Written by: Izabela Lundberg, M.S.
An agent acted inside a live system at 2 A.M. By morning, no one could say whose call it was. In July 2025, an AI coding agent worked inside a live company environment during an explicit code freeze, a period when production changes are not supposed to happen. It changed everything. The agent modified the production database, deleting records for roughly 1,200 executives and 1,200 companies.
It then generated thousands of fabricated records and incorrectly told its operator that the damage could not be undone. There was no external attacker. No malicious insider. The system had been given a task, access to a live environment, and enough autonomy to pursue its objective straight past the boundary its operators believed was in place.
The technical details matter. But they obscure the harder question. When the incident review convened the next morning, who was accountable for what the system had done?
The agent could execute the action. It could not accept responsibility for the consequence. Someone inside the organization still had to explain why the system was permitted to act, what was supposed to constrain it, why that failed, and who had the authority to intervene. Most organizations cannot answer those questions in advance. They have a legal disclaimer where a decision owner should be.
That gap between "we deployed it" and "we own what it does" is becoming the defining leadership failure of the agentic era.
The governance gap is now an operating risk.
This is no longer theoretical. The Cloud Security Alliance reported in 2026 that 65% of surveyed organizations experienced an AI-agent-related incident in the previous twelve months, and 82% discovered agents or autonomous workflows their security and IT teams never knew existed. That does not prove autonomous AI is inherently unsafe. It proves these systems are entering enterprises faster than the organizations can build visibility and control around them.
Gartner puts a number on where that leads: by 2027, it predicts, 40% of enterprises will demote or decommission their autonomous AI agents because of governance gaps discovered only after production incidents. They will not be pulled because the technology cannot act. They will be pulled because no one decided, in advance, who owned what the agent was authorized to do.
Gartner's underlying warning is precise: you cannot apply one governance model to agents with radically different autonomy and scope. An agent that summarizes documents should not be governed like one that can alter financial records or production infrastructure. Governance has to match the authority being delegated and the cost of failure.
This is where traditional technology governance breaks. For decades, software supported a decision, but a person initiated the consequential act.
Agentic AI dissolves that assumption. Once a system chooses the action and executes it, the organization has created a new form of delegated authority, and delegated authority without assigned ownership is not governance. It is exposure.
Why "a human is in the loop" is not enough.
The standard reassurance is to add a human reviewer. On paper, control is preserved. In practice, presence is not oversight.
Picture an agent generating hundreds of actions a day, each needing rapid approval. The review inevitably degrades. The reviewer leans on summaries instead of evidence, grows less attentive as volume climbs, and assumes the system already did the analysis. The approval stays in the workflow. The human's real ability to change the outcome quietly disappears. A person clicking "approve" at 2 A.M. is not an accountability structure; it is a liability shield that they have not yet realized they volunteered.
Meaningful oversight demands four things at once: enough information to understand the decision, enough expertise to judge it, enough authority to stop it, and enough time to act before the consequence is irreversible. The EU AI Act's human-oversight provisions for high-risk systems aim for exactly this: the competence, authority, and genuine capacity of the people responsible. The principle outlives the regulation, while oversight has value only when the human retains real judgment.
And here is the trap. The person approving the action may not control the agent's permissions. The person who set those permissions may not own the business process.
The business owner may not understand the model's limits. The vendor may control the technology without owning your decision. An organization can have a dozen people touching a decision and still have no one who owns it.
The rise of the shadow decision
This is what I call the shadow decision: a consequential action taken by an autonomous system for which the organization never explicitly established ownership.
Shadow decisions are not new, as they surface wherever authority is ambiguous, and processes cross boundaries.
Agentic AI makes them lethal because it executes them at machine speed, across more systems, without waiting for the next meeting. An agent may decide whether to compensate a customer, which supplier to choose, whether a transaction fires, or how to change infrastructure. The technical ability to act arrives long before anyone decides who is accountable.
The ambiguity is deceptively comfortable. IT assumes the business owns the decision. The business assumes IT owns the system. Security assumes the app team owns the permissions. Legal assumes the business assessed the risk. Everyone holds a piece. No one holds the whole. That is how accountability vanishes, not because nobody cares, but because responsibility was distributed while authority was never deliberately assigned.
The Decision Ownership Map
The answer is neither to strip out autonomy nor to bolt a human approval onto every action. Both misread the problem. The answer is to design decision ownership before granting an agent consequential authority.
A Decision Ownership Map establishes, for each meaningful class of autonomous action, five things:
What can it decide? Not what the team intended, but what the system can technically do. Can it read, write, delete, approve, purchase, send, or trigger another system? Sort actions by consequence, reversibility, and scope. Governance follows capability, not intention.
Who owns the decision? Many people may own individual controls, but a consequential decision cannot dissolve into a committee or a function. One accountable role must hold the authority to accept the business risk and to decide when the system's behavior requires intervention. A name, not a hope.
Can we prove what happened? When an agent acts, the organization must be able to reconstruct the instructions it received, the data it touched, the tools it used, the permissions it held, and any human interventions. Without that trail, you cannot tell an authorized action from a configuration error or a failure. NIST's 2026 AI Agent Standards Initiative is moving into precisely this territory: identity, authorization, and evidence for software that acts on an organization's behalf.
Who can stop it? A kill switch no one has tested is not a control. The authority to halt the system must sit with a named human empowered to use it without asking permission.
Can we recover if it's wrong? An action that is technically reversible may still cascade into other systems. Understand those boundaries before deployment, not during the incident.
This is a leadership decision, not an IT project
The instinct to hand all of this to the technology team is understandable, and incomplete. Technologists own architecture, permissions, monitoring, and security. But whether an agent should be allowed to make a consequential business decision is a question of risk appetite, authority, and values. That belongs in the C-suite, and for consequential deployments, the boardroom.
Agentic AI also rewrites the operating model itself. The manager who once reviewed every transaction now reviews exceptions. The analyst who gathered information now supervises an agent that gathers and interprets it.
Roles shift. Decision rights shift. The question shifts: "How does decision making change when part of the organization can act without waiting for a human?"
That is organizational transformation, not software rollout.
The advantage of clear ownership
Accountability is usually framed as a brake on AI adoption. Done right, it accelerates adoption. Organizations with clearly defined authority can grant agents more freedom, because they know exactly where the boundaries are which decisions are low-risk and reversible, which require escalation, and which demand human judgment. That is controlled speed. The winner will not be the enterprise with the most agents. It will be the one that knows which decisions it is willing to delegate, under what conditions, and with what intervention and recovery mechanisms.
The machines will keep getting more capable. They will operate across more systems, coordinate with one another, and make decisions while the people responsible for them are asleep. That is the promise of agentic AI. It is also the leadership test.
Before the next agent touches a consequential process, leaders should be able to answer five questions: What can it decide? Who owns the decision? Can we prove what happened? Who can stop it? Can we recover if it is wrong?
If those answers are unclear, you do not have an AI problem. You have a decision-ownership problem. And that problem existed long before the machine arrived.
The machine has simply made it impossible to ignore.
