Autonomous AI agent authorization just became a legal minefield. On March 9, 2026, a federal judge in California ruled that when a website prohibits AI agents from accessing user accounts, continued access may violate hacking laws—even when the user granted permission.
The case is Amazon.com Services LLC v. Perplexity AI, Inc. The ruling upends a core assumption: that user consent is enough.
Perplexity’s Comet browser featured an AI-powered shopping assistant. Users described items they wanted. The agent searched Amazon and completed purchases automatically. Amazon’s terms of service required AI agents to identify themselves. They also limited access to public portions of the site. Comet allegedly accessed Amazon in a logged-in state without identifying itself. This made it impossible for Amazon to distinguish agent activity from human users.
Judge Maxine M. Chesney granted Amazon’s motion for a preliminary injunction. She found Amazon likely to prevail under the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act (CDAFA). The central question: does user consent to the agent’s access count as authorization? Or do the website operator’s terms of service control? At this stage, the court answered in Amazon’s favor.
Perplexity appealed the next day. The Ninth Circuit may reach a different conclusion. But the ruling has already sent shockwaves through the autonomous AI community.
As we covered in our Autonomous AI Compliance: What It Is and Why It’s the Next Wave, the distinction between copilots and agents is becoming legally consequential. This ruling makes that distinction concrete.
Three Principles from the Perplexity Ruling
The decision creates a new liability framework for autonomous AI agent authorization. Three principles emerge:
1. Website terms of service may override user consent. The court found that even though Perplexity users authorized the agent to act on their behalf, Amazon’s terms prohibiting agent access controlled. This reverses the default assumption that user authorization is sufficient.
2. Agents that disguise their identity create legal exposure. Comet allegedly mimicked standard human browsing behavior, including impersonating Google Chrome. The court viewed this as evidence of unauthorized access according to Law.com’s analysis.
3. Cease-and-desist letters matter. Amazon sent repeated cease-and-desist correspondence before filing suit. The court noted that this reinforced its position that continued access was unauthorized.
For compliance teams, the implications are immediate. Any autonomous agent that accesses third-party platforms—shopping sites, financial accounts, healthcare portals, or government systems—now faces new scrutiny. User consent may not be enough. Autonomous AI agent authorization requires evaluating the target platform’s terms of service.
The Global Crackdown on Autonomous Agents
The Perplexity ruling isn’t happening in isolation. Over the past two weeks, regulators worldwide have moved against autonomous AI agents with unusual coordination.
China led the charge. On March 8, China’s Ministry of Industry and Information Technology issued an urgent security alert about OpenClaw. This open-source AI agent can autonomously manage email, book restaurants, and check in for flights as The Register reported. Within days, Chinese state-owned enterprises and government agencies were ordered to ban OpenClaw from office devices entirely. Some notices extended the ban to phones using company networks—even reaching military personnel’s family members according to SCMP.
The United States followed. The Federal Communications Commission and Federal Trade Commission jointly issued temporary regulations for autonomous AI tools. The rules require three core controls: permission minimization, operational traceability, and human review for high-risk actions per the FTC announcement.
The European Union designated OpenClaw as a high-risk AI system under the AI Act. This triggers enhanced compliance requirements for any organization deploying it according to Tech.eu.
The United Kingdom’s Information Commissioner’s Office issued a risk alert. It warned public service organizations to exercise caution with action-based AI tools to prevent privacy violations as the ICO reported.
Japan and South Korea saw major corporations and financial institutions ban OpenClaw from office devices. They cited risks to core business data according to Nikkei Asia.
As cybersecurity firm CrowdStrike noted in a special report on agentic AI risks, action-based AI agents pose security risks far exceeding traditional conversational AI. Once compromised, they can directly execute device takeovers, steal sensitive information, and tamper with critical data.
The Regulatory Framework Is Catching Up
The academic community is racing to define the terrain. A new paper accepted for the 2026 Governing Agentic AI Symposium reviews 24 EU regulatory documents published between 2024 and 2025. Its conclusion: existing frameworks struggle to articulate precise stipulations for agentic AI because autonomous agents blur traditional legal and technical boundaries according to SSRN.
The paper’s authors argue that “agentic AI” needs clearer definition in regulatory contexts. Distinguishing it from related concepts would resolve ambiguity in compliance obligations. Their work aims to “inform policymakers, developers, and researchers on compliance and AI governance in a society with increasing algorithmic agencies.”
This academic effort mirrors what’s happening in the private sector. Microsoft is preparing to launch Agent 365 on May 1. The platform embeds governance controls directly into agent deployment. The company’s Entra ID governance now includes preview features for managing agent identity sponsors—individuals responsible for overseeing agent lifecycle and access decisions according to Microsoft’s announcement. Meanwhile, Intapp announced Celeste, an agentic AI platform designed for professional firms with compliance built into its architecture—including ethical walls, MNPI controls, and auditability as Intapp reported.
RecordPoint launched RexCommand, a free tool for shadow AI detection and policy enforcement. The company noted that 78% of employees already use AI tools at work. Additionally, 45% admit to using tools expressly banned by employers according to RecordPoint.
A GitHub framework for financial services now provides 71 comprehensive controls for Microsoft 365 AI agents. The framework covers security, management, reporting, and SharePoint governance. It includes implementation playbooks, verification testing procedures, and zone-based approval tiers as detailed on GitHub.
What Compliance Teams Should Do Now
The Perplexity ruling creates immediate exposure. Here’s what to do this week to ensure proper autonomous AI agent authorization.
1. Inventory Agents That Access Third-Party Platforms
Any autonomous agent that logs into external services needs immediate review. This includes shopping sites, banking portals, healthcare systems, and government platforms. Map each agent against the target platform’s terms of service.
2. Review Terms of Service for AI Agent Restrictions
Look for language that requires agents to identify themselves. Check for provisions limiting access to public areas. Read for clauses prohibiting automated access. If such terms exist and your agent violates them, you may have CFAA exposure.
3. Map Permissions to the Minimum Necessary Standard
The US government’s new interim regulations require permission minimization. Audit agent permissions. Remove any that exceed what’s strictly necessary for the task according to the FTC’s interim rule.
4. Implement Traceability and Human Review for High-Risk Actions
Both US interim rules and emerging EU guidance require that high-risk agent actions be traceable. They also require human oversight. Document these controls before deployment. Don’t wait until after an incident.
5. Monitor the Ninth Circuit Appeal
The Perplexity decision is now on appeal. The outcome will shape CFAA interpretation for years. In the meantime, assume that website terms can override user consent. This conservative posture is the safest path for now.
The Bottom Line
The Perplexity ruling is not the final word. The Ninth Circuit may reverse. But the signal is clear: autonomous agents operate in a legal gray zone. Regulators and courts are now filling that gap at remarkable speed.
In the past two weeks alone, we have seen:
- A federal court hold that user consent may not authorize agent access to third-party sites
- China ban autonomous agents from government and state-owned enterprise networks
- The US impose new regulations requiring permission minimization, traceability, and human review
- The EU classify open-source agents as high-risk AI
- Major vendors launch agentic platforms with governance built in
As one Chinese securities firm’s chief information officer put it: “If OpenClaw represents Level 3 autonomous driving, most securities firms are still driving a Jetta” according to SCMP’s reporting. The gap between agent capability and governance maturity is vast.
The Perplexity ruling is the first major court decision to address that gap. It won’t be the last. Organizations that inventory their agents, map permissions, and implement governance controls now will be the ones prepared for what comes next.
For more on related topics, see our coverage of Autonomous AI Compliance: What It Is and Why It’s the Next Wave, Shadow AI Containment: A 5-Step Plan, and The Glass Box Standard: How to Evaluate AI Vendors.