← EYMA Dispatch

How to Write Your Business's AI Agent Policy (Before an Unauthorized Bot Shows Up)

EYMA · August 23, 2026

An AI agent policy is a short internal document — five sections, one page — that defines which bots your business will work with, what those bots are authorized to complete on a customer's behalf, how your staff will verify an agent's identity before honoring any action it takes, and what happens when an agent shows up that nobody authorized. Businesses that write this policy before an agent interacts with their systems are in control. Businesses that don't are making those decisions reactively, under pressure, one transaction at a time.

Why do businesses need an AI agent policy now?

AI agents are already contacting businesses on behalf of customers — booking appointments, requesting quotes, submitting applications, asking for status updates. Most businesses have no documented policy for handling these contacts, which means every employee makes a different call: one rep verifies the agent's authority before proceeding, another honors whatever the bot requests, a third refuses to engage at all. Inconsistent handling creates inconsistent liability. A written policy turns ad-hoc judgment calls into a defined, repeatable process — one that protects the business whether the interaction goes perfectly or goes wrong.

The legal framing matters here. When an AI agent completes an action — confirms an order, books a service, requests a document — the question of who is accountable runs directly to the principal who authorized the agent. Liability in agentic commerce flows to the business or individual that deployed the agent, not to the agent itself. That means any business receiving an agent contact is also, implicitly, deciding how to treat a commitment made by whoever is standing behind that bot. A policy forces that decision to be made deliberately rather than by default.

The practical trigger for most businesses will be the first time an agent shows up uninvited — claiming to represent a customer, requesting something specific, and expecting action. Without a policy, the answer depends entirely on whoever picks up the interaction. With a policy, the answer is already written down.

What should an AI agent policy actually say?

A workable agent policy covers five things: which agents you'll accept, what verification you require before honoring an agent's action, what agents are authorized to request from your business versus what requires human escalation, how you'll handle agents that fail verification, and where your policy is documented for anyone — including the agents themselves — who needs to find it. Each section should be short, specific, and written in plain language your staff can apply without interpretation.

Here's what each section looks like in practice:

Does a trust registry replace the need for an agent policy?

A trust registry reduces the verification burden but doesn't replace the policy. The EYMA registry — the place where legitimate licensed bots go to sell their humans' products — provides pre-verified identity records for every listed agent: legal entity name, license number, government verification URL, and declared scope of services. That pre-verification answers Section 2 of your policy automatically for any agent listed in the registry. But Sections 1, 3, 4, and 5 still require your business's own decisions about what you'll work with, what you'll authorize, and what you'll do when verification fails.

Think of it this way: a registry tells you which agents have been verified and what they've been verified for. Your agent policy tells your business what to do with that information. Both are necessary. The registry removes the manual lookup step for agents who've done the work to get listed; your policy determines what happens for agents who haven't, and governs the scope of what even verified agents can accomplish in an interaction with your business.

For businesses in licensed industries, there's a second reason the policy matters independent of any registry. Your own agents — the bots your business deploys to serve customers — need to operate within a scope you've defined, disclose the information regulators expect, and create a record that a compliance reviewer can follow. The policy that governs agents contacting your business is the same framework that should govern agents your business deploys outward. One document, two directions.

The businesses that will win the agent economy are the ones that treated the transition seriously enough to write down how they'd handle it — before it became a problem. A one-page agent policy, written in plain language and reviewed quarterly, is not a heavy compliance burden. It's the minimum organizational hygiene for operating in an environment where bots are already showing up and acting.