Who Is Accountable When an AI Agent Acts?

Agentic AI changes the governance question. A model may recommend, but an agent can retrieve data, call tools, update systems and trigger actions.

Why does this matter?
Because once AI moves from suggesting to acting, the risk changes. The organisation needs to know not only what happened, but who allowed the action to happen.

Who authorised the agent to act?
Every enterprise agent should have a clear chain of authority:
Business Owner → Policy → Agent → Tool → Action
The agent itself cannot hold accountability. That remains with the organisation.

What should we know after an agent acts?

We should be able to answer:
Which agent acted? What permissions did it have? What tools did it use? What evidence influenced the decision? Who owns the outcome?

Should every agent be fully autonomous?
Probably not.
Autonomy should increase gradually:
Observe → Recommend → Prepare → Approve → Act
Different processes should stop at different levels depending on risk.

My Perspective
I believe the real challenge of Agentic AI is not making agents more
autonomous. It is designing controlled autonomy.
The future enterprise will need to define exactly what an agent is allowed to see, decide and do  and where human authority must remain.
For me, the key question is not:
“Can the agent do this?”
It is:
“Should the agent be allowed to do this, and who remains accountable when it does?”
 

Agibank moves from isolated banking agents to a “superagent”


What was built : Brazilian digital bank Agibank is consolidating six specialised AI agents and 11 existing bots behind a supervisory agent on WhatsApp. Its specialised agents currently handle around 70,000 inquiries autonomously per month. Customers can move from a loan query to an account question or retention request without restarting the conversation. [More Info]
 

How it works : The superagent first verifies customer identity, then retrieves relevant account information, banking products and opportunities. Salesforce's reasoning engine interprets intent, but routing is combined with Agibank business rules and a deterministic backend route table. Requests are delegated to bounded agents covering areas such as loan status, FAQs, sales qualification, retention and account servicing. Compliance- or fraud-related conversations can be forced to a human representative. Context travels with the customer as they move between agents.
 

Why it matters : We have seen plenty of multi-agent demos. This is more interesting because it shows the organisational architecture appearing in a regulated environment: one orchestration layer, specialised domain agents, customer identity, persistent context, deterministic routing and human escalation.

Enterprise takeaway — The scalable multi-agent model may resemble microservices more than a swarm of autonomous agents. Give individual agents limited domains, clearly defined interfaces and specific permissions; make the orchestration layer responsible for intent and delegation.
 

My Angle:  Agents may soon become domain services, much like microservices, with both requiring clear contracts, authentication, permissions, versioning, monitoring, fallback behaviour and routing policies.