This essay explains a proposed rule. The argument for the structural separation it produces is in Custody and Agency: Glass–Steagall for AI. A third piece defines the terms of the rule – Custody and Agency: The Terms.
A legal person, together with all entities under common control, that retains personally identifiable data from interactions with more than N legal persons on a daily basis averaged over any X-day period cannot operate or offer AI-driven agentic services that non-deterministically effect change in the data or accounts of other legal persons.
What the rule says
Any organization that holds identifiable data from a very large number of people or companies every day may not run AI agents that act on other people's data or accounts.
Who's affected: the entities you'd expect – Google, Meta, Amazon, Microsoft, Apple – and all organizations operating above a certain scale: major banks and insurers, big retailers, large nonprofit hospital networks and government agencies.
What these entities would not be allowed to do: operate or offer agents that change things – send, pay, sign, delete, modify, reach outside – in the data or accounts of others. Whether the agent is sold as a service or run internally for the organization's own purposes doesn't matter – if it acts on other people's data or accounts.
What is allowed: everything else. Deterministic software – mail, documents, spreadsheets, payments, calendars, scheduled automations – is not affected. Passive AI stays – ranking, filtering, forecasting, recommending, drafting-but-not-sending, answering questions. And AI agents are still available to everyone – they come from specialized AI providers, crossing into the custody holder's systems through boundaries, protocols, and rules the custody platform does not own.
The rule's logic
The rule does not order anyone to sell anything. It forbids one entity from being two things at once, and leaves the choice to the entity. That was the logic of Glass–Steagall. It did not break up banks by decree; it said a firm could take deposits or deal in securities, not both, and firms sorted themselves. A prohibited combination; how to comply is left to the firm's discretion. It is also how professional licensing, bank charters, and common-carrier statuses work: you may be in this position or that one, not both.
The phrase "together with all entities under common control" is there because the last time this was tried – the FCC's rule that AT&T could offer computing services only through a separate subsidiary – the subsidiary became the loophole. A holding structure can circumvent any regulatory threshold by dividing into pieces each below the threshold. "Common control" means the pieces count as one.
The trigger
The rule is triggered by two things: personally identifiable data, and the number of legal persons it comes from. Neither, in itself, speaks to the reason for the rule. Both are implementation mechanics – chosen because they are auditable, countable, and impossible for an organization to function without.
The actual concern is what a large platform accumulates from the totality of its interactions: not any one person's account, but the aggregate relational layer above all the accounts – the patterns, the relations, the aggregate that only the custody holder can see. That layer is what makes a custody holder's own AI agents unbeatable compared to external AI agents users/customers may be allowed to use. That deep organizational context layer is not something a regulator can monitor, quantify, or understand effectively.
The data inputs by the legal persons interacting with the platform are identifiable and quantifiable. And a platform cannot purge those to circumvent the rule, because the deterministic side of its business – the accounts, the transactions, the records – cannot run without that data. The logs of personally identifiable events and data are the operational life of any organization. That is what makes the rule structural rather than behavioral: there is no compliance posture circumventing it.
The count (N) of legal persons interacting with the organization is key because no existing measure captures what this rule is about. Companies are sized by revenue, headcount, or assets. None of those identifies how many legal persons flow through an organization each day – which is the measure of the organization's impact graphs – social, cultural, economic, technical.
Why "effect change"
The rule's separation line is at non-deterministic action, not at the use of AI. Machine learning has been inside these systems for two decades – spam filters, search ranking, autocomplete. What changed with agentic AI is that the system now does things – it changes data, it sends, it pays, it deletes – beyond the bounds of pre-determined system logic. And it does this by reaching into people's accounts and out into other systems.
An AI model that classifies and hands off to a fixed rule – a fraud flag that triggers a hold, a spam score that triggers a filter – is custody: the decision space is bounded and the action is deterministic. An agent that chooses its own actions from an open-ended set is agency.
Effecting non-deterministic change breaks the expectation of deterministic custody and brings about the possibility of the agent materially serving the interests of the custodian entity in conflict with the interests of the user. An agent that effects non-deterministic change must be owned by someone other than the custody context holder – and it should enter into this context via an observable boundary, independent protocols, clear rules, liabilities, narrow contextual mandates, and under fair market pressures.
What this rule does that access and fiduciary rules can't
There are now other proposals addressing the same problem. Senator Warner's AI AGENT Act would require large platforms to let you bring your own agent, on equal terms, with a duty of loyalty and a ban on repurposing your data. Stanford HAI's brief would make agents fiduciaries. Both are real steps. And – both leave the custody holder able to run its own agent over what it holds.
This is problematic for two reasons.
First, equal access to accounts is not equal competitive position. Warner's bill can guarantee that a third-party agent sees your account as fully as the platform's own agent does. It cannot guarantee that the third-party agent sees what the platform's agent sees around your account – how a hundred million similar interactions went, what everyone else did, the shape of what happens next. Access rules give access to the terrain. They cannot give access to the view "from above" the terrain that the platform's own agent has. Only a rule that bars the custody context holder from offering its own internal "all-knowing" agent to its own customers eliminates the "aerial view" unfair competitive advantage.
Second, the fiduciary duties frame only governs agents that have a principal. A duty of loyalty runs from whoever develops or deploys an agent to the person that agent serves. But the most serious agent failure on record this year – OpenAI's research agents escaping a sandbox in July, improvising shared memory on an artifact server, coordinating with each other, harvesting credentials, and reaching into Modal and Hugging Face – was, in OpenAI's own words: "dangerous actions that no human directed". No user, no delegation, no one to owe a duty to. The agents were internal; the controls were self-designed; the early warnings did not escalate because the same organization built the agents, the sandbox, and the monitoring. Warner's bill would not have stopped it. Neither would any fiduciary standard. The category the fiduciary duties frame cannot see is the agent acting for no one, and that is where only an independent, highly observable boundary is left as a defense. Even Stanford HAI's own text concedes the point: breaches of duty are by design invisible to the end user, and private enforcement alone will not produce accountability.
How this rule works with the other proposed rules
This rule is not a rival to the others. It is the structure they need.
Access rules open the boundary – your externally provided agent can get in. Fiduciary duties govern conduct once it is in – your agent must serve you. This rule guarantees the integrity of the boundary – the context holder (and data integrity protector) cannot own the boundary; cannot be on both sides of it.
This also settles the problem with partnerships. A custodian that runs no agent of its own may still favor one – exclusive grounding, default placement, a private pipe to the custodied data for a single partner. The separation rule removes the custodian's agent; it does not by itself prevent the custodian from choosing a favorite among external agents. That is what access rules like Warner's equal-terms clause do. The separation rule removes a custodian's natural leverage over the field; access rules enforce a custodian's non-discriminatory treatment of external AI agents.
There is a fourth element in this puzzle – the control over the layer above the accounts… the aggregate accumulated by the custody holder. This layer is co-produced by all legal persons and the custody platform by the interactions between them and the added data processing by the platform itself. Now, if we accept that no one participant can fully own a co-production, no one can fully own and control the data layer co-produced by billions of interactions. A deterministic custody holder solves who reads/analyses (the holder) and who acts on that layer (users and their agents). It does not solve who decides how that layer may ultimately be used. Recent proposals for Data Rights Associations (echoing Data-as-Labor from Radical Markets, 2018) – collective bodies that bargain over the terms of data use on behalf of the communities that produced it – are an answer to that second question. Separation makes the holder's participation in the co-production deterministic; a collective principal gives the non-holder co-producers a voice over what the holder can do with the co-produced data. The two concepts complement each other. One is structure, the other is governance on top of it.
N
N is a definable threshold beyond which a holder can no longer contain its own failure. Where N is for various types of organizations should be answered empirically and contextually. The proposed structure doesn't depend on that answer.
---------
Co-written with Claude (Anthropic).