We aren't talking about laws. We're talking about rules. And how "agency" is regulated in the rule of law is entirely different than how it's regulated within an organization like the NCAA. The NCAA is an organization with rules that all of these schools and universities have agreed upon. Things not listed are legal. This is how Harbaugh got away with satellite camps as ways to get around recruiting regulations; until the NCAA changed the rules. The NCAA does, in fact, have to define every single broad instance.
The NCAA does regulate agency -- which is why there's a whole section around boosters, definitions on who counts as university employees, boosters, ect. And regulates their actions, especially around recruiting. It's why I, as a defined University booster, couldn't (5 years ago) offer a recruit $50k to attend Michigan.
The NCAA rule says institutional employees are regulated in how they scout teams and it even goes as far as to define institutional employees. That definition does not include private contracts between an individual associated with the institution and one who isn't - or simply acquaintances performing this; nor does the rule attempt to regulate that. Which is why, to this day, I (as a defined university booster) can go to a Georgia game, record all the signals, even scout Georgia to the best of my abilities, and give that information over to every single team in the SEC. This is legal for the same reason that having any third party scout a team, is legal.
Now this is a clear loophole that the NCAA might argue against, and even issue rule violations over. Like I said, Michigan could fight it if it comes to that - but my guess is that they're going to say these are secondary violations, Michigan is going to accept that as the lesser of two evils and move on with the minor punishment for those "violations". After which, the NCAA will modify the rule to be more clear (or we'll see in person scouting become legal).