Human accountability

Definition

The operating discipline that assigns a named human role authority and answerability for an agent’s purpose, risk, decision rights, authorization, intervention, outcomes, and lifecycle. Agency can be delegated. Enterprise accountability cannot.

Human accountability is established; agent-specific roles and decision models are still being operationalized.

Why it matters

Agency can be delegated. Enterprise accountability cannot.

The operating shift is from “A human somewhere in the loop” to “A named human with decision authority.”

System anatomy

Practice 1

Assign exactly one accountable role per consequential decision

Practice 2

Publish decision rights and escalation paths

Practice 3

Keep override, suspension, and risk acceptance human-authorized

Important distinctions

A human somewhere in the loop

This concept moves the engineering system toward a named human with decision authority.

Implementation signals

• Assign exactly one accountable role per consequential decision
• Publish decision rights and escalation paths
• Keep override, suspension, and risk acceptance human-authorized

Failure modes

• Accountability diffused across a committee or vendor
• A review click treated as ownership of the outcome

Sources and further study

1. Microsoft Agentic Center of Excellence — Define roles, responsibilities, and decision rights

   An operating model that assigns one accountable role per decision and distinguishes domain, platform, risk, and runtime responsibilities.

   Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

   guidance · guidance · Published 2026-07-14
2. Microsoft Entra Agent ID — Administrative relationships in Microsoft Entra Agent ID

   Separates technical ownership from business sponsorship and assigns sponsors lifecycle, access-review, and incident-response decisions.

   Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

   guidance · guidance · Published 2026-04-08
3. NIST NCCoE — Identity and Authority for Software Agents concept paper

   A concept paper exploring how established identity and authorization practices can apply to software and AI agents.

   Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

   guidance · guidance · Published 2026-02-05