THE UAF INDEX
A bill introduced by U.S. Senators Mark Warner and Brian Schatz would create a federal AI Safety Board, require pre-release access to certain frontier models, and set reporting rules for serious incidents. It is a proposal; none of its requirements are currently in force.
SPIFFE’s Workload Endpoint omits direct client authentication and relies on out-of-band authenticity checks; OAuth tokens represent scoped, time-limited authorization.
NIST offers a voluntary framework for AI risk. California’s DMV points the public to autonomous-vehicle incident reporting and collision records. These are different tools for asking what happened—and what deserves scrutiny.
A reported majority of HTML requests tells us about traffic, not a census of machine users. The harder question is what those machines are authorized to do.
A web for people and a web for agents is a forecast, not a completed divorce. The useful question is who controls the doors between them.
Frontier developers increasingly publish safety frameworks, system cards and capability thresholds. That is better than silence, but public evidence must be more than a company’s
Buying an agent is not only buying software. It is choosing a provider’s defaults for memory, data retention, tool access, oversight and incident response. Procurement
Human approval is often presented as the answer to agent risk. It is necessary, but a button is not a governance system. Approval only works when
Persistent assistants turn memory into an institutional question. A remembered preference can be useful; a remembered confidential conversation can be a liability. The longer an agent
Computer use gives models a way to act. A proposed NIST identity project asks how access should be governed. The cursor has moved faster than the paperwork.
Visa’s agent protocol and HTTP Message Signatures describe signed identity and intent; application choices still determine what a verifier can trust.
Agent communication protocols and oversight research answer different questions. Neither supplies a complete system of government for a hypothetical machine society.
Two research demonstrations show how hostile prompts can travel between AI systems. A message from a trusted machine still needs a boundary.
AI agents have spent the year being described as products. The more durable development is administrative: security agencies and standards bodies are beginning to treat them
The public argument about agents often begins with capability. The more durable 2025 development was administrative: teams began naming the controls required when software can pursue goals, use tools and carry context across interactions.
By August 2025, the agent conversation had acquired a practical vocabulary: approval, read-only access, data segregation, prompt injection and tool boundaries. Anthropic’s framework did not solve those problems, but it made them difficult to dismiss as future concerns.
On 2 August 2025, the European Union’s obligations for general-purpose AI models entered application. The change mattered because it moved the debate from principles
Public institutions cannot treat agent deployment as a private experiment. Decisions affect people who may not be able to switch providers, inspect a model or appeal
Anthropic’s activation of AI Safety Level 3 protections showed how a scaling policy becomes operational. The policy does not make a model harmless; it commits
Confirmations, monitors and interruptions give oversight a mechanism. The harder question is whether the person can catch the mistake in time.
Google and Anthropic are proposing different connections for AI systems. Shared protocols can make delegation easier. Someone still decides what gets connected.
