Every major AI lab is currently racing to ship autonomous agents - software that doesn’t just answer questions but takes actions: booking meetings, writing and executing code, filing support tickets, browsing the web on your behalf. Anthropic has Claude’s computer use capability. OpenAI has Operator. Google has Project Mariner baked into Gemini. The capability exists. What doesn’t exist, in any serious form, is a shared understanding of what these agents should be allowed to refuse.
This isn’t a hypothetical future problem. Enterprise customers are already deploying agents with access to internal databases, email systems, and procurement tools. The agents are making decisions - small ones, mostly - that previously required a human click. The speed of adoption has quietly outpaced both internal policy at the companies deploying these tools and any regulatory clarity from governments that are still, in 2026, largely debating foundation model transparency.
The Gap Isn’t Technical
The interesting thing is that labs have thought hard about certain failure modes. Prompt injection - where a malicious instruction embedded in a webpage hijacks an agent mid-task - is a known attack vector, and researchers at places like DeepMind have published on defenses. Rate limiting, sandboxing, and confirmation steps before irreversible actions are all implementable. Some products implement them; many don’t by default.
What nobody has seriously standardized is the decision boundary problem: under what circumstances should an agent pause and ask a human, versus proceed? Different vendors are making different calls, and enterprise IT teams are inheriting those calls without necessarily knowing it.
The Liability Question Is Going to Force This
The governance conversation will sharpen the moment something goes wrong at scale - an agent authorized to handle vendor payments misreads an instruction, or one with HR system access leaks salary data while executing a legitimate task. At that point the question of who owns the decision the agent made becomes very legally uncomfortable.
Right now, most enterprise contracts push liability back to the deploying organization. The AI vendor supplied the tool; the company configured it. That framing will be contested, probably in court, probably soon.
Builders are moving faster than buyers understand and faster than regulators can track. That’s not unusual for a new technology. What is unusual is the degree to which the actions being automated - sending money, accessing records, communicating externally on someone’s behalf - carry real-world weight that earlier generations of software automation simply didn’t.
The agents are already deployed. The rules for them are still being written in pencil.