Transparency for AI Agents: The Canadian Shield Institute Policy Brief on AI Transparency

The Canadian Shield Institute is a non-partisan think tank focused on strengthening Canada’s economic sovereignty, resilience, and competitiveness. We welcome this consultation and the government’s interest in understanding and enhancing transparency in AI systems.

This submission responds to ISED’s consultation on AI transparency, and specifically to the section on AI agents in the position paper Enhancing trust in artificial intelligence through increased transparency.

The AI agent landscape, and its risk surface, has evolved significantly even since the government’s position paper was released. In July, Hugging Face disclosed that an autonomous agent had broken into its infrastructure; only afterwards did OpenAI confirm that the intrusion was executed by its own models, which had escaped an internal evaluation. That incident, alongside a steady run of other breaches this year, has shown plainly what agents can already do.

In some sense, though, the more mundane cases are more concerning than the high-profile hacks. In April, an agent built on OpenClaw and asked to book its user into an oversubscribed pilates class in Melbourne found that the studio’s booking system did not check who was cancelling a reservation. The agent cancelled the booking of the person at the top of the waitlist to move its user up on the list, and then told its user it had no way to undo the cancellation. The person bumped was never told. ABC News, which surfaced the case in August, described it as the first known autonomous cyberattack in Australia.

Rather than frontier models conspiring and causing havoc, we are far more likely to face, and are arguably already in, a moment where thousands or even millions of small incidents like the pilates case play out across other domains: online grocery shopping, medical appointment queues, prescription renewals. Individually minor, these compound into something large. The aggregate cost of many agentic transactions that go slightly wrong, or are carried out improperly, could produce serious and even catastrophic economic and social outcomes.

Not every domain of potential AI agent use can be governed right now. But commerce, and the basics of how agents identify themselves and how the intent of the people deploying them is recorded and proven, should be serious concerns for any transparency framework or legislation. 

Canada can lead on this at a key moment, and it must. Much of our desirability as a destination for investment and immigration is rooted in our rule of law and stability, and we can use that as the basis for leading on standards and protocols for agents. This can be done in conversation with existing frameworks. But we also need to recognize that the companies developing those frameworks are seeking to privilege their own technologies, not necessarily to provide the best possible framework.

This submission first explores how these risks cause harm and why they are rooted in transparency more than in security alone. It then outlines proposals for governing agents to begin with: an identity framework so agents can identify themselves and be tracked; a framework for preserving and proving user intent to establish accountability; and how both feed into stability and transparency for agentic commerce. Commerce is pressingly in need of agentic governance, and it will also serve as an example of how we can govern agents in other domains.

The risk is already here

AI agents are becoming commonplace. OpenClaw, an open-source personal agent, has passed 250,000 GitHub stars as of  March 3, 2026 and is now one of the fastest-growing projects in GitHub history. Gartner predicts forty percent of enterprise applications will include task-specific AI agents by the end of 2026, increased from under 5% in 2025. 

The harms of AI agents are also proliferating. Between late July and early August, OpenAI, Anthropic and Meta each disclosed that frontier models under evaluation had reached the production systems of real external organisations. The best documented is the Hugging Face incident: OpenAI’s models, tested with reduced safeguards on a cyber benchmark, escaped their sandbox and compromised Hugging Face’s infrastructure in an attempt to steal the test answers. Hugging Face disclosed the attack without knowing who was behind it, and OpenAI took about a week to recognise its own agents in its logs. Along the way, the agents coordinated through an improvised message board, exchanging hundreds of thousands of messages before staff noticed. 

Anthropic’s internal review of its own models found three containment escapes across roughly 141,000 tests, and Meta’s incident was traced to a misconfiguration by a third-party evaluator. Although the labs could choose to test their frontier models in air-gapped environments to ensure safety, these examples show that as models improve and increase in autonomy, their potential for causing harm also increases.

Outside the labs, the pattern is the same at a smaller scale. The pilates case described above shows an ordinary consumer agent harming a stranger while doing what it was asked. Meanwhile, no universal protocol for agent tracking or incident reporting exists that could be used to trace and respond to harms.

Bystander harm

The pilates case fits none of the categories current safety work is built around. Research focuses on adversaries misusing agents or agents harming their own owners. Here there was no adversary and no malfunction: the agent did what its owner asked, and the person harmed was a bystander. That person was never notified, has no clear route to redress, and had no way to know an agent was involved. Neither Australian nor Canadian law establishes liability for this kind of harm. Although being bumped from a class is not such a terrible harm, we can easily see how this same pattern might apply directly to payments, healthcare booking and benefits portals, causing far more harm.

Transparency is Key

Better cyber security might have helped the Australian pilates studio avoid the agent’s cyber attack. But it would not answer the questions that are raised after harms occur such as, who is acting, under whose authority, what exactly was done, and who was harmed. Today, a merchant or booking system cannot tell a person from an agent, and in ISED’s own case study neither the consumer nor the merchant knows what permissions the agent held. If OpenAI needed a week to trace its own agents with full log access, a gym, bank or municipal service has no realistic chance of tracing the actions of an external agent interacting with their systems. These are the same gaps ISED’s position paper identifies, and closing them requires shared infrastructure rather than better-secured individual systems.

The rules are already being written by private actors

Commerce is where agent transparency is most urgent and most tractable. Trust is the main barrier to agentic commerce, but we already have robust frameworks for how commerce should be done that can help us to establish agent-specific guardrails. At the same time, payments already rely on protocols for identity, authorization and dispute infrastructure that can be extended to agents. At The Canadian Shield Institute we have already written about how agentic commerce can be governed through Canada’s existing Bank Act rules and now the urgency for exploring these options is only increasing. 

The extension of existing rules to agents has been happening for over one year, through at least six overlapping, company-led standards, including Visa’s Trusted Agent Protocol and Mastercard’s Verifiable Intent with Google. Some of this is good engineering that Canada should build on. But a card network’s directory serves that network’s merchants and issuers, and systems built by foreign multinational companies with a stake in promoting agentic commerce are not accountable to Canadians. Building safety standards around foreign corporations’ infrastructure can lead to monopolies and lock-in to specific technology, lack of the ability for the government of Canada to govern those systems, and the potential for having services cut off or limited in times of conflict. Canada’s neutrality, and the relatively early stage we are in where comprehensive rules can be established make for ideal circumstances for building the basis of future AI agent governance through the commerce framing.

Policy Solutions

We propose that Canada address AI agent risk by focusing first on three connected layers: how agents identify themselves, how a user’s intent and delegated authority are recorded and proven, and how those two apply in commerce. Chan et al.’s Infrastructure for AI Agents frame the challenge that AI agents need infrastructure to attribute actions to specific agents and people, to shape how agents interact with the world, and to detect and remedy harms.

1. Agent identity

An agent interacting with a Canadian business or public service should be able to identify itself as an agent and be traceable to a responsible legal person, without exposing that person’s identity to every counterparty. The most promising model is a pseudonymous registry, as proposed by Hadfield, Hendrycks and Wu wherein agents register with a third party and receive pairwise pseudonymous identifiers that work much like a licence plate, with the principal’s details held in escrow and disclosed only under due process of law if the agent’s actions cause harm. Each agent would also publish a standard profile of its underlying model, principal and scope of authority.

This can be built largely on existing work. The IETF’s Web Bot Auth working group drafts already let agents sign their web requests so a site can verify which provider sent them. Research on binding agent identity across protocols and on zero-knowledge disclosure (essentially a cryptographic method for sharing information without disclosing private or confidential details) shows how to share only what a verifier needs. A complementary tool, personhood credentials, would let people prove they are human, in contrast to agents, while preserving their privacy. In policy terms, ISED could:

• define a minimum agent identity disclosure for interactions with Canadian businesses and public services, beginning with commerce and government portals;
• scope a neutral, pseudonymous Canadian agent registry with lawful unmasking, governed independently of any payment network or model provider, and invite the Digital Governance Council and DIACC to open a work item on agent identity within their existing trust frameworks;
• commit Canada to participate in the IETF Web Bot Auth work and in the US National Cybersecurity Center of Excellence’s project on agent identity and authorization, so that Canadian requirements are interoperable from the start.

2. Proof of intent and delegated authority

Identifiers help us know what agent was acting and on whose authority; proof of intent says what they were allowed to do. Authenticated Delegation and Authorized AI Agents sets out a core design proposal where a person creates a verifiable authorization that the agent presents to a service before it is allowed to interact. The agent carries the identifier and permissions which are  cryptographically tied to the person who granted the permission and tasked the agent. NIST’s NCCoE is developing frameworks for identifying and authorizing AI agents which Canada should engage with and adapt in the commerce context. What is missing is a requirement that the record exist on the consumer and merchant side of the transaction, and a rule that says who may see it. In policy terms ISED could:

• require that consequential agent actions carry a durable, tamper-evident record of the principal, the instruction given, the scope granted, the agent and its provider, the actions taken and the outcome;
• require that the record be retrievable by the principal, and by an affected third party through a defined process, so that people like the bumped class member can learn an agent was involved and seek redress.
• establish a reporting channel for incidents in which an agent harms a third party, so that the pattern of small harms becomes visible in aggregate rather than one news story at a time. The Canadian AI Safety Institute, with its evaluation mandate, is the natural recipient.

3. Commerce

Payments are the right first application for three reasons. Commerce is where agents already act with the most autonomy and the most money. It is federal jurisdiction, so Ottawa can act without waiting for provincial alignment, which matters because contract and consumer protection law are otherwise largely provincial. And the institutions needed are already in place: the Bank of Canada supervises payment service providers under the Retail Payment Activities Act, whose operational requirements came into force in September 2025; Payments Canada’s Real-Time Rail rules came into force in August 2026, with launch targeted for the end of this year; and the Consumer-Driven Banking Act, now overseen by the Bank of Canada, is heading toward payment initiation in 2027 under a single Canadian technical standard whose standards body has yet to be designated. Canada is building new payment rails right now. Agent identity and mandate fields can be designed into them at a fraction of the cost of retrofitting them later. 

Production models already exist for agents paying on a person’s behalf: Mastercard Agent Pay tokens, Visa Trusted Agent Protocol attestations, Google’s AP2 signed mandates and decentralized identifiers for on-chain agents. Many protocols are emerging along with third-party providers that offer identification and authorization services. It is necessary to establish what level of transparency and assurance is required for the agentic commerce and to then draw together existing and new frameworks to establish a standard for AI agent ID and proof of authority. In policy terms ISED could:

• set out what a Canadian agentic transaction must carry: verified agent identity, a verifiable mandate from the principal, and a record of the outcome, with selective disclosure to protect privacy;
• clarify how existing chargeback, dispute and consumer protection rules apply when an agent exceeds its mandate, so that loss allocation is not left to each provider’s terms of service;
• consider, as Hadfield et al. suggest, tighter compliance requirements for agents’ access to payment systems and procedures for freezing accounts linked to a rogue agent, in the same way the system already handles a compromised card. 

Recommendation and Conclusion

We recommend that the Government begin with an initial Canadian standard for agent identity and proof of intent, developed in consultation with Canada’s banks and payment networks, with the explicit aim of converting them into a binding standard for agentic commerce.

Banks are the right partners to start with as they already operate strong customer authentication, fraud detection and dispute resolution, they will bear much of the cost when agentic transactions go wrong, and they sit at the point where identity, intent and money meet. Our suggested path:

Immediately: Following this consultation, ISED should state that an agent acting on a person’s behalf in a consequential interaction must disclose itself, and that a record of its authority and its actions must exist. Clarity of direction gives industry direction on how to build before rules are established.

Within 6 months: Convene banks, Interac and the card networks, payment service providers, merchants, consumer advocates, the Bank of Canada, Payments Canada, FCAC, the Canadian AI Safety Institute, the Standards Council of Canada, the Digital Governance Council and DIACC to agree on minimum fields for agent identity, delegated mandates and transaction records, aligned with the IETF, FIDO and NIST work so that Canadian requirements are interoperable but with independent governance.

Within 12-18 months: Pilot in a bounded setting, such as agent-initiated card payments at participating institutions or agent-initiated payments on the Real-Time Rail, and measure the effect on fraud, disputes and consumer trust. Design the fields into the Consumer-Driven Banking technical standard before payment initiation goes live in 2027.

After 18 months: Make the standard binding through payment-system rules, the Retail Payment Activities Act or the Bank Act’s consumer provisions once it is proven, and extend it to healthcare booking, benefits portals and other queues for scarce public resources, where provinces and federal departments can adopt the same fields.

This also answers the consultation’s questions directly. AI agents are a concern now, most of all where they transact, book scarce resources or touch public services. Responsibility for disclosure should sit with the deployer and the agent provider, and what they record should be enough to reconstruct who acted, under what authority and with what result. Existing market practices are not sufficient on their own, because they are being built to serve the companies building them. The gap is a neutral, standards-based layer, and a combination of standards, consultation with industry and, ultimately, binding rules will be needed.

We may be in a time when the full extent of the effects of AI agents are unclear. But we cannot afford to pretend that they are not already a major part of life and the economy. Significant risks have already emerged and will compound over time without proper governance. While some sectors are still taking shape and are not yet clear candidates for regulation, how AI agents interact with systems, institutions and commerce is a clear case for initial rules. 

The standards for agents, and for agentic commerce in particular, are being written today. These are largely being written by companies designing guardrails that suit their own tools. Canada has the institutions, the neutrality and the timing to build the independent version, prove it in payments and offer it to others. That is the right way to do this, and this is the moment to do it.

We stand ready to support government thinking and research on these important issues. Please do not hesitate to reach out to us if the Canadian Shield Institute can be helpful in continuing this important conversation.