Who Is Accountable When an AI Agent Acts?

Mohamad Khalil Yossif — Tue, 10 Nov 2026 13:55:47 +0000

The company that deployed it, through an accountable person. The hard part is proving, for each action, whether the person or their agent did it, and under whose authority.

Who is accountable when an AI agent acts? In practice, the company that deployed it, through one accountable person who set the agent's bounds. Saying so is easy. Proving it for a given action is the hard part: did the person do this, or their agent, and under whose authority?

Most agent security products answer a different question: what is this agent allowed to touch? That is the right first question. Agents now edit timecards, fill shifts, issue refunds and change access inside the same products people use. Limiting what they can reach is basic hygiene.

Who Did This, the Person or Their Agent?

When people and agents act in one system, every action raises two more questions. Who did this, the person or their agent? And which human answers for that agent?

Access rules cannot answer either one. An agent working through a manager's browser session or shared credentials reaches exactly what the manager reaches, and the platform's record shows the manager's name on both. Where delegated tokens do log an agent ID, the entry still sits in the platform's own database. A log is the system's account of itself, kept by the same system whose actions are under review.

Human Approval for the Few Agent Actions That Matter

The tempting answer is to put a person in front of every agent step. It fails within a week. Reviewers start approving on reflex to clear the queue, and the agent stops being worth running.

Bounds signed once. Each agent has one accountable person, who ratifies its mandate: which actions, which records, which limits. Authority is verified at the moment the human last ratified, and enforced against bounds, revocation and live actor signals thereafter. Inside the bounds the agent runs at full speed. The person can revoke the mandate at any moment.

A short list waits. The customer picks the few actions that must carry a person: a pay change, approving overtime, a timecard edit after the period closed, removing someone's access. These do not execute until the accountable person approves that exact action on their own phone. Everything else stays automatic.

An AI Agent Audit Trail That Says Which One Acted

Each action leaves its own record at the moment it executes, with its place in a continuous chain. When a person approves, the record binds the exact action to the signature from their phone and the phone's verified state at that moment. When an agent acts, the record binds the exact action to the mandate a person signed. The chain runs across every action, so evidence does not exist only at the moments someone was asked to step in.

Attribution is fixed when the action happens and is not reassigned later. The record verifies against published keys, so the customer's own team or an auditor can check it without trusting an export from the system that acted. A review can sort actions into three groups: approved by a person, executed inside a ratified mandate, and no record at all.

The record is evidence. Deciding who is responsible stays with the people who review it, up to a court.

Govern what agents can reach. Then make every action say who did it, and keep a short list that waits for a person's approval. People and agents in one system, under human authority.

This post first appeared on the Yuthent blog.

DEV Community: Mohamad Khalil Yossif

Who Is Accountable When an AI Agent Acts?

Who Did This, the Person or Their Agent?

Human Approval for the Few Agent Actions That Matter

An AI Agent Audit Trail That Says Which One Acted