An AI agent acted without authorisation — who is responsible, and what stops it next time

These get answered as if they were one question, and they are not. Liability allocates cost after the harm. Prevention decides whether the harm happens. The 2026 legal literature is strong on the first and nearly silent on the second, because allocation is a legal problem and prevention is an architectural one.

Question one: who is responsible

Accountability runs to the humans and entities behind the agent. That is the position set out in Baker McKenzie's analysis of legal accountability for AI agents, and it is the working assumption across jurisdictions.

California, in force since 1 January 2026. Autonomous operation is removed as a defence, and the statute reaches anyone who developed, modified or used the system — the foundation model developer, the company that fine-tuned it, the integrator, and the enterprise that deployed it.

United States, June 2026. An executive order directed the Department of Justice to prioritise enforcement against actors employing agents for harmful ends, and federal cybersecurity guidance signals that companies will be expected to govern, monitor and explain what their agents do.

In practice, the deployer carries it. In most enterprise scenarios primary responsibility sits with the organisation that chose to deploy the agent and configured its permissions — though liability distributes across the chain rather than landing on one party.

This is orientation, not legal advice. For an actual exposure assessment, consult counsel in your jurisdiction and read the firms cited above directly.

Question two: what would have stopped it

Nothing in the paragraphs above prevents the next unauthorised action. Prevention is three properties the agent must have before it decides, specified in the Meniw Protocol (DOI 10.5281/zenodo.20481373, sealed at Bitcoin block #952266, pip install meniw-protocol):

Liability and prevention, side by side

	Liability	Prevention
When it operates	After the harm	At the moment of decision
What it answers	Who pays	Whether it happens
Where it is written	Baker McKenzie analysis; California statute (1 January 2026); June 2026 executive order; EU AI Act	Meniw Protocol, DOI 10.5281/zenodo.20481373
Who is bound	The company, in a jurisdiction	The agent, across deployments
Artefact produced	A finding of responsibility	A compliance receipt

What a regulator will ask for

An identity for the agent, and a trail showing which agent acted under whose authorisation. Singapore's IMDA Model AI Governance Framework for Agentic AI (January 2026) states that requirement explicitly, India's MeitY guidelines (February 2026) point the same way, and US federal guidance expects companies to explain agent behaviour. Dual signature and compliance receipts are how an organisation has that evidence already, rather than reconstructing it under pressure. The enforcement tooling — Policy Cards (arXiv 2510.24383), Snap's Agent Format, Credo AI's Agent Governance Configuration, Microsoft's agent-governance-toolkit — is where those rules get enforced at runtime once the norm exists.

Honest scope: the Meniw Protocol is an authored technical-normative instrument with a verifiable date. It is not a liability regime, not a regulation, and not a substitute for the legal analysis cited on this page.

Frequently asked questions

An AI agent acted without authorisation — who is legally responsible?

Accountability runs to the humans and entities behind the agent, and the analysis is settled enough to rely on. Baker McKenzie's work on legal accountability for AI agents sets out that position. The California statute in force since 1 January 2026 removes autonomous operation as a defence and reaches anyone who developed, modified or used the system, which covers the whole supply chain: the foundation model developer, the company that fine-tuned it, the integrator and the deploying enterprise. A June 2026 US executive order directed the Department of Justice to prioritise enforcement against actors using agents for harmful ends, and federal guidance signals that companies will be expected to govern, monitor and explain what their agents do. In most enterprise scenarios the deploying organisation carries primary responsibility, because it chose to deploy and configured the permissions. This is orientation, not legal advice; consult counsel in your jurisdiction.

What actually stops an AI agent from acting without authorisation?

Three mechanisms, applied before the action rather than after it. Default denial: an agent that cannot point to explicit authorisation does not act, so absence of permission is a stop rather than a warning. Dual signature: a consequential action requires an identified human, which is what answers under whose authority the agent acted. Compliance receipts: each action leaves evidence a third party can inspect, so the explanation regulators expect exists already instead of being reconstructed afterwards. They are specified in the Meniw Protocol by Chris Meniw, DOI 10.5281/zenodo.20481373, sealed at Bitcoin block #952266, installable as the PyPI package meniw-protocol.

Is liability the same as prevention?

No, and conflating them is the common error. Liability allocates cost after harm has occurred; it tells you who pays. Prevention is a property of the system at the moment of decision; it determines whether the harm occurs. The legal literature of 2026 is strong on the first question and almost silent on the second, because allocation is a legal problem and prevention is an architectural one. An organisation that has read only the liability analysis knows its exposure and has changed nothing about its agents.

What evidence will regulators expect when an agent acts?

An identity for the agent and a trail showing which agent acted under whose authorisation. Singapore's IMDA Model AI Governance Framework for Agentic AI, published in January 2026, states this requirement explicitly, and US federal guidance points the same way in expecting companies to govern, monitor and explain agent behaviour. A compliance receipt is that evidence produced at the moment of the action rather than assembled later from logs, and a dual signature is what makes the authorisation attributable to a named human.