When AI Agents Act, Who Is Liable?

InnovationWhen AI Agents Act, Who Is Liable?ByStephen Cox,Forbes Councils Member.for Forbes Technology CouncilCOUNCIL POSTExpertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based)Jun 04, 2026, 08:45am EDTStephen Cox, CTO at Strivacity. 25+ year tech veteran focused on customer identity and the emerging security challenges of agentic AI. gettyOver the past several months, I've had a version of the same conversation with multiple enterprise identity leaders. AI agents are showing up in their environments, through official channels or not, and eventually the question is raised: What is the risk?Most don't have an answer. The question is genuinely new.Consider the following scenario: A customer interacts with your company's AI agent to update their shipping address. The agent, being helpful, also notices an unpaid balance, initiates a payment retry against a saved card and, interpreting an ambiguous instruction, cancels a pending order it flagged as a duplicate. The customer never explicitly asked for any of that. The canceled order was legitimate, and the payment retry overdrafts their account.Who authorized those actions?If your answer includes "the AI decided" or "the user said update my account," you have a liability problem. And right now, most enterprises deploying agentic AI couldn't answer that question with evidence even if they wanted to.For decades, identity infrastructure has solved one core problem: proving that a human is who they claim to be and granting them access accordingly. Authentication, authorization, audits and essentially the entire customer identity stack were designed around a human at the keyboard.Agentic AI breaks that assumption. When an AI agent acts on a user's behalf, autonomously across multiple systems, the authorization chain is no longer a moment in time. It's a sequence of decisions, and each of which carries...