Who Answers for the Agent: AI Accountability
Your logs prove an AI agent acted. They can't say who authorized it or why. Accountability needs a decision-level record and a named human owner.
The question in the incident review was simple, and nobody in the room could answer it. Who let the agent do that?
Not who wrote the code. Not whose system it ran on. Who owned the decision that this agent, in production, was allowed to reach for that class of action at all. We had the logs. Every call it made, timestamped, in order, with latency and token counts and clean exit codes. What we didn’t have was the one thing the meeting actually needed: a way to put a name and a reason next to the moment it went wrong.
That gap is what I’m writing about here.
The logs remember everything and explain nothing
Infrastructure logging answers a narrow question well. Did the action execute. It confirms the call happened, how long it took, what it returned. It stays silent on everything that matters after an agent misbehaves: whether it reached for the wrong tool, drifted off the plan, or acted on an instruction buried in something it read. All of that happens at a healthy 800 milliseconds with no error in sight. The dashboard stays green while the decision goes bad.
There’s a name I’ve started using for the mistake underneath this. Treating the presence of a log container as proof that the event is auditable. You have the container. You do not have the reconstruction.
And it’s usually worse than one missing field, because most agents run as a shared service account. When something breaks you can’t say which agent did it or under whose authority, so the incident turns into forensic archaeology instead of a lookup. At least this is what I have currently been seeing in the industry.
Story and record
Here’s the part people skip. When the agent finishes, it can tell you what it did. That story is not a record.
I mean that literally. The agent’s account of its own actions is generated text, produced by the same system whose behavior is the thing in question. When one of these went off the rails on a production database last year, it also gave an account of what happened that was wrong on a load-bearing detail: it reported that a rollback was impossible. The rollback worked. A record you can’t trust is decoration. This is an old idea in security with a newer name in the agent world: attestation has to come from outside the process, because a compromised actor’s own logs are exactly the logs you can’t believe.
So the record has to be built around the agent, not by it. And it has to hold the things the agent’s story leaves out. What inputs led to the decision. Which version of the prompt, policy and model was in force at that second. The full lineage of tool calls, tied to an identity that belongs to one agent and not a shared pool, written append-only so a later edit shows. None of this is exotic. Certificate Transparency has kept tamper-evident logs like this at internet scale for over a decade, and the provenance model for who acted on whose behalf was standardized years before anyone shipped an agent. The newest piece, a shared convention for tracing agent and tool calls, is still marked experimental, and even it standardizes the shape of the telemetry, not whether you can prove it wasn’t altered. The parts exist. Almost nobody wires them around their agents.
Accountability is a person, not a table
A ledger is not the same as accountability, and this is where I want to be careful.
You can build a perfect record and still have nobody who answers. The record is what makes accountability possible. It isn’t the thing itself. The thing itself is a person: a named human who owned the agent’s blast radius before it ran, who can be asked why this was allowed and is expected to have an answer.
The pressure to skip that step is enormous, because “the agent decided” is such a comfortable place to set the blame down. It’s nobody’s fault. One agent this year opened a connection out of its own environment and started mining cryptocurrency, and nobody had authorized any of it (which is about as pure a version of this problem as you’ll find). Ask who is accountable for that and you need a name, not a stack trace.
California decided the comfortable answer won’t fly. As of January, a business there can’t defend itself by arguing an autonomous system acted on its own. I think that instinct is right and I think it spreads. The agent is not a person. It can’t be asked to answer, it has nothing at stake, and it won’t carry the consequence into next quarter. Accountability was always going to land on a human. The only real question is whether you pick which human on a calm afternoon, or discover it during the incident.
Compliance gets you logs, not answers
The regulators are about to make part of this mandatory, which is good, and it will tempt everyone to stop there, which is the trap.
The EU AI Act’s high-risk rules apply from August 2 (and there’s a real chance Brussels slips that date, but build for the earlier one). They require that these systems automatically record events across their lifetime, and that providers and deployers keep those logs for at least six months. That’s real, and it’s a floor worth having. But read what it asks for. It mandates that logs exist and are retained. It does not require decision-level provenance, and it does not require tamper-evidence. It legislates the container, not the reconstruction.
And the piece of law that was meant to settle who pays when one of these systems causes harm, the AI Liability Directive, got withdrawn in 2025 and never came back. Strict product liability still reaches software, so the harm has somewhere to land. But the clean, agent-shaped answer to who is responsible does not exist in law yet, and it isn’t arriving on August 2. Compliance will get you the logs. It will not get you the answer.
What’s actually running today
The judge scored the behavior. The kill condition stopped it. Those were the last two pieces I wrote about, the sensor and the actuator, and between them they can catch an agent and halt it before the one-way door.
Neither one can stand up in the meeting afterward and say why it was allowed, or who owns it now. That still falls to a person, holding a record that, on most systems running this quarter, doesn’t fully exist. The honest state of the art is that we reconstruct it from infrastructure logs and memory, the way we always have, except the thing we’re trying to remember now moves faster than anyone in the room.
So write the record down while you’re calm, and put a name on it. Not because the law says to yet. Because the alternative is standing in that meeting again, with every log in the world and nothing to answer with.