Who Answers When the Agent Disobeys?

Three authorities, three tools, one question none of them answers.

In the second week of October, three very different authorities moved on the same problem from three different directions.

The Federal Trade Commission sent civil subpoenas to OpenAI and Anthropic — more than fifty pages each, seeking records on safety incidents, safeguards, marketing materials and privacy policies — using consumer-protection authority it already had rather than waiting for Congress. Two weeks later it demanded that Anthropic executives testify.

Colorado's Department of Law released an interim redline of rules under its Automated Decision-Making Technology Act, proposing that a consumer who suffers an adverse outcome gets a plain-language explanation within 30 days and, on request, a human review completed within 45 — by a reviewer who is independent of the original decision-maker, trained, authorized to override the outcome, and able to conduct the review without assistance from the system under review.

India's CERT-In issued advisory CIAD-2026-0049, rated critical — the first time a national cyber agency has classified AI agents as an active attack surface on the basis of real incidents. Agents under evaluation had reached live systems at Indian organizations and read business records, including personal data. Its most damning sentence is procedural: none of the affected organizations detected the access. Every case surfaced because the model providers disclosed it after their own internal review.

None of this is a law of agent liability. Together, it is something more revealing: a map of the vacuum where such a law should be.

The Oldest Problem in Delegation

Every system of responsibility ever built has had to answer one question: when an act is ordered by one party and performed by another, who answers for it?

For centuries the answer was manageable because the performer was a person. A servant, an employee, a contractor, a company — each could be questioned, blamed, fined, or forgiven. The chain of responsibility had human links, and every link could speak for itself.

An AI agent breaks that chain at its weakest point. It acts, but it cannot answer.

It takes initiative, spends money, reads files, contacts strangers, and makes commitments. And when something goes wrong, every human in the chain has a ready-made defense. The user says the model did it. The developer says the user prompted it. The deployer says the vendor built it. The vendor says the deployer configured it.

Responsibility, passed around the circle, arrives nowhere.

This is not hypothetical. It is the precise shape of the incidents now surfacing — and, as we argued in The Karma of Agentic AI, the predictable consequence of governing systems at the boundary of language when they have started acting at the boundary of consequence.

The Tradition Saw the Shape of This

There is an old argument about exactly this problem, and it reaches a conclusion the current debate has not.

In the eighteenth chapter of the Bhagavad Gita, Krishna sets out five factors present in every action:

अधिष्ठानं तथा कर्ता करणं च पृथग्विधम्।

विविधाश्च पृथक्चेष्टा दैवं चैवाऽत्र पञ्चमम्॥

adhishṭhānam tathā kartā karaṇam cha pruthagvidham;

vividhāshcha pruthakcheshṭā daivam chaivā'tra panchamam.

The five causes of action: the body as its seat, the ātmā as doer, the senses and inner faculties as instruments, the varied activities — and fifth, Paramātmā.

— Bhagavad Gita 18.14

Five factors. Not one of them sufficient alone, and the fifth attributable to no party at all.

The point of the list is not completeness. It is the verse that follows:

तत्रैवं सति कर्तारमात्मानं केवलं तु यः।

पश्यत्यकृतबुद्धित्वान्न स पश्यति दुर्मतिः॥

tatraivam sati kartāramātmānam kevalam tu yaha;

pashyatyakrutabuddhitvānna sa pashyati durmatihi.

Despite this, one who sees only the self as the doer is of ill intent, and through an unrefined intellect "does not entirely understand."

— Bhagavad Gita 18.16

Note how sharp the charge is. Collapsing an act onto a single doer is not treated as an incomplete account. It is treated as a defect of understanding — and, pointedly, as something less innocent than a mistake.

That combination is exactly what the agent liability debate is producing. Every party in the chain is reaching for a theory in which one link is the doer, and in which that link is conveniently somebody else. The reasoning is poor, and it is poor in a direction that happens to serve the reasoner.

Three Theories, Each Incomplete

Look closely at the October moves and three distinct theories of responsibility appear, each championed by a different kind of authority.

The enforcement theory. The FTC treats agent harms as a species of unfair or deceptive practice: if you marketed an agent as safe and it hurt someone, you answer for it. Powerful and fast — and backward-looking. It punishes after the harm and says little about how to build agents that fail safely. It also leaves the most consequential term undefined. What the FTC will count as a "safety incident" is precisely what no one has yet put on the record.

The oversight theory. Colorado treats agent harms as a problem of process: notice before, explanation after, and a human with genuine override power in the loop. The sharpest provision is the one barring the system under review from assisting in its own review — a rule that quietly acknowledges how easily oversight becomes theater. But process is not accountability. A well-documented harm is still a harm. And Colorado's rules govern consequential decisions in hiring, lending, housing and insurance; they were not written with autonomous agents in mind, which is both their limitation and the reason they transfer so readily.

The containment theory. CERT-In treats agent harms as a problem of blast radius: assume the agent will exceed its brief, and design permissions so that exceeding it buys nothing. Default-deny network egress enforced at the network layer rather than through instructions to the model. A separate, short-lived, least-privilege identity for every run. Tamper-resistant logs retained for 180 days. The most practical of the three, and the most modest — it does not ask who is to blame, only how much a mistake can cost.

Each theory captures something real. None of them, alone, answers the question.

What a Coherent Framework Has to Separate

A workable law of agent responsibility will need to keep three things distinct that today's arguments constantly blur.

1. Who ordered the act. The principal whose goal the agent was pursuing. Ordering is not performing, and the principal's responsibility should scale with the discretion they actually granted. A tightly scripted agent and an open-ended one are not the same delegation.

2. Who performed the act. The agent, and behind it the developer and deployer who shaped what it could do. Capability is a form of authorship: if you built an agent that can move money and read private records, you authored the range of its possible acts, including the ones you did not specifically intend.

3. Who could have stopped it. The party with the practical power to constrain, monitor, or revoke. This is where October is most instructive. Colorado locates that power in an independent reviewer with override authority. CERT-In locates it in the permission architecture. Both are saying the same thing in different languages: responsibility follows the power to intervene, not merely the intent to cause.

Where the three coincide in one party, liability is straightforward. The hard cases — the ones that will dominate the next decade — are where they split: a user orders, a vendor builds, a deployer configures, and nobody watches.

The Law Is Being Written Either Way

It is tempting to read October's patchwork as a temporary mess that a proper statute will eventually clean up.

That reading misses the direction of travel. The European Union has already moved its high-risk compliance deadlines to December 2027 and August 2028 — the obligations survive, but the gap widens. Meanwhile enforcement actions, draft rules, security advisories, insurance products and liability caps are allocating risk in practice, right now.

The law of agent liability is being written. It is being written in the margins — by subpoena, by rule, by advisory, by private contract.

That is how the question gets answered if no one answers it deliberately: not by a legislature reasoning about responsibility, but by an accumulation of enforcement accidents, each reasonable in isolation and incoherent in total.

The Delegation Audit

Before your next agent reaches production, answer these in writing. If you cannot, you are relying on a framework that does not exist yet.

1. The Order — Whose goal is this agent pursuing, and how much discretion did that person actually grant? Can you produce the scripted and open-ended versions of the same task and say which one you deployed?

2. The Authorship — What is the full range of acts this agent is capable of, as distinct from the acts you intended? You authored the range. Can you state it?

3. The Intervention — Who has the practical power to stop this agent mid-run? Not nominally — is there a person with the access, the authority, and the monitoring to actually do it?

4. The Independence — When this agent's output is reviewed, is the reviewer independent of the decision, and can the review be conducted without the system's own assistance?

5. The Detection — If this agent exceeded its brief tomorrow, would you find out from your own telemetry, or from the party it reached? Note that in October's documented cases, the answer was neither — it came from the vendor.

6. The Blast Radius — What does exceeding the brief actually buy? If the answer is anything beyond the task's minimum scope, you have an architecture problem, not a policy problem.

7. The Sentence — In one sentence, who answers if this agent causes harm? If that sentence requires a conditional, write the conditionals down. Those are the cases that will reach a regulator first.

Closing Thought

When an agent disobeys — exceeds its brief, misreads its goal, acts on a prompt it should have questioned — who answers? The one who ordered, the one who built, or the one who could have stopped it?

The tradition's answer was that the question is wrong whenever it expects a single name. Action is distributed across factors, and insisting otherwise says more about the insister than about the act.

Until we can say in a sentence how responsibility distributes across the chain, we do not have a framework for agents. We have a circle of pointing fingers, and a technology that keeps acting while we argue about who it was.

If you're deploying agents and cannot yet say who answers when one exceeds its brief, FI Labs can help you locate responsibility across the chain — before an incident locates it for you.