When something goes wrong in a well-run system today, the question "who did this?" has an answer. A person, a service account, a change ticket, a pull request with a name on it. Almost every control we've built for fifty years quietly assumes that answer exists: least privilege assumes an identity to scope, audit logs assume an actor to record, approvals assume a human to hold accountable, and non-repudiation is the entire point of a signature. Security has always been able to lean on a simple fact - behind every action was, eventually, a person.
Autonomous agents break that fact, and they break it quietly.
Picture an agent that takes a goal, reads some context, calls four tools across three services, and produces a result. A user asked for something, sure. But between that request and the action that touched production, there was a model deciding, a tool being selected, a retrieved document shaping the plan, and a credential being spent. When the action turns out to be wrong - a record deleted, a message sent, money moved - the honest answer to "who did that?" is a shrug and a gesture at the whole apparatus.
That shrug is the problem. Not because the agent is malicious, but because accountability was load-bearing and we just removed the beam.
We spent fifty years assuming a human behind every action. The interesting failures now happen where that assumption used to be.
Three things go, and they go in a way that's easy to miss until you need them. The first is identity. Agents tend to run as one over-permissioned service account, because that was the fast way to ship - so ten different tasks, kicked off by ten different people with ten different authorizations, all arrive downstream as the same principal. The logs are technically complete and practically useless: everything was "the agent." Least privilege can't scope what it can't tell apart.
The second is intent. A traditional audit log records what happened; with an agent, what happened is often the least interesting part. Why it happened - which instruction, which retrieved passage, which earlier tool result tipped the decision - is what an investigator actually needs, and it's exactly what we throw away. The reasoning is transient. By the time you're reading the log, the context that produced the action is already gone.
The third is consent. A person approving an action is reviewing a specific thing. An agent granted standing permission to act spends that one approval hundreds of times, against situations the approver never saw. The signature at the top of the flow stops meaning "I reviewed this" and starts meaning "I reviewed the idea of this, once."
The answer isn't to ban autonomy; that argument is over, and it lost for good reasons. It's to carry the three things the agent erased all the way through the system, on purpose, instead of going looking for them during the incident review.
Identity has to travel. An agent's action should be bound to a human sponsor and a specific task - not laundered through a shared account - and that binding should follow the request down to the last downstream call, so the system of record names the person, not just the machine that acted for them. Intent has to be kept, because it doesn't keep itself: the instruction, the context, the tool results the agent actually consumed are audit data now, and the reasoning trail is only there later if you decided, earlier, that it would be. And consent has to be bounded - by blast radius, by time, by a step-up check when a task crosses from routine into consequential - with a human left in the loop at precisely the edges where being able to answer for it matters most.
It's the same instinct that built identity, logging, and approvals in the first place, pointed at an actor that isn't a person. The teams that get agentic AI right won't be the ones that trusted their agents least. They'll be the ones that can still answer, long after the fact, the oldest question in security: who did that, and on whose authority?