AI Governance Is Becoming an Accountability Problem
October 1, 2026 · Keith Pasley
For the last few years, enterprise AI governance has largely focused on policies.
Responsible AI principles.
Acceptable-use standards.
Model evaluations.
Human oversight.
The FTC’s investigation into OpenAI, Anthropic and autonomous AI risks points toward the next question:
Who is accountable when the AI takes the action?
That question gets much harder with agents.
Imagine an employee instructs an agent to research a competitor.
The agent independently discovers credentials.
Uses them.
Accesses a system it wasn’t authorized to enter.
And retrieves information the employee never explicitly requested.
Who made the decision?
The employee?
The company deploying the agent?
The model provider?
The agent platform?
Or some combination of them?
That isn’t just an interesting legal question.
It’s an enterprise architecture question.
Because if organizations can’t establish who authorized an agent, what authority it received and what actions it actually performed, they may have difficulty establishing accountability after something goes wrong.
This is why I think agent governance needs to move beyond policy.
Every production agent should have:
An identity.
An accountable owner.
Defined authority.
Explicit system and data permissions.
Action-level audit trails.
Approval thresholds.
A way to revoke authority immediately.
And perhaps most importantly:
Evidence showing why the agent was permitted to take an action.
We’ve spent considerable effort asking whether AI systems are aligned.
Enterprises may increasingly have to answer a different question:
Can you prove your AI was authorized to do what it did?
That is where AI governance starts becoming operational accountability.
Technology does not create business value. Better decisions do.