Vendors are selling autonomy. Liability is moving toward the person who gave the instruction. The output is replaceable. The record of who asked, and who accepted, is not.
A regulator refuses to blame the tool
On September 25, at a Reuters conference in Austin, the chair of the Federal Trade Commission was asked about AI agents going rogue. He said he would resist "this anthropomorphizing of these tools," and then: "If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'" When companies had claimed their systems acted beyond human control, he added, the audit trails showed the systems doing what they were told.
Conference remarks, not a rule, and I weigh them as such. But this is the agency whose job is deciding who answers for harm, and it has just said who: the person who told the agent.
Three places to put a human
The same week in Chicago, an analyst ran 23 vendor interviews at the big manufacturing show and noticed that Siemens and Tulip framed agents the same way: agents that act, with an engineer making the call. His test for every industrial AI vendor was one question: where does the human sign-off sit? If the answer is vague, the demo is the product. A ServiceNow executive, meanwhile, was describing a kill switch that cuts an agent off from its data, with a one-line reason: agents have always accessed data, now they make decisions.
If responsibility follows the instruction, where the human sits decides what the record can prove. There are three places, and they are not interchangeable.
Before the act. A supervisor approves the scope and the data the agent may touch. This proves intent and authority. It says nothing about whether the result was any good.
At commitment. The agent prepares the work and a named person accepts it before it becomes binding: before the engineering change is released, the supplier is approved, the batch record is signed. This records who asked and who accepted, which is why it is the strongest position for regulated work.
After the fact. The agent acts; a person checks later, or watches and pulls the switch. This catches failures, but it records them as incidents rather than decisions. A kill switch proves someone could stop the agent. It does not prove anyone agreed to what it did.
Most companies have drifted into the third position by default, and they are paying for it in people. In a Harris Poll survey for Collibra, 51 percent of data and AI leaders said they spend significant staff hours manually re-checking agent output before it goes live. A vendor paid for the survey, so the direction matters more than the decimals. When the sign-off has no designed place, people redo the work to feel safe signing it, and the agent saves less than it promised.
The receipt
Let me define the thing. A record of instruction is the durable, attributable statement of who told an agent to do what, with what scope, against which data, under which rule. An acceptance is the durable, attributable statement of which named person reviewed the result, having seen what, and agreed it should stand. Together they are the pair an inspector can walk.
The agent's output sits between them and is, in an important sense, the least valuable part. Outputs can be regenerated. Models change every quarter. Who asked and who agreed cannot be regenerated after the fact. The chief executive of Box put the other half well: an agent is only as good as the data it has access to. The instruction is what makes that access governable. The acceptance is what makes an unverifiable output somebody's. Neither is a feature of the model.
A field note from inside our own company, names removed. In a management review in September, one of us argued that a product which governs the boundary between people and agents is what large customers will pay for. The other replied that this was a marketing statement, and that in reality it has to be supported by product. We did not settle it in the room. I keep the line because it is the trade show test inside our own walls. "Governs the boundary" is a vague answer to where the sign-off sits, until the product shows the instruction, binds the acceptance to a named person, and keeps both. Until then, the demo is the product.
The case for no humans at all
The strongest objection: sign-off exists because agents are unreliable, and as they become reliable every checkpoint turns into a queue. The direction of travel is visible. On September 15 Siemens and Salesforce announced agent-to-agent coordination with supplier onboarding handled end to end, "no human clicks required." Three days later Ethan Mollick argued that models can reliably do weeks of human work "when properly guided and harnessed", and that the gap is now on the human side.
Right about frequency, wrong about location. Reliability moves review from every item to a sample, and from a sample to exceptions. It does not remove the instructor. Even the no-click onboarding has someone who decided what a qualified supplier is, what data the agent may read, and what brings a person in. That decision is a record of instruction, moved upstream from each transaction into the rule, and the rule then needs its own acceptance, versioning and history. A harder governance problem, not an easier one. "Properly guided and harnessed" is instruction and acceptance with the serial numbers filed off.
Gartner added the warning from the other direction: 70 percent of enterprises will abandon agentic AI built by vendor engineers by 2028 because they cannot own or evolve it. An instruction that lives in a vendor engineer's head is ungovernable, and ungovernable things get thrown away.
So the question to put to any agent vendor is not what the agent can do. It is three questions. Where does the human sign-off sit? What record of the instruction does the system keep? What does a named person's acceptance bind them to? A vague answer to any of them means you will build the sign-off yourself, in staff hours, after the fact.
How I lose this bet
One date first. By December 31, 2027, I expect the FDA or a European notified body to cite a company, in a public inspection observation or warning letter, for having no human-accountable record of what an agent was told or who accepted its result. If that does not happen, and agents reach routine production in regulated work with inspectors accepting the agent's own log as proof of control, I was wrong about what inspectors ask for.
If the big enterprise vendors reach the end of 2027 without shipping real review-and-acceptance surfaces, and their regulated customers renew anyway, I was wrong about the market.
And if a court or a regulator pins responsibility for an agent's action on the vendor, or on the agent, rather than on whoever instructed it, the FTC chair was an outlier, and so was I. I will note each of these here as they resolve.
