Working in business process automation and exploring AI agents — reading

the research, following the tooling, watching how teams were starting to

deploy them — two topics kept surfacing in almost every serious

conversation: governance and liability.

Who is accountable when an agent makes a consequential decision? How do

you prove what context it had? What happens when it acts on data it

shouldn't have accessed? How do you satisfy a regulator who wants to see

the record? I'm not a veteran agent engineer — I came to these questions

from the automation and process side, developing my understanding of how

AI agents actually work in production and where the real friction is. But

the governance questions didn't require deep hands-on experience to

recognise. They were showing up everywhere: in the research, in the

compliance conversations, in the gap between what the tooling offered and

what real accountability would actually require.

I found those questions genuinely interesting.…