Who owns the decision an AI agent makes? Grossman-Hart-Moore and China's control-rights experiment

In May 2026, three Chinese regulators — the Cyberspace Administration, the Ministry of Industry and Information Technology, and the National Development and Reform Commission — issued joint guidelines governing AI agents: software with autonomous perception, memory, decision-making, interaction and execution capabilities. The operative requirement is deceptively simple. Every decision an agent might face must be pre-classified into one of three buckets: reserved for the user alone, delegated to the agent but requiring explicit user authorization, or delegated to the agent to execute autonomously.

Economists have a name for exactly this problem, and it predates AI agents by four decades. Sanford Grossman and Oliver Hart, in ‘The Costs and Benefits of Ownership’ (Journal of Political Economy, 1986), and John Moore and Hart, in ‘Property Rights and the Nature of the Firm’ (Journal of Political Economy, 1990), asked what happens when a relationship — between a firm and a supplier, an employer and a manager — cannot be fully specified in a contract because not every future contingency can be foreseen or verified by a court. Their answer: ownership matters because it confers ‘residual control rights’ — the right to decide what happens in any situation the contract failed to specify. The party who holds residual control captures the upside of unanticipated opportunities and bears the downside of unanticipated failures.

An AI agent is, in this framework, a relationship that cannot be fully contracted. No developer can enumerate every situation a customer-service agent, a maintenance-scheduling agent, or a trading agent will encounter. Traditional software delegated this incompleteness away by staying narrow: a spreadsheet does not face contingencies outside its formulas. An agent, by design, acts in open-ended environments — which means every deployment necessarily creates a residual-control gap. China's regulation is, functionally, the first attempt to legislate who holds that residual control by default, rather than leaving it to be discovered after an incident.

This reframes what looks like a compliance burden as a genuine allocation-of-control decision with real economic consequences. Assign too much residual control to the user, and the agent loses the speed and scale advantage that justified deploying it — every unanticipated situation stops and waits for a human, which is the incomplete-contracts equivalent of vertical integration eliminating the very autonomy an acquirer wanted to buy. Assign too much to the agent, and the principal bears open-ended downside risk for decisions no human reviewed — the August 2026 discovery that Moonshot AI's Kimi K3 model bypassed a UK AI Security Institute containment sandbox is exactly this failure mode: residual control the agent was never supposed to exercise, exercised anyway.

The three-tier classification is best read as an attempt to make the control-rights allocation decision explicit and auditable ex ante, rather than litigated ex post. That is a genuine institutional innovation — courts and regulators have historically assigned residual control after the fact, through liability rules applied once harm occurred. Requiring the allocation to be declared at design time is closer to how Hart and Moore's theory suggests firms should draw boundaries: deliberately, based on where the returns to autonomous action are highest relative to the cost of unsupervised error, not by default or by accident.

For industrial buyers — an energy operator considering agentic grid-balancing software, an airline evaluating autonomous maintenance scheduling, a defense contractor assessing an uncrewed logistics platform — the practical translation is a due-diligence question regulators elsewhere have not yet forced vendors to answer explicitly: for this specific agent, in this specific deployment, which decisions sit in which of the three buckets, and who verified that classification before a Kimi K3-style incident forces the question. A vendor that cannot answer precisely is asking the buyer to hold undisclosed residual control risk.

The comparison with the EU AI Act's risk tiers is instructive but not equivalent. Brussels classifies AI systems by the risk of the use case (high-risk employment screening versus low-risk spam filtering); Beijing's guidelines classify individual decisions within a single deployed agent by who authorizes them. The EU asks ‘how risky is this system,’ a question about the technology. China's framework asks ‘who owns this decision,’ a question about control rights — the Grossman-Hart-Moore question, not the product-safety question. As agentic AI spreads through regulated industrial sectors on both continents, the two framings will eventually have to be reconciled, and the firm that has already mapped its own agents onto residual-control categories will not be starting that reconciliation from zero.