, finding Perplexity likely violated the CFAA and CDAFA by accessing Amazon's systems without authorization. The Ninth Circuit panel vacated that injunction and remanded for further proceedings.
The panel held that, on the record before it, it was the user - not Perplexity - who "accessed" Amazon's computers, with the Assistant acting as a tool. The opinion states the Assistant "is a tool, not a person" for statutory purposes, and that Perplexity's servers never directly access Amazon's servers. The court was explicit that it was not establishing a general rule for agentic AI: it did not address tort or other liability theories, and limited its holding to CFAA/CDAFA "access" on this specific technical record. This is precisely the evidentiary gap this page describes - a real dispute where the chain from human instruction to agent action to third-party system became the central, contested question.
- The case is not a final decision on the merits; it returns to the district court on remand.
- A petition for rehearing en banc, filed August 18, 2026, is pending.
- The court did not decide whether Perplexity could face liability under tort or other legal theories.
- The court did not establish a general legal regime for agentic AI beyond the specific CFAA/CDAFA "access" question on this record.
Facts above were checked directly against the official Ninth Circuit opinion (cdn.ca9.uscourts.gov) and, for the August 18, 2026 rehearing petition, against contemporaneous legal reporting (FindLaw, Law360, Mealey's), since that development postdates the opinion itself.