Who Is Accountable When the Agent Places the Order?

Internal audit sat down with the automation team to review a vendor payment. The invoice had been paid twice. The audit team asked to see the approval chain. The automation lead pulled up a JSON log showing a 200 OK status from the agent, the model version, and the prompt template. The auditor stared at the screen and asked where the signature was.

Finance departments maintain a delegation-of-authority matrix that runs to eleven pages. It covers every human role in the company, mapping dollar thresholds to specific titles and requiring secondary approvals above certain limits. When the same company deploys an AI agent to handle procurement or issue refunds, they often skip the matrix and provision a service account with broad API access. Identity and Access Management controls where a system can go. It does not control why it does something or how much it can spend. An API key grants access, but it does not establish the organizational authority to commit funds.

A procurement agent configured with a $10,000 per-transaction limit submits twelve $9,800 orders to the same supplier in one afternoon. The per-transaction limit was respected. The aggregate monthly spend was not. The controller finds the discrepancy during the monthly close. Agents are patient and literal. Without aggregate limits, an agent can easily exceed the intended monthly spend while technically respecting every individual transaction limit. These limits must be enforced outside the model, using a deterministic script that checks cumulative spend against the supplier before executing the API call.

Segregation of duties assumes two actors who can disagree. An agent and its own prompt-based guardrail are not two people. If the same vendor provides the agent, the guardrails, and the logging dashboard, the deployment lacks segregation of duties. Furthermore, a manager might approve a draft purchase order at 10:15. At 10:17, the agent refreshes pricing, selects expedited shipping, and submits a more expensive order to a different supplier. The approval has to attach to the exact transaction the supplier receives, not an earlier draft that looked close enough. If the payload changes after the human reviews it, the approval must be re-issued.

The design conversation for agent authority usually starts with dollar thresholds. It should start with reversibility. A $500 action that cannot be undone is more dangerous than a $50,000 action that can. An infrastructure agent changes a production load balancer configuration to resolve an alert. The change is within its allowed parameter range, but the rollback procedure fails because it depends on a previous state value that the agent overwrote. The engineering team built the execution function but not the cancellation function. Authority should scale directly with the speed and completeness of the rollback path.

Human audit trails are legible because humans narrate their intent. An agent’s trail is a sequence of tool calls. If internal audit pulls a record, they need the prompt, the retrieved context, and the system instructions at the exact millisecond of execution. A transaction ID is useless if you cannot reconstruct the state of the agent’s context window. An audit trail must be legible to the person defending the transaction; otherwise, it is just system telemetry. A middleware layer must intercept the API request and bundle the payload, the full prompt, and the model version into a single hashed record.

Vendor updates are change events. A platform vendor adds a new tool to the default toolset in a minor release. The customer’s change management process does not cover sub-processor capability changes. Nobody notices until the agent starts creating tickets in a system it was not supposed to touch. When the agent does something wrong at 2 a.m., the on-call rotation matters more than the policy document. If the person who gets paged cannot roll back the action, the control is aspirational.

The business unit that sponsors the agent owns the financial risk of its actions, even if the IT team provisioned the infrastructure and built the guardrails. When the auditor asks for the name of the person who authorized the agent’s spending limit, that name needs to be on a signed delegation of authority document rather than just buried in a deployment log.