TL;DR
AI agents are taking security actions in production right now. Most of those actions have no human name attached. Four questions close that gap: scope, approval, stop, proof. Run them against any action an agent is allowed to take, and write down a name for each answer before the agent runs, not after an auditor asks.
An AI closed the alert at 2 am. Who said it could?
Most teams cannot answer that the next morning. The gap now has numbers attached.
A CIO survey published by Sopra Steria Next in October 2026 found that fewer than 20% of AI-influenced or AI-executed decisions in large organizations have an identified business owner, explicit rules, or formal accountability. Fewer than 25% of AI-driven decisions in production can be traced and replayed end to end. The firm did not publish a sample size, so read those figures as directional.
What AI accountability actually means
Responsibility, accountability, and liability are three different things
Responsibility is who does the work. Accountability is who answers for the result. Liability is who pays. An AI agent can take over the first one—the second and third stay with named people.
“The AI did it” stopped working as an answer
California’s AB 316 took effect on January 1, 2026. It blocks a defendant who developed, modified, or used an AI system from arguing that the system acted on its own as a defense for harm it caused. The law does not create liability on its own, and every other defense survives, so a plaintiff still has to prove the case.
Insurers are repricing the same exposure. An industry standard generative AI exclusion for commercial general liability took effect on January 1, 2026, and more than 60 property and casualty carriers filed AI exclusions this year. Some technology errors and omissions carriers have added their own AI exclusions, while others are doing the opposite and intentionally writing AI coverage. Check which side your policy falls on before an agent decides for you.
Most AI decisions have no named owner.
AI is already taking action inside security stacks. Two 2026 surveys suggest the paperwork behind those actions has not kept up.
In the same OneTrust study, 87% encourage the use of AI agents while only 47% have clear governance controls and oversight for them. Adoption is running roughly twice as far ahead as governance.
Who is responsible when an AI security agent gets it wrong?
Courts have not settled this. Four parties are exposed, roughly in this order.
The company running the agent
The operator carries the most risk today. You chose the tool, you connected it to production, and you decided what it could touch. That is the easiest link for a regulator or a plaintiff to prove.
The team that scoped and configured it
Permissions are a human decision, and someone authored it. If an agent had write access to a production cloud account because someone widened its role to clear a backlog, the change log names the person who did it.
The model provider
Most provider terms disclaim guarantees and push risk back to the customer. Ask for three things in writing before you sign: indemnification for actions the agent takes inside your environment, a notice period for model changes that affect behavior, and a contractual right to your own action logs.
The security leader
Investigators will ask who approved the agent’s permissions, whether anyone objected, and what the board was told. An approval trail that names the actual decision-maker keeps those questions pointed at the right desk.
The number one reason AI governance quietly stalls
Ownership breaks at the handoff. Work moves from the risk team to the platform team to the operator, and the name attached to it drops somewhere in the middle. Nothing formally fails. The program stops moving.
OneTrust’s 2026 AI Ready Governance survey of 1,200 senior decision-makers across eight markets puts the scale of it plainly: 87% encourage the use of AI agents, 47% had clear governance controls and oversight for them, and only 5% said coordination and accountability across the AI lifecycle was clear. In the same study, 86% reported at least one AI-related incident in the past year, and 40% were still deploying AI systems while their controls were still in development.
Our own research points in the same direction. In 14 moderated interviews for The Security Practitioner’s Guide to AI Hype, 57% of buyers raised AI governance or shadow AI concerns without being prompted. Small sample, so treat it as directional.
Four questions that map accountability to every AI action
Run these against any action an AI agent is allowed to take. If a question has no name as its answer, you have found the gap before an auditor does.
1. Who set the scope?
Someone decided this agent operates on these assets, in this tenant, during these hours. Record that person next to the boundary they drew. Scope is the first human decision and the one teams forget to write down.
2. Who approved the step that mattered?
Draw the line at actions that change production state, touch customer data, or cannot be undone in one step. Those pause for a human. Everything below that line runs inside policy. Approval puts a person’s name on the action, which is why human approval gates belong in the workflow rather than in a policy document.
3. Who can stop it while it runs?
Most teams can name who starts an agent. Far fewer can name who kills it at 3 am on a Sunday. An Economist Enterprise survey of 804 senior technology executives, all of them already running agents, found only 37% keep a complete and current inventory of their agents and the actions those agents are allowed to take. Test the kill switch quarterly and after every permission change, because an untested stop is a stop you do not have.
4. Who can prove it 12 months from now?
Keep five things for at least 12 months: the action, the model version, the policy that allowed it, the approval and who gave it, and the outcome. That is the same package an auditor asks for, so building it once covers both jobs.
What the map looks like on one real SOC action
Take a common one. An AI teammate isolates an employee laptop during a suspected compromise. Fast, useful, and expensive if it hits the wrong device.
- The SOC lead owns scope, which includes corporate laptops and excludes servers and executive devices.
- The on-call analyst approves within a 5-minute window, with the alert context attached to the approval.
- Either that analyst or the shift supervisor can stop it. Both have a tested rollback that restores network access in one step.
- Proof lives in the case record for 12 months: the alert, the enrichment, the approver, and the restore.
- Four names. One action. Run the same four questions against a cloud fix or an audit evidence pull, and the pattern holds.
Why trust decides how far AI gets in security
Security teams expand what an agent may do once they can defend each action to a CISO, an auditor, a regulator, or a customer. Each name you can attach to a step buys you a little more autonomy on the next one. Teams that skip the naming stay stuck at advice, with the workload still sitting on people.
How Secure.com helps
Secure.com runs governed AI Teammates above the stack you already own. They do real security work within the boundaries your team sets, and every consequential action has a human name.
- Scope is explicit. Each Teammate has a function, environment, and asset group, so authority is never open-ended.
- Permissions are separable. You grant read, recommend, write, execute, and remediate one at a time, so you can increase autonomy as confidence grows.
- Consequential actions pause at a human gate, while lower-risk work continues within the policy you set.
- Define escalation and stop paths up front, so someone is always named to halt a Teammate mid-action.
- Log every recommendation, approval, action, and outcome so you can reconstruct any decision a year later.
Start with one Teammate in one function. The governance model stays the same as you add more.
Frequently asked questions
What is AI accountability?
What is the difference between AI governance and AI accountability?
Does a human have to approve every AI security action?
If an AI agent causes a breach, is the vendor or the customer liable?
How long should we keep AI action logs?
Conclusion
How human approval gates keep AI compliance work defensible. The deepest version of question two in this post, with the mechanics of building a gate auditors accept.
How to validate the outputs of AI native security tools in a live environment. Answers the objection this post raises but does not solve, which is how you check the agent was right before you approve it.