Third in a series: Glass–Steagall for AI makes the argument; The Rule states it in one sentence. This piece defines the rule's terms and maps the effects of the rule on a small sample of widely used systems.
A legal person, together with all entities under common control, that retains personally identifiable data from interactions with more than N legal persons on a daily basis averaged over any X-day period cannot operate or offer AI-driven agentic services that non-deterministically effect change in the data or accounts of other legal persons.
Definitions
Legal person. Any natural person or entity with legal personality – an individual, a company, a nonprofit, a government body. The rule counts interacting parties.
Common control. The standard corporate-law meaning: entities where one has the power to direct the management or policies of another, whether through ownership, contract, or otherwise. Subsidiaries, affiliates, and controlled joint ventures count as one legal person for the rule.
Personally identifiable data. Data linked or reasonably linkable to a person, account, device, or persistent identifier. Pseudonymous identifiers, device IDs, and account tokens are included. The test is linkability, not whether a name is attached.
On a daily basis, averaged over any X-day period. The count is a rolling average, not a peak. An organization is covered if its average daily count of distinct legal persons from whom it retains identifiable data exceeds N over any window of X days.
AI model, AI agent. An AI model is the "machinery" that selects – it produces a classification, a draft, or a proposed operation, and by itself changes nothing. An AI agent is an AI model bound to capabilities: permissions to perform state-changing operations on specific data or accounts. Supplying a model is not operating an agent.
Operate or offer. The operator of an AI agent is whoever decides what it is allowed to do – which state-changing operations it may perform and on what data or accounts – regardless of where it runs or who built it. Suppliers of AI models are not operators. A custodian that decides what an AI agent may do on data or accounts it holds for other legal persons is that AI agent's operator, no matter which company supplied the model. To offer is to make such a service available to other legal persons under one's own name or terms.
AI-driven agentic service. A service in which a machine-learning model selects operations to perform, rather than executing operations fixed in advance by system logic. It makes no difference whether the model's output can be made repeatable. The test is whether the model chose the action, not whether it would choose the same one again.
Non-deterministically effect change. To execute a state-changing operation – send, post, purchase, transfer, sign, delete, modify, provision, revoke – where the specific change was selected by the model rather than by a fixed rule or by a human. A change is selected by a human only if that specific change – the operation and its concrete parameters – was presented to a human for review before execution and a human affirmed its execution. Presenting a count or a summary is not presenting the change. Otherwise the change is model-selected. A model that classifies and hands off to a fixed rule does not non-deterministically effect change. An agent that decides what to do next does. A fixed rule is one whose operations and parameters were specified in advance by a human for each possible model output. A rule that executes whatever operation or parameters the model specifies is not a fixed rule; the change is model-selected.
Data or accounts of other legal persons. Any data, record, account, or system belonging to, held for, or controlled by a legal person other than the one operating the service. A custodian's own customers are other legal persons.
Cases
Meaning of column headers in the table that follows:
-
Configuration – an organization that meets the (N, X) criteria stated in the rule and operates an AI agent – its own or supplied by a third party – on user or tenant data.
-
Allowed – type of actions by the AI agent operated by the Custodian like read-only, recommendations, summaries, answers to questions, deterministic rule-based triggers, etc. that do not effect state changes on tenant data, or effect them only through fixed rules.
-
Barred – type of actions by the AI agent operated by the Custodian that effect model-selected changes on tenant data.
(The table has 3 columns)
| Configuration | Allowed | Barred |
|---|---|---|
| Gmail + Gemini | Gemini summarizes a thread, drafts a reply, suggests a label | Gemini sends the reply, archives the thread, schedules the meeting |
| Gmail + ChatGPT (Google decides what ChatGPT may do in Gmail) | ChatGPT summarizes, drafts, suggests | ChatGPT sends, archives, schedules (Google attached ChatGPT to the mailbox) |
| Microsoft 365 + Copilot | Copilot summarizes meetings, drafts documents, answers questions over files | Copilot sends mail, edits shared files, creates calendar events |
| Amazon "Buy for Me" Alexa shopping | Agent recommends products, compares prices, builds a cart | Agent completes the purchase, manages subscriptions, initiates returns |
| Facebook/Instagram + Meta AI | Meta AI answers a question the user asks it directly | Meta AI posts into a group conversation, sends/posts on user's behalf |
| Bank system + Bank's AI | Bank's fraud AI model flags a transaction; triggers a fixed rule placing a hold | Bank's own AI agent decides to move funds, close accounts, adjust limits |
| Government benefits system + Government's AI | Rules engine plus classifier updates a beneficiary file | Agency's own AI agent adjusts benefits, sends notices, opens cases |
| Nonprofit Hospital Network + internal AI agent | Triage AI model flags a chart; a clinician acts | Hospital's own agent writes orders, schedules procedures, messages patients |
Swapping an internally built AI model for an externally supplied one does not achieve compliance. Who operates the agent is what matters. ChatGPT or Claude acting on a Gmail account from outside – across a boundary Google does not own, on terms open to any agent – is the intended design.
The table shows configurations that exist today. The rule also defines potential configurations: an independent agent provider (OpenAI, Anthropic, etc.) that retains memory, files, and context from more than N legal persons daily would become such a configuration facing the choice defined by the rule.
Grey zone
There are types of actions where state changes on tenant data are co-produced by the AI agent operated by the Custodian and a tenant or multiple tenants in complex ways that will need to be specified, discussed, and decided.
A reply Grok posts on X when a user @-mentions it: the human requested a reply, but a one-word invocation is not a selection of what Grok would write.
When an AI agent lines up fifty changes and the human clicks "approve all," the human has not looked at any one of them – not this message to this recipient, not this payment of this amount. The model is the only party that ever saw each specific change before it happened; the approval click is a formality. Compare that to sending an email the agent drafted: the human read that exact message and chose to send it.
When Apple's agent runs on your phone rather than on Apple's servers, the agent on your phone is still Apple's – Apple builds the model, updates it, and decides what the agent may do. Where the computation happens doesn't change who's operating the agent.
In all those cases the rule asks one question: who selected the specific change, as it would actually land? If a human saw each specific change and affirmed it, the human did. If not, the model did – and the rule applies.
Those "grey zone" cases will be and should be contested.
---------
Co-written with Claude (Anthropic), prompted by feedback from Grok (X Corp.), and with a bit of feedback from ChatGPT (OpenAI).