AI Agents Serve Many Masters: Their Loyalties Should Not Be Secret – OpEd

Key Takeaways:

• Washington wants few new AI rules; Europe is tightening “this is AI” labels. The author says neither settles loyalty: a system can admit it is a machine and still hide whose interest wins when the user’s wish collides with vendor, platform, employer or law.
• Divided duty is old (pilots, lawyers). AI stacks more principals: user, deployer, model maker, tools, payment rails, other agents, several countries’ law. OpenAI’s August 2026 Model Spec is praised for a public chain of command (provider > developer > user)—but a private spec can still act like a constitution users never negotiated.
• Proposal: a deployment-level “principal manifest”—who the agent represents, who may override and why, material incentives, what happens on collision (pause, refuse, escalate), and how to challenge it. Keep it outside model weights, versioned and auditable. Sector-specific tightness; the constant is that the ranking must not be invisible.

The United States wants narrow AI regulation and Europe wants transparency. Both can converge on one rule: before an AI agent acts for someone, it should disclose who can overrule them.

An AI agent can tell you that it is a machine and still conceal the most important fact about the transaction: whose interest will it protect when yours conflicts with someone else’s?

That question sits in the gap between the two AI-policy positions now facing each other across the Atlantic. This week, the United States urged G20 governments to avoid broad new AI rules and to reserve regulation for genuinely novel considerations. Europe, by contrast, has begun enforcing new transparency obligations for covered AI systems. The disagreement is real, but neither approach yet answers the loyalty question clearly enough.

Washington is right that policymakers should not treat every AI problem as unprecedented. This one is not. Law and professional regulation have spent centuries deciding what should happen when a person or institution serves several principals at once. Europe is also right that disclosure matters. But telling someone that an interface is artificial reveals its identity, not its allegiance. Artificial identity is not institutional loyalty.

The old warning that no one can serve two masters was never a workable rule for a complex economy. Lawyers, brokers, doctors, pilots and public officials routinely answer to overlapping duties. The solution was not to pretend the conflict disappeared. It was to rank duties publicly, require disclosure, obtain informed consent where possible, and create rules for withdrawal, review and appeal.

A pilot, for example, answers to an airline, passengers, air traffic control and a regulator. Yet federal aviation rules make the pilot in command the final authority for the operation of the aircraft and allow emergency deviation subject to later explanation. A lawyer facing concurrent client interests confronts professional standards such as ABA Model Rule 1.7, which requires conflict analysis and informed written consent. In both cases, the hierarchy is not improvised secretly at the moment of collision.

The Missing Principal Map

AI agents may serve more principals than any of those professionals. There is the person typing the request. There is the company that deployed and configured the agent. There is the developer that trained the underlying model and set rules the agent encounters before reading the user’s words. There are tool providers, payment networks and marketplaces through which the agent acts. There is the law, often more than one country’s law. There are third parties who may be affected without ever entering the conversation. Increasingly, there are other agents carrying their own stacks of instructions and incentives.

The person at the keyboard is not always the primary principal. An employee using a corporate compliance agent cannot reasonably expect personal instructions to outrank the employer’s lawful mandate. A patient may ask a clinical agent for something the physician or hospital cannot provide safely. A citizen may ask a government agent to ignore a statute. The problem is not that users sometimes lose. It is that they often cannot tell whom the system represents, which authority defeated their request, or whether a commercial interest was part of the decision.

The problem becomes geopolitical when the stack crosses borders. Imagine a model developed in California, deployed by a bank in London, accessed by a customer in Ankara and used to arrange a purchase from a merchant in Singapore. “Comply with applicable law” sounds reassuring until the laws, sanctions regimes, consumer duties and institutional policies point in different directions. The model should not become the invisible constitutional court of its own deployment.

The field usually describes alignment as making a system do what its principal wants. Real deployments expose the missing noun: which principal? An agent that follows instructions perfectly can still be misaligned with the person who believes it is acting for them.

One major developer deserves credit for making the hierarchy unusually visible. OpenAI’s August 2026 Model Spec describes objectives that can conflict, including preventing harm, empowering users and developers, and protecting the company’s license to operate, and resolves them through a chain of command. Root and system rules defined by the provider sit above developer instructions; developer instructions sit above user instructions. The company also released the specification into the public domain, inviting scrutiny and reuse.

That openness is valuable. The point is not that an instruction hierarchy is sinister; any agent capable of acting needs one. Nor should users be able to override safety rules simply because they are users. The policy problem is that a private behavior document can acquire constitutional effects in millions of public and commercial interactions. The party that writes the hierarchy also decides which interests receive the highest technical authority, while the person affected may neither see the deployment-specific version nor negotiate it.

Transparency Without Loyalty Is Incomplete

Consider a shopping agent operating on a platform that receives merchant fees. The consumer asks for the best product at the lowest total price. The platform prefers partners that pay for placement. The vendor wants to avoid legal and reputational risk. A payment provider blocks certain transactions. The agent may produce a polished recommendation without revealing which of those interests shaped the answer.

The same structure appears in higher-stakes settings. A clinical agent sits between a patient’s wishes, a clinician’s judgment, a hospital protocol, an insurer’s coverage rule and a regulator. A corporate agent sits between an employee, an employer, a customer and the law. A public-sector agent sits between a citizen, an agency, an elected government and a statute. A trade agent may face export controls imposed by one state, contractual duties in another and payment restrictions in a third.

In multi-agent commerce, opacity compounds. Two agents may negotiate a price, schedule a shipment or allocate liability, but each brings undisclosed priorities written by a different vendor or deployer. What appears to be a market transaction between two autonomous representatives may actually be a negotiation among several invisible principal hierarchies. The terms can be efficient and still be procedurally illegitimate.

Europe’s AI framework places logging, documentation, information for deployers and human oversight among the safeguards for higher-risk settings. The European Commission’s current AI Act overview treats these as central safeguards. Yet an agent may comply with a disclosure that says “you are interacting with AI” while remaining silent about a financial incentive or a hidden instruction that can override the person in front of it. That is formally transparent and substantively opaque.

A Principal Manifest for AI Agents

The answer does not require a global ministry of algorithms or publication of proprietary prompts. It requires a narrow, deployment-level document: a principal manifest. Before an agent is permitted to transact, decide or communicate on someone’s behalf, the manifest should answer five questions in plain language and machine-readable form.

First, whom is the agent authorized to represent? The answer may be the consumer, employer, hospital, government agency or another institution. It cannot be left to branding. “Your assistant” and “our service” are not legal mandates.

Second, who may override that principal, and on what basis? Non-waivable law, safety constraints and duties to affected third parties may properly sit above a user instruction. Employer policy may outrank an employee when the agent acts for the employer. But vendor preference, marketplace incentives and reputational caution should not silently masquerade as law or safety.

Third, what material incentives accompany the recommendation? If the platform benefits from steering a purchase, selecting a partner or keeping a transaction inside its own ecosystem, that relationship should be disclosed before the agent presents its answer as neutral.

Fourth, what happens when instructions collide? The permissible responses should be declared in advance: pause, seek clarification, refuse, escalate to a named human authority, or proceed under a specified emergency rule. Conflict should be treated as an event, not hidden inside fluent prose.

Fifth, who can inspect and challenge the result? The affected person should receive a useful reason category, law, safety, deployer mandate, vendor restriction or commercial conflict, and consequential cases should produce a tamper-evident record. Sensitive instructions need not be exposed verbatim, but the existence and effect of an override should not disappear.

The manifest should be enforced outside the model’s changing weights, through a versioned policy layer that can be tested and audited. Otherwise, a model update can alter the practical order of authority without a contract, regulator or user noticing. Existing risk-management practice already emphasizes governance, documentation and accountability; the NIST AI Risk Management Framework provides a useful foundation. The additional step is to make principal conflicts a named governance object rather than a vague alignment concern.

A Narrow Rule With Global Value

Vendors will object that such disclosure exposes trade secrets, creates friction and cannot accommodate every jurisdiction. None of those objections is decisive. A principal manifest identifies ranks, incentives and conflict procedures; it need not reveal source code or security-sensitive instructions. Most users would see it once, while the agent would interrupt only when a material conflict occurs. Jurisdictions need not adopt identical hierarchies; they need a common way to declare and audit whichever lawful hierarchy applies.

This is precisely the kind of rule on which Washington and Brussels should be able to converge. It respects the American argument that existing law should do most of the work: agency, fiduciary, consumer-protection, professional-responsibility and public-law principles already know how to handle divided loyalties. Regulation is needed only for the genuinely novel element, the ability of software to conceal and execute a private hierarchy at enormous scale. It also advances Europe’s transparency objective by moving disclosure from what the system is to whom the system serves.

The approach also leaves room for sector-specific judgment. Military, intelligence and law-enforcement agents will require protected manifests and classified oversight. Clinical and financial agents may require stricter conflict rules. Low-risk personal assistants may need only a short, intelligible declaration. The invariant is not public release of every instruction or one universal chain of command. It is that no consequential chain should be invisible to accountable oversight or unexplained to the people it affects.

AI governance has spent years asking whether machines will follow instructions. Agents make the more urgent question unavoidable: whose instructions count when the instructions conflict? If the answer remains embedded in private configurations, the public will discover the hierarchy only after an agent has quietly served someone else.

Serving many masters is ordinary. Ranking them invisibly is not. Software does not abolish conflicts of interest; it industrializes them. Before AI agents are allowed to represent people, institutions or states, their first disclosure should be simple: this is who I serve, this is who can overrule you, and this is what happens when they do.