Can an AI agent sign a contract?
It shouldn't, and in docuinked it can't. US law lets automated systems take part in a contract if their actions are attributable to the person bound. That is exactly why you want a hard line: prepare by machine, approve and sign by person.
By docuinked. Published 2026-11-07, updated 2026-11-07.
What the law says
ESIGN says a contract isn't invalid because an electronic agent took part, as long as the agent's action is legally attributable to the person bound. So law doesn't forbid it. It raises a harder question: if your agent clicked yes, are you bound by something you never read? Our view is that you should never have to find out.
Why prompts aren't enough
The usual advice is to tell the agent to ask first. MCP's own spec says clients should keep a human able to deny tool calls, but that sits in the client, and it is only a should. Custom agents and scheduled jobs often have no such client. Docusign's own post says those agents "must build their own approval step".
The deeper issue is prompt injection. A signing agent has three dangerous things at once: private documents, text written by strangers, and a way to reach people. Researchers call that mix the lethal trifecta. In a reported 2025 case, white-on-white text in a PDF steered an agent into leaking client data. Instructions to be careful sit in the same text stream as the attack.
The split we recommend
| Step | Who | How it is held |
|---|---|---|
| Find the template, fill it, pick signers | Agent | API key |
| Decide this exact draft may go out | A named person | Sign-in, bound to a hash |
| Agree to the document | The signer | Their own link, in their own email |
An agent gets everything it needs to be useful and nothing it could misuse at scale. Reads are free. Drafts are private. The two acts with legal weight belong to people.
What goes in the record
If software took part, the log should say so, and it should never merge two identities. A good record reads: prepared by this key, approved by this person at this time, signed by that person at that time. That covers the attribution question.
Limits we won't hide
If an agent controls a signer's inbox and browser, it can open their link. We stop this by credential and it shows in the record, but we can't stop it completely. Don't give an agent the mailbox of someone who signs. Add an access code to documents that matter.
Sources
Checked 2026-11-07.
This guide is general information, not legal advice.
Common questions
Can I authorize an agent to sign for me?
Some law allows authorized agents in general, but we don't support it. docuinked has no sign call, and a person signs for themselves. If you need a delegate, talk to a lawyer and use a human delegate.
What is the lethal trifecta?
It is the mix of private data, untrusted content and a way to send data out, all in one agent session. A signing agent has all three, so at least one must be cut. We cut the third with server rules.
Is a human approval step slow?
It takes as long as reading the draft. For fixed flows that you wrote and trust, your own server can send directly. Approval is for anything an agent can steer.
Related
Try it in test mode
Free during the beta. Test keys send no email, so you can build the whole flow first.