The System Did It

Your logs record what your agents did. They do not record who agreed to it. Access and authorization used to be the same event — agents separated them.

Somewhere in your organization there is a log line with a timestamp, an action, and no name.

The action was probably correct. That is the part people skip when they hear this story. The record was updated the way it should have been updated. The ticket was closed because it deserved to be closed. The message went to the customer who was supposed to receive it.

And when somebody asks who decided that, the honest answer is a shrug and four words.

The Chain, and Where It Breaks

For most of the history of software, that sentence was a bug report. Programs did what they were told, and when one did something surprising you went and found the instruction, and behind the instruction you found a person. Attribution was tedious. It was never mysterious. The chain ran from the action back through the code, back through the commit, back through a name and a date and a review.

Agents break that chain. They break it in a specific place, and it is not the place most teams are watching.

Everyone Is Watching Access

Most teams are watching access. Access is a question every mature organization has already answered: what can this system reach, which databases, which endpoints, which environments. There are whole product categories for it. There are quarterly reviews. There is, in regulated shops, an auditor who shows up and asks.

The second question almost never gets asked, because until recently it didn’t need to be. Access and authorization were the same event. A person logged in, a person clicked, and the click was both the permission and the decision. One human, one action, one record.

An agent separates them. The login happens once, in a deployment. The decisions happen continuously, for months, at a volume no one is reading. Somewhere in that volume an action gets taken that a person would have hesitated over — and the hesitation is the thing that didn’t survive the handoff.

Your Logs Are Probably Excellent

Here is what makes this hard to see from the inside: your logs are probably excellent.

That is not a consolation. It is the diagnosis. Teams investigating this gap almost always discover that they logged the event in full. Timestamp, payload, outcome, retry count, latency. What the log records is the actor, and the actor is a service account. The service account was issued to a process. The process was handed a task. And between the human who set the thing running in March and the action that landed on a Tuesday in September, there are steps that no one named, because naming them was never a step anyone was asked to perform.

So the record is complete and the answer is still missing. You know exactly what happened. You cannot say who agreed to it.

The Question From Outside the Building

This becomes urgent the moment the question comes from outside the building. A board member, a regulator, a customer’s counsel, a journalist. They are not asking whether your system is well engineered. They are asking a question that human institutions have asked for several thousand years and have never accepted a technical answer to: who decided this.

“It was autonomous” is not a category the question recognizes. Autonomy is a description of the mechanism. It is not a transfer of accountability, and no one outside your engineering organization will hear it as one.

Run the Trace

The discipline here is smaller than it sounds, and you can run it this week.

Take one action your agents performed in the last seven days. Not a category. One action, with a timestamp. Now trace it back to a human name — and be strict about what counts.

• Does the person who deployed the system count? No. Deployment is access, not authorization.
• Does the person who wrote the prompt six months ago count? Only if you can show that this specific class of action was the thing they were agreeing to.
• What actually counts? A named human who authorized this action, or the class it belongs to, on the record, in a form you could hand to someone who does not work here.

Most teams cannot complete the trace on the first try. That is not a failure of the team. It is the honest output of a system that was built to answer a different question, and it is far better to learn it on a Tuesday with a stopwatch than in a conference room with a lawyer.

The gap is closeable. It is closeable in a way that does not require slowing your agents down or putting a human in front of every action, which is the false choice that keeps most organizations from starting. But it starts with the admission, said plainly and without defensiveness: we have complete records of what our systems did, and no record of who agreed to it.

“The agent did it” is not an answer. Somebody authorized it. You just can’t say who.

Next Week: why the credential your agent is using was never issued to it in the first place.