The question your board will ask after the first agent mistake

Picture the board meeting six months from now.

An AI agent did something it should not have. It sent a contract to the wrong customer, or deleted a quarter of records, or gave a refund nobody asked for. The damage is contained. The logs are perfect. Everyone knows exactly what happened, down to the second.

Then a director asks one question. "Who approved that?"

Silence.

Not because anyone is hiding something. Because nobody knows. The access was granted in a ticket two years ago. The task was approved in a chat thread. The permission to act without asking was a checkbox somebody ticked during a pilot. Three people, three systems, no record that connects them.

That silence is the real AI incident. Not the mistake. The fact that nobody can stand up and say who allowed it.

Here is our view. Companies are managing agents like software. They should be managing them like staff with signing authority.

Every company can tell you who is allowed to sign a large contract. There is a policy, a limit, a name, a paper trail. Ask the same company who is allowed to let an agent act on customer data without a human in the loop, and you get a shrug.

Logs are the security camera. They show what happened. What is missing is the signature: who said yes, under which rule, and when.

And the camera usually belongs to the system that acted. If you are being investigated, you do not get to keep the only copy of the evidence. Neither should your platforms.

What we would do on Monday: pick the one agent in your company that can do the most damage. Ask your team to show you, in writing, who approved what it is allowed to do. Time how long it takes.

That number is your real exposure.

← All perspectives