Agent accountability
AI agent accountability: who answers for an agent when nobody created it on purpose.
Ownership is the control everything else depends on, and it is the one most organisations discover they do not have. This page covers what agent accountability actually means, why agents arrive unowned, what a usable register contains, how to assign owners without stalling the programme, and how to measure whether oversight is real or ceremonial.
Six fields a register needs
Demonstration tenantA team or a mailbox is not an owner. The test is whether somebody would answer if the agent caused an incident at three in the morning.
AI agent accountability is the practice of ensuring every autonomous agent has a named person answerable for its existence, a declared and approved purpose, a defined autonomy tier, and a scoped identity of its own — so that when the agent acts, there is someone to ask and something to revoke. It is distinct from monitoring: telemetry tells you what an agent did, accountability tells you who has to answer for it.
Why agents arrive unowned
This is not negligence. It is the predictable result of how agents get created, and understanding the mechanism is what stops the fix being a memo.
Copilot Studio, Microsoft 365 Agent Builder and Power Platform were bought, reviewed and rolled out. Publishing an agent inside them requires no further approval, because the platform itself was the approval. Nothing in the process asks who will own the result.
The person who built an agent is usually the person who needed it that week. They are not accountable for it in any governance sense, they may move team, and they will not be consulted when it misbehaves eighteen months later.
When an employee leaves, HR fires a signal and access is removed. When an agent’s purpose expires, nothing fires. The agent keeps running, keeps holding its connectors, and keeps appearing in no review.
The same agent promoted through dev, test and production appears three times in a raw platform read. Counting rows describes the manifest rather than the estate, which is how a programme ends up reviewing three hundred entries that represent a hundred agents — and abandons the exercise.
What accountability actually requires
Six fields. A register that carries fewer than these cannot be used to make a decision, which is why most agent inventories are read once and never opened again.
- A named business owner. A person, not a team and not a mailbox. The test is whether someone would actually pick up the phone.
- A named security owner. Often different from the business owner, and responsible for the agent’s reach rather than its output.
- A declared purpose, signed. What the agent is for, in a sentence, agreed by the owner. Unsigned purposes drift; signed ones can be checked against what the agent actually does.
- An autonomy tier. What the agent can do, derived from platform signals rather than self-declared — read only, act on systems, act without confirmation.
- Its own machine identity. An agent running as its creator cannot be scoped or revoked independently of that person’s account.
- A recorded decision. Approved, declined or deferred, with a reason and a date. “Undecided” is a legitimate state; absent is not.
Assigning owners without stalling the programme
The failure mode is trying to own everything at once, producing a spreadsheet nobody completes. Four rules make it tractable.
Some decisions close a great deal of exposure and most close almost none. Three decisions on agents that can write and egress are worth more than thirty on read-only assistants, and a ranked queue is what makes the first week productive.
An empty field gets left empty. A proposed name drawn from platform data — creator, environment owner, connector owner — converts the task from authorship to confirmation, which people will actually do.
A reasoned exception with a named person and a date is governance. Forcing every agent to be approved produces false approvals, which are worse than recorded refusals because they look clean in an audit.
Risk appetite, tiering thresholds and what counts as acceptable autonomy belong to the business and the board. A CIO who absorbs those decisions takes unbounded liability for judgements they do not make, and lets the business skip the work.
Human-in-the-loop is not a control until you measure it
Almost every AI governance programme leans on human oversight as its primary accountability control, and almost none instruments it. The result is a control that is assumed to work and never tested.
- Approval volume per reviewer. Past a certain rate, review becomes acknowledgement. The number at which that happens is knowable for your organisation and almost never measured.
- Override rate, and whether overrides catch anything. An override rate near zero means either the agent is excellent or the reviewer has stopped reading. Those two look identical on a dashboard and require different responses.
- Time to decision. Approvals granted in under a few seconds, repeatedly, are not reviews.
- Coverage of the decisions that matter. Whether human review sits at the irreversible actions — write, delete, egress — or at whichever step happened to be easy to instrument.
Drawing the review line at irreversibility rather than at a risk score is the more operable rule, because irreversibility is a property of what an agent can reach and is therefore visible in configuration before anything goes wrong.
What the frameworks ask for
Accountability is not only good practice; it is the specific thing several frameworks now require, and the one most programmes cannot evidence.
- EU AI Act. An inventory of AI systems, a risk classification for each, and records a regulator could inspect. Without an owner per system, none of the later obligations are reachable.
- ISO/IEC 42001. An AI management system with defined roles and responsibilities — which is accountability written as a clause.
- NIST AI RMF. The Govern function is explicit that accountability structures come before measurement and management.
- SOC 2 and ISO 27001. Access governance requirements that apply to non-human identities in principle, and are rarely sampled against them in practice.
How Govern360 handles it
Read-only, from your management APIs. Roughly thirty minutes to connect, first score within twenty-four hours, nothing installed and nothing in your traffic path.
Every agent appears because it exists, not because someone declared it. Replicas are distinguished from genuine duplicates, so the queue reflects the estate rather than the manifest.
Each entry carries its finding, its reach, an exposure weight and a proposed owner drawn from platform data. A human confirms or rejects; the decision, the reason and the date are recorded in a hash-chained audit log.
The Purpose Register holds the signed statement and checks it for drift. Autonomy tiers are derived from platform signals rather than self-declared. Agents holding no machine identity are reported as such, because that is the population conventional identity tooling cannot see.
Controls compile into Purview, Intune, your SASE and your AI gateway, and applied state is read back where the platform exposes a read path — reported as Compiled, Marked applied or Verified rather than as a single green tick. An Agent Passport export gives one agent on one page for an auditor or a board.
What this page does not claim. Govern360 reads management APIs and configuration. It can tell you an agent exists, what it is scoped to reach, whether anyone owns it and what it costs — it does not observe what the agent did at run time, and the published coverage matrix says so. Deciding in the register records what a person concluded; it changes nothing about the agent and closes no exposure on its own. Figures attributed to a connected estate come from a demonstration tenant, not a customer.
Questions, answered
What is AI agent accountability?
It is ensuring every autonomous agent has a named person answerable for it, a declared and approved purpose, a defined autonomy tier and its own scoped identity. Monitoring tells you what an agent did; accountability tells you who has to answer for it and what can be revoked.
Who is responsible for an AI agent nobody created on purpose?
Until someone is named, it defaults to whoever signed off the platform it was built in — usually the CIO or CISO, by omission rather than decision. That is why the first useful step is a register that proposes an accountable person and forces a human to confirm or reject.
What should an AI agent register contain?
Six fields: named business owner, named security owner, signed purpose, autonomy tier, machine identity, and a recorded decision with a reason and a date. A register with fewer than these cannot support a decision, which is why most are read once and abandoned.
How do you assign owners to hundreds of agents without stalling?
Rank by how much exposure each decision closes rather than alphabetically, propose an owner from platform data instead of leaving a blank field, and allow a reasoned decline as a legitimate outcome. Three decisions on agents that can write and send data out are worth more than thirty on read-only assistants.
Is a team or a mailbox an acceptable owner?
No. The test is whether somebody would actually answer if the agent caused an incident at three in the morning. A distribution list fails that test, and an auditor will treat it as an unowned system.
How do you measure whether human oversight is real?
Instrument the supervision itself: approval volume per reviewer, override rate and whether overrides catch anything, time to decision, and whether review sits at the irreversible actions rather than the convenient ones. An override rate near zero means either the agent is excellent or nobody is reading, and those look identical on a dashboard.
Which AI agents need human approval?
Draw the line at irreversibility rather than at a risk score. An agent that can only read and summarise needs a different control load from one holding a write path, a deletion permission or a route out of the tenant — and irreversibility is visible in configuration before anything goes wrong.
Does the EU AI Act require named ownership?
It requires an inventory, a risk classification per system and records a regulator could inspect. In practice those are unreachable without an accountable person per system, which is why ownership is the dependency for the rest of the obligations rather than a separate task.
Why do agentic AI programmes stall after launch?
Commonly because oversight quality degrades quietly. Approvers rubber-stamp at volume, overrides stop catching errors, and nobody measures either — so the programme looks governed right up until an audit or an incident says otherwise.
See it on your own estate.
Thirty minutes to connect, read-only, no proxy. Every agent, which ones are acting autonomously, which have nobody accountable, and a ranked list of what to decide first — within twenty-four hours.
Get my AI Exposure Score