The Accountability Void at the Heart of the Agentic Enterprise
There is a legal case that every enterprise deploying AI agents should study. In 2024, a Canadian court ruled against Air Canada after its AI chatbot provided a passenger with incorrect information about bereavement fares—information that the airline subsequently refused to honour. The court's reasoning was unambiguous: Air Canada was responsible for the representations made by its AI system, regardless of whether those representations were made by a human employee or an automated agent. The airline's attempt to disclaim responsibility for its own chatbot's outputs was rejected.
The Moffatt v. Air Canada case involved a relatively simple AI system—a customer service chatbot with limited capabilities and a narrow scope of action. The agentic AI systems being deployed in enterprise environments in 2026 are categorically more complex: they can plan multi-step workflows, delegate tasks to sub-agents, access sensitive data systems, execute financial transactions, and operate continuously without human supervision. The accountability questions raised by these systems are correspondingly more complex—and the legal frameworks for resolving them are correspondingly less developed.
This is the governance gap. It is not primarily a technical problem. The technical capabilities of agentic AI systems are advancing rapidly, and the engineering community has developed sophisticated approaches to agent architecture, safety constraints, and monitoring. The gap is organisational and legal: the structures of accountability, oversight, and liability that govern enterprise operations were designed for a world of passive tools and human decision-makers. They are not adequate for a world of autonomous agents that perceive, reason, and act.
What Makes Agentic AI Categorically Different
From Tools to Actors
The distinction between a tool and an actor is not merely semantic. A tool does what it is told, when it is told, by a human who bears responsibility for the decision to use it. An actor perceives its environment, forms intentions, makes decisions, and takes actions—and the chain of responsibility for those actions is correspondingly more complex.
Agentic AI systems in 2026 are actors in this meaningful sense. They are persistent—they operate continuously, not just when invoked. They are delegated—they are granted authority to commit resources, access systems, and take actions on behalf of their principals. They are autonomous—they make decisions within their delegated scope without requiring human approval for each action. And they are capable of delegation themselves—in multi-agent architectures, a primary agent can spawn sub-agents, delegate tasks to them, and coordinate their outputs, creating chains of autonomous action that may be difficult to trace or audit.
These characteristics create accountability structures that have no clear precedent in existing organisational or legal frameworks. When a human employee makes a consequential error, the chain of responsibility is relatively clear: the employee, their manager, and ultimately the organisation bear responsibility in proportion to their roles and the degree of oversight exercised. When an AI agent makes a consequential error—particularly in a multi-agent pipeline where the error may have propagated through several layers of delegation—the chain of responsibility is far less clear.
When an AI agent makes a consequential error—misrepresenting a refund policy, executing an unauthorised transaction, or delegating a task to a sub-agent that causes harm—the question of who is responsible is not merely philosophical. It is a legal question that courts are now being asked to answer.
The Specific Risks of Multi-Agent Systems
When an AI agent makes a consequential error—misrepresenting a refund policy, executing an unauthorised transaction, or delegating a task to a sub-agent that causes harm—the question of who is responsible is not merely philosophical. It is a legal question that courts are now being asked to answer.
The governance challenges of individual AI agents are significant. The governance challenges of multi-agent systems—networks of agents that interact, delegate, and coordinate—are substantially greater. Research from the Cloud Security Alliance identifies several categories of risk that are specific to or amplified by multi-agent architectures.
Loss of execution control is the most fundamental: in a multi-agent pipeline, individual agents may take actions outside their intended scope, particularly when task delegation occurs without adequate human visibility. The primary agent may have been designed with appropriate constraints, but sub-agents spawned to handle specific tasks may operate with different constraint sets, creating gaps in the overall governance architecture.
Goal hijacking—the diversion of an agent from its original objectives through adversarial inputs—is a technical vulnerability with significant governance implications. The "EchoLeak" vulnerability, which demonstrated that agents could be manipulated by external inputs embedded in the data they process, illustrates that traditional security perimeters are insufficient for agentic systems. An agent that processes external documents, emails, or web content is potentially exposed to adversarial inputs designed to redirect its behaviour—a threat that requires data-level and logic-level validation, not just network-level security.
Retirement debt is a governance failure mode that is easy to overlook: agents that remain active after their intended lifecycle concludes continue to access systems with stale permissions, representing a significant security vulnerability. In organisations that have deployed multiple agents over time, the accumulation of retired-but-active agents with outdated access rights creates a substantial attack surface.
The Shadow AI Problem: A Symptom of Governance Failure
Approximately 52% of employees report using unauthorised AI tools in their work environments. This statistic is frequently cited as evidence of a security problem—and it is. But it is also evidence of a governance failure of a different kind: the failure to provide employees with AI tools that are useful enough to compete with the unauthorised alternatives they are choosing instead.
The 52% of employees who report using unauthorised AI tools are not rogue actors—they are rational responders to an environment where official AI tools are too restricted to be useful. Shadow AI is a symptom of governance failure, not a cause of it.
Shadow AI—the use of AI tools outside official channels and without organisational visibility—creates "black box" entities that interact with corporate environments undetected. These tools may process sensitive data, generate outputs that influence business decisions, and create dependencies that are invisible to the organisation's risk management function. The governance challenge is not simply to detect and prohibit shadow AI use, but to understand why employees are choosing unauthorised tools and to provide authorised alternatives that meet their needs.
This requires a more sophisticated approach to AI governance than simple prohibition. Organisations that respond to shadow AI primarily through restriction—blocking access to unauthorised tools, monitoring employee behaviour, imposing penalties for non-compliance—typically find that the behaviour continues through less visible channels. The more effective response is to understand the use cases driving shadow AI adoption and to provide authorised tools that serve those use cases within appropriate governance frameworks.
The Governance Architecture That Is Actually Working
Runtime Governance: The Critical Insight
The most important insight to emerge from enterprise agentic AI deployments in 2026 is that governance that happens after the fact is not governance at all. Post-hoc audits of agent behaviour can identify what went wrong, but they cannot prevent harm from occurring. For agentic systems that can execute consequential actions in seconds, the window between a governance violation and its consequences may be too short for any post-hoc intervention to be meaningful.
The 52% of employees who report using unauthorised AI tools are not rogue actors—they are rational responders to an environment where official AI tools are too restricted to be useful. Shadow AI is a symptom of governance failure, not a cause of it.
Research published in 2026 demonstrates that embedding controls directly into agent runtime loops—rather than relying on post-hoc audits—reduces policy violation windows by 89.5%. This finding has significant implications for governance architecture: the controls that matter most are those that intercept problematic actions before they are executed, not those that detect them after the fact.
Runtime governance—embedding controls directly into agent execution loops rather than relying on post-hoc audits—reduces policy violation windows by 89.5% according to recent research. The implication is stark: governance that happens after the fact is not governance at all.
Runtime governance in practice means adaptive guardrails—confidence thresholds, behavioural baselines, and action classifiers—that evaluate agent actions before execution and intercept those that exceed defined risk parameters. It means "human-on-the-loop" supervision, where human intervention is triggered by exceptions and anomalies rather than required for every action. And it means continuous monitoring that can detect behavioural drift—the gradual expansion of agent behaviour beyond its intended scope—before that drift produces consequential errors.
Agent Identity Management: The Foundational Requirement
Effective governance of agentic AI systems requires that every agent have a unique, verifiable identity. This requirement, which may appear obvious, is frequently violated in practice: many enterprise AI deployments use shared credentials, long-lived service accounts, or human user credentials to authenticate agent actions. These approaches make it impossible to attribute specific actions to specific agents, audit agent behaviour accurately, or revoke agent access without disrupting other systems.
The emerging standard for agent identity management replaces shared credentials with scoped, ephemeral token allowances: credentials that are specific to a particular agent, limited to the permissions that agent requires for its current task, and automatically revoked when the task is complete. This approach—analogous to the principle of least privilege in classical security architecture—limits the blast radius of agent compromise and makes agent behaviour auditable at the individual action level.
The Model Context Protocol (MCP) for secure tool access and the Agent-to-Agent (A2A) Protocol for standardised inter-agent communication represent the industry's emerging response to the agent identity and communication challenge. These protocols provide a common framework for agent authentication, authorisation, and communication that can be implemented consistently across different agent architectures and platforms.
The Autonomy Tier Framework
One of the most practically useful developments in agentic AI governance in 2026 is the emergence of autonomy tier frameworks—structured approaches to classifying agents by their level of autonomy and applying proportional governance intensity to each tier. The Agentic Trust Framework (ATF), which defines autonomy levels from A1 (fully supervised) to A5 (fully autonomous), provides a basis for calibrating oversight requirements to the actual risk profile of each agent deployment.
Under this framework, low-autonomy agents—those that execute predefined workflows with limited decision-making authority—require relatively light governance: clear scope definitions, basic monitoring, and periodic audits. High-autonomy agents—those that can plan novel workflows, delegate to sub-agents, and take consequential actions without human approval—require substantially more intensive governance: runtime controls, human-on-the-loop supervision for high-risk actions, comprehensive audit trails, and regular behavioural reviews.
The practical implication is that governance should be proportional, not uniform. Applying maximum governance intensity to all agents is operationally unsustainable and drives employees toward shadow AI alternatives. Applying minimum governance intensity to all agents creates unacceptable risk. The autonomy tier framework provides a principled basis for calibrating governance intensity to actual risk—a more defensible approach than either extreme.
Runtime governance—embedding controls directly into agent execution loops rather than relying on post-hoc audits—reduces policy violation windows by 89.5% according to recent research. The implication is stark: governance that happens after the fact is not governance at all.
The Regulatory Horizon: What Is Coming and When
The EU AI Act and Agentic Systems
The EU AI Act, which entered into force in August 2024 and is being implemented in phases through 2027, provides the most comprehensive regulatory framework for AI systems currently in force. Its risk-based approach—classifying AI systems by their potential for harm and applying proportional requirements to each risk tier—is broadly consistent with the autonomy tier frameworks that enterprises are developing independently.
The application of the EU AI Act to agentic systems raises questions that the regulation's drafters did not fully anticipate. The Act's requirements for transparency, human oversight, and accountability were designed primarily for AI systems that make or support specific decisions—credit scoring, recruitment, medical diagnosis. Agentic systems that execute complex workflows across multiple domains, delegate tasks to sub-agents, and operate continuously do not fit neatly into this framework. The European AI Office, which is responsible for implementing the Act, is actively developing guidance on agentic systems—guidance that will have significant implications for enterprises operating in European markets.
The NIST AI Risk Management Framework
In the United States, the NIST AI Risk Management Framework (AI RMF) provides a voluntary but increasingly influential basis for enterprise AI governance. The NIST AI Agent Standards Initiative, launched in 2026, is developing specific guidance for agentic systems that addresses the governance challenges identified in this analysis: agent identity, runtime controls, accountability structures, and multi-agent coordination.
The voluntary nature of the NIST framework does not diminish its practical significance. Regulatory bodies, procurement agencies, and institutional investors are increasingly using NIST AI RMF alignment as a criterion for assessing enterprise AI governance maturity. Enterprises that can demonstrate alignment with the framework—and, as it develops, with the agent-specific guidance—will be better positioned in regulatory examinations, procurement processes, and investor due diligence.
The Organisational Imperative: Building Governance Before Deploying Agents
The central argument of this analysis is that the governance gap in agentic AI is primarily an organisational failure, not a technical one. The technical tools for governing agentic systems—runtime controls, agent identity management, autonomy tier frameworks, monitoring infrastructure—exist and are being deployed by leading enterprises. The failure is in the organisational structures that determine whether these tools are used, how they are configured, and who is responsible for their effectiveness.
Organisations that deploy agentic AI systems without first establishing clear governance structures are accumulating what researchers call "governance debt"—a backlog of unresolved accountability questions, unmapped decision rights, and unmonitored agent behaviours that will eventually produce consequential failures. Like technical debt, governance debt is easier to accumulate than to repay. Unlike technical debt, governance debt may produce failures that are not merely costly but legally consequential.
The practical implication is straightforward: governance infrastructure should precede agent deployment, not follow it. This means establishing a centralised agent registry before deploying agents, not after. It means defining decision rights and accountability structures before granting agents access to sensitive systems, not after an incident reveals the gaps. It means implementing runtime controls before agents are operating in production environments, not after a governance violation has occurred.
The enterprises that will navigate the agentic era most effectively are not those that deploy agents most rapidly, but those that deploy them most responsibly—with governance structures that are proportional to the autonomy and risk profile of each deployment, and that evolve as agent capabilities and organisational experience develop. The governance gap is real, and it is widening. But it is not inevitable. It is a choice—made, or not made, by the organisations deploying these systems.
