When a human employee wires $500,000 to the wrong account, the investigation follows a clear chain: who authorized the transfer, what were their limits, who approved the exception? The answers exist in approval workflows, delegation matrices, and audit logs. Accountability is structural.
When an AI agent initiates the same transfer — because it interpreted an instruction creatively, because its training data suggested it, because a prompt injection reframed its objectives — the investigation hits a wall. Who authorized it? The developer who deployed the agent six months ago? The manager who approved the AI pilot? The vendor whose model generated the action? The agent itself?
This accountability vacuum is the governance crisis of enterprise AI. And it is getting worse as agents move from pilots to production, from read-only to read-write, from supervised to autonomous.
The Accountability Stack
Effective AI agent governance requires a clear accountability stack — defined before deployment, not reconstructed after an incident.
The deploying executive owns the decision to deploy. Just as a business leader who approves a new trading strategy owns its outcomes, the executive who authorizes an AI agent deployment owns the consequences of that agent's actions within its designed scope. This accountability cannot be delegated to IT or to the vendor. It sits with the business owner who decided the capability was worth the risk.
The agent owner — a named individual, not a team — owns the agent's ongoing behavior. This role is analogous to a system owner in traditional IT governance: accountable for the agent's configuration, its entitlement scope, its monitoring, and its decommissioning. When the agent's behavior drifts, the agent owner is the first call. Organizations that leave this role undefined discover, after an incident, that everyone assumed someone else was watching.
The model vendor owns the model's general capabilities and safety properties — but not the specific deployment's actions. This boundary is critical and widely misunderstood. Anthropic, OpenAI, and Google are accountable for building models that behave safely in general. They are not accountable for what your agent does with your data in your environment under your mandate. Conflating these accountabilities lets everyone point fingers and no one take responsibility.
The oversight function — typically the AI governance board, risk committee, or (in regulated industries) the model risk management function — owns the framework: the policies that define what agents may do, the approval processes for new deployments, and the audit cadence. They don't approve individual agent actions. They approve the system within which agents operate.
The Authorization Chain
"Every autonomous action should trace to a human authorization. Not necessarily a human who approved that specific action — but a human who authorized the scope within which the action occurred."
The practical implementation is an authorization chain — a documented linkage from each agent action back to human decisions:
1. Deployment authorization: a human approved this agent's existence, its mandate, and its entitlement scope. Documented, signed, reviewable. 2. Mandate definition: a human (or human committee) defined what the agent is permitted to do — the systems it may access, the actions it may take, the boundaries it may not cross. 3. Tier escalation: for actions above the agent's autonomous tier, a human approved the specific action or the class of actions. The approval is logged with full context. 4. Exception handling: when the agent encounters situations outside its mandate, the escalation path routes to a human — not to the agent's own judgment about whether to proceed.
This chain doesn't mean humans approve every action — that would defeat the purpose of autonomy. It means every action occurs within a scope that a human defined, under conditions a human established, with oversight a human designed. The autonomy is real but bounded. The bounds are human.
Governance Artifacts That Matter
Boards and regulators are converging on a set of expected governance artifacts for AI agent deployments. Organizations should produce these proactively:
Agent registry. A complete inventory of deployed agents: what each does, who owns it, what systems it accesses, when it was last reviewed. Most organizations cannot produce this today. Regulators will soon require it.
Risk assessment per agent. Not a generic AI risk assessment — a specific analysis per agent covering: what could go wrong, what the blast radius is, what controls mitigate the risk, and what residual risk the business accepts. Updated when the agent's mandate, model, or environment changes.
Incident response plan. When an agent misbehaves — and eventually one will — the response plan should specify: who gets notified, how the agent is contained (kill switch procedures), how the blast radius is assessed, and how the root cause is determined. Tabletop exercises for agent incidents, analogous to cybersecurity incident response drills, are emerging as best practice.
Audit trail. Immutable, comprehensive logging of agent actions, entitlement evaluations, and human authorizations. This isn't just for forensics — it's the evidence that the governance framework actually operates. An auditor's first question will be "show me the logs." The second will be "show me that someone reviews them."
The Board Conversation
For directors, the governance question distills to three inquiries of management: What AI agents are operating in our environment with the ability to take autonomous actions? What is the authorization framework governing those actions? And who is accountable when — not if — an agent exceeds its intended scope?
Management teams that can answer these crisply are governing well. Those that respond with generalities about "responsible AI principles" are not. The difference will become visible the first time something goes wrong — and in the regulatory examination that follows.
The accountability vacuum around AI agents is a temporary condition. Regulation, litigation, and board pressure will fill it. Organizations that build governance proactively will experience this as validation. Those that wait will experience it as crisis.