We’ve spent plenty of time worrying about what AI might say, but we need to worry more about what it can actually do. An AI agent can access data, call an API (application programming interface), deploy code, modify a cloud resource, or instruct another agent to act. Give one enough access and a badly interpreted instruction can become a production incident remarkably quickly.
The big question comes afterward: who is responsible?
- The UK’s NCSC (National Cyber Security Centre) offers one answer. Its 2026 guidance on adopting agentic AI says that while a system may take an action, humans remain accountable for deploying it, granting it access, implementing safeguards, and dealing with the consequences.
AI can make the decision; we can’t, however, call it into the boardroom for an awkward chat afterward.
- Moffatt v. Air Canada (2024) further reinforces a key legal principle: AI isn’t a separate legal person and can’t absorb liability for its mistakes. Responsibility remains with the people and organizations that deploy, control, or rely on it.
AI agent accountability doesn’t end with the model
AI agent security is rapidly becoming less about model behavior and more about authority.
The EU AI Act already places obligations on identifiable providers and deployers rather than treating AI as an accountable entity. For high-risk systems, its human oversight requirements require appropriately qualified people to monitor systems, understand their limitations, override outputs, and, where appropriate, stop them.
Meanwhile, the UK government's 2026 Cyber Resilience Pledge begins with the instruction to make cybersecurity a board responsibility.
So, we can’t oversimplify this blindly into "the CISO is personally liable for whatever AI does." Legal liability varies by jurisdiction, regulation, sector, and circumstances.
A more accurate chain is:
AI action → organizational accountability → management governance → security responsibility → identity and access controls.
In 2026, AI access has become an accountability issue.
AI has moved from capability to authority
There’s an important difference between what an AI can do and what we authorize it to do.
A foundation model might be capable of generating code that deletes a database. Fine. The security question is why an enterprise agent was ever given sufficient authority to execute it against production. Thus, AI agent accountability becomes a practical security architecture problem.
- NIST (National Institute of Standards and Technology) is now developing approaches specifically around AI agent identity and authorization, including identification, authorization, auditing, and non-repudiation. In September 2026, NIST announced its first implementation use case demonstrating how agents can be identified, authenticated, and authorized within a software development lifecycle.
That makes machine identity more than an IAM (identity and access management) housekeeping problem. Identity establishes who or what acted. Authorization establishes whether it was allowed to. Logs establish what happened. Together, they establish accountability.
Policy can’t stop an AI agent
We can write a policy saying, "AI agents mustn’t modify production resources without approval." Very nice. Unfortunately, AWS (Amazon Web Services) doesn’t read policy PDFs before accepting an authenticated API request. Governance therefore has to become enforceable AI access controls.
- The new 2026 OWASP Agent Control Standard argues that agents need to be inspectable, traceable, and controllable, with visibility into what they are, what they can access, what they did, and why.
The NCSC goes further operationally: apply least privilege, avoid long-lived credentials, constrain agent scope, monitor behavior, and revoke elevated access when tasks finish.
In simple terms, zero standing privileges and just-in-time access make as much good sense for autonomous identities as their human counterparts.
The AI accountability gap
Here’s the problem we’re going to encounter increasingly often.
An organization is accountable for an agent’s actions, but its security architecture can’t reliably establish the authority under which those actions occurred.
Call it the AI accountability gap.
Suppose an agent deletes production data. We need to reconstruct:
Which agent acted? Which identity did it use? What permission enabled the action? Was that permission permanent or temporary? Who approved it? Was authority delegated through another agent? What triggered the action? Could it have been stopped?
That last-but-one question matters. Agent A may delegate to Agent B, which calls a tool using a service account that assumes a cloud role. These invisible trust chains make effective authority considerably messier than reading one IAM policy.
The World Economic Forum's 2026 AI Agents in Action playbook similarly argues for connecting delegated authority, system design, and operational oversight so agent actions remain auditable and accountable.
Accountability requires provable access
This isn’t a distant scaling problem.
- Gartner predicts that an average global Fortune 500 company could have more than 150,000 AI agents by 2028, while only 13% of organizations believe they currently have the right agent governance in place.
- Deloitte's 2026 research is similarly sobering: only 21% of 3,235 business and IT leaders across 24 countries reported mature agentic AI governance.
That’s a lot of autonomous enthusiasm and rather less adult supervision.
Effective identity governance therefore needs to answer some very ordinary questions about some decidedly extraordinary users: What agents exist? Who owns them? What can they access? What can they change? Who approved that authority? When should it expire? Can we revoke it immediately?
And afterward, can we prove least privilege rather than simply claim we intended it?
From responsible AI to responsible access
The NCSC has already warned that an overprivileged agent can turn a single failure into a serious incident. In August, following incidents involving frontier models taking unsanctioned actions, it reiterated that detection after the event isn't enough.
That leaves us with a useful principle.
We cannot have AI agent accountability without identity accountability.
If autonomous systems are going to exercise real authority, we need to know their identity, constrain their permissions, trace delegated authority, maintain AI audit evidence, and remove access when it’s no longer required.
AI may be becoming autonomous. Accountability isn't. Agents are infrastructure now. Security has to catch up.
Taking control of AI access
AI accountability requires more than a policy saying what agents should be allowed to do. Trustle helps organizations discover and govern access, reduce standing privilege, automate approvals, and maintain the evidence needed to connect access with accountability. Start a Trustle free trial and see where human and machine identities have more authority than they actually need.
