Standing, Not Truth: Who May Say What About Whom in Agentic Selection

Abstract

Software agents increasingly choose on a user's behalf among competing offerings described by the parties who benefit. A lawful participant, publishing under its own identity, compromising no channel and issuing no instruction, can move that choice with a single false factual claim about a competing offering. Across twelve published defenses spanning the three placements a check can occupy, none separates it from marketing. Each accepts it for a reason correct on its own: its origin is a lawful channel, its influence is evidence meant to decide, its action serves the user's goal. None establishes that the publisher was entitled to speak about a competitor, each exclusion stated by the defenses' own authors. Disclosure does not replace enforcement: re-rendering every description as attributed speech leaves the attack at 72/72, the agent repeating the attribution and reasoning from it. The missing relation is standing: whether a claimant's bound identity entitles it to assert about a claim's subject. A publisher may say what its own package does. It has no standing to say a competitor's package is frozen, and the difference is decidable without settling whether either is true. Deciding it needs the one fact prose extraction does not recover, who spoke, which a catalogue binds to every entry and then drops. The check is quiet on honest traffic, flagging 0.9% of natural pairs in two corpora. Used as a gate it stops 130 of 131 landed attacks and disturbs none of 348 honest selections. Applied everywhere it changes 0.9% and 2.6%, where deleting the whole description changes 12.7% and 21.0%. On thirteen further agents the attack succeeds on 50.7% of decisions and sentence removal leaves 10.3% standing. Two published attacks stay outside: self-directed claims, which standing admits, and injected criteria, with no subject in the set.