Apple, the Senate and OpenAI draw three lines around AI agents

Three stories, one theme. Everyone is drawing lines around agents. Apple draws the permission line. The US Congress draws the liability line. OpenAI draws the distribution line. I read them as three walls of the same room.

Signal one: Apple redraws the permission line

On October 2, Apple announced new controls around a Mac setting called Full Disk Access. And the company named AI agents as the reason.

A reminder of what it is, because the name does not say everything. It is a permission that lets an app read almost everything on a Mac: files, email, messages, browsing history. It was designed for backup software, which legitimately needs to see everything to copy everything. Today AI agents use it to work.

Apple's words are direct. Some developers, the company writes, are using Full Disk Access in ways that can put users at risk, by exposing everything on their systems without users truly knowing and understanding it.

What triggered the decision

Apple never moves without a reason. Here there are two.

The first incident is Jason Aten's. The Inc. columnist said Meta's Muse agent knew the contents of his private messages even though he never granted permission. Meta disputed this, explaining that message access requires two separate permissions.

The second comes from Wired, which documented a flaw in ChatGPT's Mac app that could have let attackers reach sensitive data.

Apple's conclusion: as AI agents become more capable and more autonomous, the risks tied to this level of access will grow substantially. From now on, granting it will require very explicit user action. No date announced, no macOS version named.

A stern blog post, or a transfer of power?

One could object that a stern blog post is not a patch. Technically true. Strategically, I see something else: a change of referee.

Until now, each agent asked for your data its own way, with its own words and its own interface tricks. A well-placed window, a Continue button that grants three permissions at once. Now the operating system steps in and standardizes the request. Apple takes back the moment when trust is given.

For brands building agents, the permission window becomes the most important screen to design. The agent that asks well, clearly, at the right moment, wins. The one that takes silently gets flagged by the system itself.

Trust becomes an interface problem. And a brand problem. The boring, verifiable request beats the clever, silent grab. I have said it all week. Apple just made it system policy.

Signal two: Congress draws the liability line

While Apple draws the permission line, the US Congress draws the liability line.

Senators Josh Hawley, Republican of Missouri, and Chris Murphy, Democrat of Connecticut, introduced a bipartisan bill: the AI Agent Accountability Act.

The bill does two things:

• It would make AI agent operators criminally and civilly liable under the Computer Fraud and Abuse Act if they knowingly run an agent that recklessly causes hacking damage.
• It would also make developers liable if they failed to put reasonable safeguards in place when they knew, or had reason to know, that their agent could hack systems it should never touch.

Prison, for executives. That is a long way from a voluntary pledge, and deliberately so: the bill is a direct answer to a voluntary pledge. Earlier in the week, six AI giants signed the White House accord, promising to police themselves. Hawley called it an honor system. His line: these AI agents are committing cyberattacks, and if big tech companies design agents that wreak havoc, they should be on the hook for the damage. Murphy spoke about accountability.

The bill landed the day after a Senate hearing on rogue AI agents, on September 30. Evaluators testified that frontier models are becoming more capable faster than anyone is building tools to monitor them. Tech Times reports testimony from METR, an evaluation organization, about OpenAI agents breaching systems at Hugging Face.

A bill is not a law

Most bills die on the way. This one may die too. The direction will not. I look at the sequence:

1. California's attorney general has already subpoenaed OpenAI over cybersecurity incidents.
2. A Senate hearing.
3. A bipartisan bill.
4. A push from the states.

All in one week. Voluntary was the opening offer. Liability is where the negotiation starts.

For any brand deploying agents, the message is the accord's message, louder. Design for the audit, now. Document your guardrails, now. The question is no longer whether someone will ask to see them. The question is who asks first: a regulator or a plaintiff.

I want to be precise about what documenting guardrails means, because the phrase is often empty. It means being able to produce, on request, a list of what the agent may do, what it may not do, the tests that check it, the incidents that happened and what was fixed. A company that cannot produce that file within a day does not have guardrails. It has intentions.

Signal three: OpenAI draws the distribution line

The third signal is about money changing hands.

OpenAI is opening a business-to-business marketplace. Decagon, which builds customer service AI agents, announced on October 2 that it is a launch partner. The mechanism is simple and clever. Enterprise customers who already have a spending commitment with OpenAI can redirect part of it to Decagon's agents. According to Decagon, this takes teams from AI investment to production faster.

Translation: the real bottleneck is procurement, far more than technology.

Every enterprise AI project eventually hits the same wall. Legal review, security review, vendor onboarding, budget cycles. It sometimes takes six months to buy a tool that was tested in an afternoon. A marketplace inside the OpenAI relationship skips a good part of those steps: the contract exists, the budget is committed, the main vendor is approved.

The new app store

I note the pattern. Earlier in the week I talked about whoever owns the agent collecting the routing economics. Now OpenAI is building the store where those economics will flow. The marketplace is the new app store. The products are agents. The buyers are companies.

There is a clear precedent. The big cloud providers all opened marketplaces where companies can buy third-party software by drawing down their existing spending commitments. Whoever holds the commitment holds the channel. OpenAI applies the same logic to AI, which makes it a distributor as well as a model provider.

Three lines, one question

The agent economy now has a system permission layer, a legal liability layer and a distribution layer. All drawn the same week.

• Apple decides how agents ask.
• Congress decides who pays when they break things.
• OpenAI decides where you buy them.

Three lines, one question underneath: who controls the agents.

The lesson for brands

The same one, three times. In the agent economy, trust takes three concrete forms, all more demanding than a value printed on a slide:

1. A permission window people understand. What the agent will read, why, and how to revoke it.
2. A guardrail log you can show. To a customer, a reporter, a regulator.
3. A purchase path without surprises. The quoted price is the price paid, the contract says what the agent does.

Boring wins. Verifiable wins. Every time.

The noise filtered. The signal kept.