Who Takes Responsibility When AI Agents Act as Employees?

With digital employees on the job, accountability becomes a muddled issue.

Written by: Forbes

Compiled by: AididiaoJP, Foresight News

According to a survey by Anthropic, 57% of organizations have deployed AI agents to handle multi-stage workflows, and 81% of companies plan to use them for more complex tasks by 2026. Meanwhile, many companies are still figuring out how to effectively manage these agents: a survey by the Cloud Security Alliance found that 82% of respondents had discovered at least one AI agent or autonomous workflow that their security or IT teams were completely unaware of.

The rapid adoption of AI agents reflects a fundamental shift in how businesses perceive artificial intelligence. Agents are no longer limited to drafting copy, conducting research, and basic chatting; they are now directly involved in customer conversations, internal databases, and daily business operations. They can schedule appointments, update records, filter leads, and perform tasks that were previously handled by employees.

This shift is prompting a broader discussion about how companies should manage AI agents as a new form of digital workforce. Tech companies like Microsoft and Okta are developing systems to give agents independent identities, designate responsible parties, and restrict their permissions. The U.S. National Institute of Standards and Technology (NIST) is also exploring how existing identification, authorization, and auditing standards can be applied to agents.

Business communications company Nextiva has directly positioned its XBert AI assistant as an "AI employee." This agent can answer customer calls and messages, schedule appointments, filter leads, and route requests to relevant business systems. Companies can set the scope of its responsibilities, decide when to transfer to a human, and review all interaction records.

Referring to software as an "employee" implies that it can represent the company, exercise authority within a limited scope, and complete work on behalf of the company. However, the companies deploying it still bear responsibility for what it says and does.

"Trust in AI agents is the same as trust in employees: it must be earned through performance and must be verifiable," Nextiva's Chief Marketing Officer Yaniv Masjedi told me in an interview. He added that agents should clearly indicate they are AI, explain what they can and cannot do, and always provide an option to transfer to a human.

"Behind the scenes, companies need to apply the same rigor as they would with new employees: clarify permissions, document all actions, and designate a human responsible for the outcomes. AI never owns the results; the company does. The commitments made by agents are your commitments."

Managing the New Digital Workforce

The level of oversight required for agents largely depends on what they can do. If they only answer questions based on an approved knowledge base, the risks are relatively manageable; if they can access customer records, send messages, issue credits, or modify accounts, more precise controls are necessary.

Companies must manage agents' identities and access permissions with the same caution as they would for human employees. The controls surrounding agents effectively become their job descriptions: which systems they can access, what actions they can perform, and which decisions still require human approval.

"If agents are to work like employees, create an 'employment file' for them: designate a direct supervisor, clarify job scope, set time-limited access credentials, document thresholds for transferring to human intervention, and establish a complete offboarding process," wrote Anupam Satyasheel, CEO of Occams Advisory and co-founder of Occams AI, in a response.

"On the last day of a human employee, their access card is deactivated. Most agents, however, do not have a 'last day.'" He added.

Recent research from Okta shows that foundational management infrastructure is still in the building phase: only 47% of executives reported being able to identify all agents in their environment, 46% could control what content these agents accessed, and 45% could authorize their specific actions.

The challenge lies in imposing enough structure without stifling the agents' inherent flexibility.

"Agents are inherently flexible. Over-regulating them is like paying a high price to run a script; under-regulating them equals a complete lack of governance," Imran Siddique, Chief Platform Officer at Opaque Systems, told me in a written response.

He believes agents should have independent machine identities and clear capability lists, rather than broad job titles or directly inheriting permissions from a human user.

"This agent can only perform this set of actions—no implied permissions, no inherited permissions," he said.

Human roles often come with informal expectations and unspoken powers. AI agents operate entirely through system access: as long as the connected account allows a certain action, they can execute it, even if the company never intended to grant that power.

Building Trust

Clarifying who is responsible for agents is just one part of the structure. Companies must also be able to identify the agents themselves, limit their permissions, and fully reconstruct all their actions.

Verification platform Sumsub recently launched the "Know Your Agent" framework, which binds agents to verified human identities. "Linking AI agents to verified human identities is the foundation of accountability, but that alone may not be enough," Sumsub's Chief Growth Officer Ilya Brovin told me in a written response. Organizations must be able to determine: who is responsible for this agent, what it is authorized to do, and what it actually did.

This requires persistent machine identities, strictly limited permissions, continuous authentication, and tamper-proof activity logs. "Trust must be ongoing, not a one-time event," Brovin added.

This distinction reflects the difference between agents and one-time identity verifications for human users. A person may only need to verify their identity once when opening an account or accessing a service. Agents, however, may operate continuously, move between systems, and execute new actions hours or even days after initial authorization.

Customers should clearly know: which company this agent represents, that they are conversing with AI, what requests it can handle, and how to contact a human for sensitive or significant decisions. Internal teams need more complete records: who authorized this agent, what data it accessed, what actions it performed, and whether those actions were within the approved scope.

The rise of AI employees requires companies to apply familiar management principles—ownership, job descriptions, limited access, oversight, and offboarding—to a whole new class of "employees." As agents join the digital workforce, those who benefit the most will be the companies that, while granting greater autonomy, also draw clear boundaries and enforce accountability.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.