Who Signs for the Agent? A One-Page Accountability Map for Your First Enterprise DDQ

The short answer

Your first enterprise due diligence questionnaire (DDQ) will have an AI section, and somewhere in it is a question that sounds simple: who is accountable for this?

The agent can’t sign that answer. A person does, and your company stands behind it. That’s good news, because it means the hardest AI question in the questionnaire has a concrete answer you can write down this week: a one-page accountability map.

The map has one row per agent you build or run, and each row answers six things:

1. What it does and what it reaches. Customer data, production, code, email, money.
2. Whose identity it runs as. Its own, a shared service account, or a person’s.
3. Who answers for it. One named owner, and a backup.
4. What it does on its own, with a person’s approval, and never. Decided by consequence, not by tool.
5. Who can turn it off, how fast, and when they would. Timed, not assumed.
6. What proves it. Logs that show the agent and the person behind it, and the date of the last test.

Then an executive signs the page, the team reviews it on a schedule, and the board sees a summary. Big buyers already ask for exactly this. Microsoft’s supplier data protection requirements ask every AI supplier to “Assign and clearly define responsibility and accountability for the operation, oversight, and risk management of AI Systems during and after deployment,” and to support “turning features off, including time elapsed until the feature can be turned off” (Microsoft).

Below are the questions in buyers’ own words, why accountability for an agent always lands on a person, and how to decide what an agent does on its own. Then there’s a builder that drafts your map and your DDQ answers in your browser, and a section on what your board should see. That last part is what I’ll be talking about at the AI LAX Summit on Friday.

The questions are already written

You don’t have to guess what the AI section will ask. A big buyer, a government and the companies that write questionnaire templates have published the wording, and it clusters around a few ideas:

• Microsoft’s Supplier Data Protection Requirements, version 12, from March 2026, include an AI section that suppliers confirm every year. Besides the accountability and off-switch requirements above, it asks that the supplier “has a person or group charged with ensuring compliance for AI Systems,” keeps an AI incident response plan “that requires supplier to notify Microsoft,” and accepts that “Any change to the Intended Uses must be disclosed without undue delay” (Microsoft).
• The UK government’s AI Management Essentials, a self-assessment for organizations, asks “Does your AI policy identify clear roles and responsibilities for AI management processes in your organisation?” and “Have you identified who in your organisation will be responsible for addressing concerns when they are escalated?” (GOV.UK).
• Questionnaire templates from vendors go further. Reco’s AI vendor security questionnaire asks “Which actions can the product take autonomously versus with human approval?” and “Is there a kill switch to halt all autonomous activity immediately, and who can trigger it?” It also asks, bluntly, “Who is liable when an autonomous action causes damage: you, the model provider, or us?” (Reco). Kognitos’s request-for-proposal template for agentic AI asks “How is the human reviewer’s identity, decision, and review time captured in the audit log?” (Kognitos).
• The frameworks underneath say the same thing. NIST’s AI Risk Management Framework wants roles and responsibilities that are “documented and are clear to individuals and teams throughout the organization,” and puts decisions about AI risk on “Executive leadership” (NIST). The EU AI Act requires deployers of high-risk systems to “assign human oversight to natural persons who have the necessary competence, training and authority” (AI Act Explorer). After this year’s Digital Omnibus, that duty applies from December 2, 2027 for the high-risk uses in the Act’s Annex III (EUR-Lex).

Here’s how the wording lines up, one example per idea:

Idea	How they ask it	Who asks
Owner	”Assign and clearly define responsibility and accountability” for AI systems	Microsoft’s supplier requirements
Roles	”clear roles and responsibilities for AI management processes”	UK AI Management Essentials
Decision rights	”Which actions can the product take autonomously versus with human approval?”	Reco’s AI vendor questionnaire
Off switch	”time elapsed until the feature can be turned off”	Microsoft’s supplier requirements
Stopping	”risk thresholds or critical conditions under which it would become necessary to cease” using a system	UK AI Management Essentials
Identity	”Do AI features inherit the invoking user’s permissions, or run with elevated service permissions?”	Reco’s AI vendor questionnaire
Records	”How is the human reviewer’s identity, decision, and review time captured in the audit log?”	Kognitos’s agentic AI template
Escalation	”who in your organisation will be responsible for addressing concerns”	UK AI Management Essentials
Change	”Any change to the Intended Uses must be disclosed without undue delay”	Microsoft’s supplier requirements
Liability	”Who is liable when an autonomous action causes damage: you, the model provider, or us?”	Reco’s AI vendor questionnaire

Ten questions, and one page answers all of them. Each one maps to a column you’d want to keep anyway:

AI governance begins during development, not when an enterprise client sends a due diligence questionnaire.

Monisha Prem · Founder and CEO, LexAI by M. Prem Attorneys · October 12, 2026

Load the post from LinkedIn

A potential client has sent me an AI generated institutional grade due diligence questionnaire

And my AI agent is going to answer that

Which he'll comprehend using AI because I'm pretty sure he doesn't understand his own questions

So effectively our AIs will talk to eachother

Sagar Lele (@sagar_lele) · October 12, 2026

The agent can’t sign

Underneath all ten questions is one more: when an agent does something, whose decision was it?

Hacker News argued about that for 99 comments last month, under the title “Who should be held accountable when an AI Agent (accidentally) acts maliciously?” The best answers were less philosophical than the title.

"A computer can never be held accountable, therefore a computer must never make a management decision."

jdkee, quoting a line usually attributed to a 1979 IBM training manual, in the Hacker News thread, September 28, 2026.

"The model's operator is directly liable for any undue harm caused in the course of the model's operation."

bunderbunder, in the same Hacker News thread. The comment goes on to say that this is already how it works for classic machine learning, and that a vendor who misrepresents its model can share the liability.

Tribunals have landed in the same place. In 2024, Air Canada argued before British Columbia’s Civil Resolution Tribunal that its website chatbot was a separate legal entity, responsible for its own actions. The tribunal disagreed: the chatbot was part of Air Canada’s website, and Air Canada was responsible for the information on it (ABA Business Law Today).

The harder fights are between a vendor and its customer. This June, in the lawsuit over Workday’s AI hiring tools, a federal judge let the California state-law claims go forward and revived a disability claim. Workday’s statement put the decisions with its customers: “Our customers maintain full control of their hiring processes and our tools are designed with human oversight at their core” (HR Dive). Whatever the court decides, that’s the conversation your first enterprise customer wants to settle on paper before anything goes wrong.

Listen · Episode 99 with Ged Ossman

I find this freeing. An agent is software. We choose its model, we write its prompts, we grant its permissions and we test it. When it acts, it does what we built it to do or what we let it do. So “who signs for the agent?” isn’t philosophy for a startup. It’s an org chart question, and you can answer it this week.

Who is accountable when an AI agent working for government breaks the rules? OII DPhil candidate Jonathan Rystrom maps three risks agentic systems pose to the state, along with five principles for keeping humans in charge: oii.ox.ac.uk/are-governments-ready-for-ai-agents/

Oxford Internet Institute (@oiioxford) · October 5, 2026

Name a person, not a team

So who? The companies that manage agent identities have started to answer, and they draw a useful line.

Microsoft’s Entra Agent ID separates two roles. “Owners are technical administrators who can manage the configuration and operations of an agent.” “Sponsors are business owners who are accountable for the agent’s purpose, lifecycle decisions, and access reviews” (Microsoft Learn). When a sponsor changes roles or leaves, a built-in lifecycle task can “Transfer agent identity sponsorships to manager” (Microsoft Learn), and if a sponsor ignores an access review, the agent’s access package can simply expire. One detail to know: “Sponsors can be assigned to agent identities after creation” (Microsoft Learn), so an agent can exist for a while before anyone is accountable for it. And the sponsor can be a group as well as a person.

In September, Okta and eleven other companies, including AWS, Google Cloud, Salesforce and CrowdStrike, formed the Blueprint Alliance. Its principles tie each agent to “an accountable human owner or operational team” (Okta). I’d drop the “or,” and I’d make the Entra sponsor a person too. A team can run an agent. Only a person can answer for it in a security review, pick up the phone at 2 a.m., and sign. We made the same case for your people in the week after your SOC 2 report; agents get the same treatment.

Most companies haven’t decided yet. In a Cloud Security Alliance survey commissioned by Aembit, an agent identity vendor, 228 IT and security professionals split on who primarily owns agent identities: security teams 28%, engineering 21%, IT 19% and identity teams 9%. Forty-three percent said they rely on shared service accounts for agents, and 31% let agents run under human user identities (Cloud Security Alliance). VentureBeat’s June survey of 107 enterprises found that “Only 32% of enterprises give every AI agent its own scoped, managed identity” (VentureBeat).

Shared identities matter because they erase the answer to “who.” The OpenID Foundation’s paper on agent identity notes that an agent’s call “is often logged indistinguishably from an action taken directly by the user” (OpenID Foundation). If the log says a person did it, then as far as anyone reading the log can tell, the person did it. Uber’s engineers built the opposite: tokens that carry an “actor chain,” from the user to an on-call agent to an investigation agent, because “Accountability, the ability to answer ‘who did what, when and why’ is critical for auditing” (Uber).

Here’s what goes in the owner columns of the map:

• One named person per agent. Usually whoever decided to build or buy it. They don’t do all the work; they answer for it.
• A backup. For vacations, departures and 2 a.m.
• The team that operates it, listed separately from the owner.
• The identity it runs as. If the honest answer is “mine” or “the shared key,” fix that first. It’s a few days of work, and it makes every other answer on the page true. We covered how in one identity per agent, one job per credential, and the 30-minute credential inventory finds the borrowed keys.

Decide by consequence

The owner answers for the agent. The next columns say what the owner has agreed the agent may do, and Manny Sandhu put the auditor’s version of that question better than anyone this month.

When an AI agent makes a bad transaction, who does the auditor name as accountable?

Manny Sandhu · Senior digital transformation leader, ex-Microsoft · October 5, 2026

Load the post from LinkedIn

I use three tiers, decided by what happens if the agent gets it wrong:

1. Read, summarize and draft. On its own. A person reads the draft before it goes anywhere that matters.
2. Change things you can undo. On its own, or with approval at high volume, as long as every change is logged and you’ve practiced the undo.
3. Anything you can’t undo, that spends money or that reaches a customer. A named person approves it, or the agent doesn’t do it at all.

The third tier is where buyers look first, and it’s where approval prompts actually earn their keep. Ask for approval on everything and people click yes on reflex, which is why we wrote that the human in the loop is going away. Ask only for the irreversible few, name who approves them, and every approval means something. We built the mechanics of that in a named human for the irreversible few. Whoever approves is signing, so the log should record who approved, what they saw and when.

My test for any leadership team: produce the approval record.

Ankitesh S. · AI governance, formerly at Snowflake and Deloitte · October 9, 2026

Load the post from LinkedIn

That trigger deserves its own column. The UK’s self-assessment asks whether you’ve defined “risk thresholds or critical conditions under which it would become necessary to cease the development or use of your AI systems” (GOV.UK), and NIST’s framework wants responsibilities “assigned and understood, to supersede, disengage, or deactivate AI systems” that drift from their intended use (NIST). In plain words: who can turn it off, how long that takes, and what makes them do it. Okta now advertises “an instant kill switch to revoke access the moment something goes wrong” for agents (Okta), and Microsoft asks its suppliers for the time it takes to turn a feature off. So time yours. A game day where someone turns each agent off, and you write down how long it took, is one of the most convincing hours you can spend before a review. It’s also fun, in the way red-teaming your own sandbox is fun.

The map on one page

Put the columns together and the whole thing fits on one page:

Each row has eight parts:

1. Agent and job. A name and one sentence on what it does. If you can’t write the sentence, you’ve found your first problem.
2. Reaches. Customer data, personal data, production systems, code, email and messages, money. Be specific, because reach is what the reviewer is really asking about.
3. Runs as. Its own identity, a shared service account or a person’s account.
4. Owner and backup. Two names.
5. Decision rights. For each tier, on its own, with a named approver, or never.
6. Off switch. Who can turn it off, how long it took when you last tried, and the conditions that make you do it.
7. Evidence. What the logs record, and the date of the last test of the agent’s limits.
8. Last reviewed. The date the owner last confirmed the row is still true.

At the bottom of the page goes one signature, with a title, a date and the date of the next review. Adrian S., who answers due diligence questionnaires for his clients, described fixing a client’s paperwork the same way this month: one dated plan, “with one person at the top who signs” (LinkedIn).

Download the template and fill it in by hand, or use the builder below and export it:

• The one-page map and DDQ answer templates, Word
• The same templates, PDF
• The map as a spreadsheet, CSV

Draw your map right here

Start with the agent that reaches the most: customer data, production or money. Ten minutes per agent is about right. If a field makes you stop and think, that’s the conversation to have with your team before the questionnaire arrives, not after.

The builder checks each row as you go, drafts the answers for the AI section of a DDQ, and exports both. It all runs in your browser.

Interactive · 10 minutes per agent · Runs in your browser

The accountability map: one row per agent

Add each agent you build or run. Name who answers for it, decide what it does on its own, and time the off switch. The checks, the one-page map and your draft DDQ answers update as you type.

Company or product Who signs the map Review it Every monthEvery quarterTwice a year

The builder needs JavaScript. The PDF template has the same columns.

Add an agent Load an example Start over

…agents on the map

…with a named person who answers for it

…tiers that need a named approver

…things to fix before you sign

The one-page map

Draft answers for the AI section

Download the map and answers (.md) Download the map (.csv) Copy the answers

Everything here runs in your browser and is saved only in this browser. The draft answers are starting points: replace each bracket, have whoever signs the map read every answer before it goes out, and leave the liability wording to your counsel.

Have a person review my map →

We get your email, the number of agents, the counts behind each check and your review cadence. Never agent names, owner names or anything else you typed. A person who answers these questionnaires for a living replies with what they'd fix first. No sequence.

Prefer paper? The PDF template has the same columns, blank rows and the signature block.

Answer the AI section from the map

Every question in the table at the top has its answer in one column of the map:

The question	The column that answers it
Who is accountable for each AI system?	Owner and backup, plus the signature at the bottom
What can it do on its own, and what needs approval?	Decision rights, with the approver’s name
Is there a kill switch, who can trigger it, and how fast?	Off switch
What would make you stop using it?	Off switch: the pause conditions
Does it run with its own permissions or a user’s?	Runs as
How is the reviewer’s decision recorded?	Evidence: what the logs record
How do you disclose changes in intended use?	Agent and job, last reviewed, and the review cadence
Who is liable when it causes damage?	Your contract, with the map as the evidence behind your answer

Two habits make those answers land.

Send the map with the questionnaire. A reviewer who can see the whole page asks a few follow-ups instead of fifty questions. It’s the same move Sasha recommended for health system reviews: send the answer pack before they ask.

Treat every answer as a promise, because it can become one. Some customer contracts turn questionnaire answers into warranties, and some rules already want an executive’s name on AI paperwork. California’s privacy regulator now requires risk assessments for uses that include automated decision-making technology for significant decisions, and a member of executive management has to certify the submissions under penalty of perjury, with the first due April 1, 2028 (FTI Consulting; CPPA). When the map is true, signing is the easy part.

If a DDQ is already in your inbox and the deal has a date, our sales support team answers it with you and joins the security call. If your buyer’s AI committee wants a certification behind the map, ISO 42001 is the AI management system standard, and like other ISO management system standards, it asks top management to assign roles, responsibilities and authorities.

What the board should see

Friday’s panel at AI LAX is about fiduciary oversight in the agentic era, which is a formal way of asking whether the board knows enough to do its job. The map is most of the answer.

In Delaware, directors’ oversight duty comes from the Caremark line of cases: boards have to make a good-faith effort to have a reporting system for the company’s central risks, and to respond when it raises a red flag. Pierluigi Matera, a visiting professor at Boston University School of Law, argued in March that AI doesn’t change that standard so much as the evidence of meeting it, and that “Delegation does not eliminate oversight, it heightens the need for clarity about accountability” (CLS Blue Sky Blog). NIST says it more plainly: “Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment” (NIST). None of this is legal advice, and your counsel will have views. The practical point holds either way: someone has to be able to show the board who answers for each agent.

Boards are catching up. EY’s review of the 2026 proxy season found that 37% of S&P 500 companies cited AI experience for at least one director, up from 11% in 2022, while the share of individual directors with AI experience cited rose from 1% to 5% (Harvard Law School Forum on Corporate Governance). Most boards will lean on management for the detail, which is exactly why the detail should fit on one page.

Good governance should make accountability executable.

Probal Lala · Growth-stage CEO and board chair · October 9, 2026

Load the post from LinkedIn

Directors are talking about it this week. The NACD Directors Summit runs through Wednesday in the Washington, DC area, and Alessandra Ginante wrote that Sunday’s workshops covered AI accountability and measurable outcomes:

A common thread: turning technology into results requires clarity about decisions, accountability, and capabilities across management and the board.

Alessandra Ginante, Ph.D. · Founder and CEO, Videre, and board director · October 12, 2026

Load the post from LinkedIn

Here’s what I’d put in front of a board every quarter. It’s the map, summarized:

Your insurer is asking too, in its own way. Insurance Journal reported in August that W. R. Berkley introduced an “absolute” AI exclusion last year for its directors and officers, errors and omissions, and fiduciary liability products, and that Verisk’s ISO has published generative AI endorsements for general liability policies (Insurance Journal). Read your renewals, ask your broker how a loss caused by one of your agents would be treated, and bring the map. A signed page with owners, limits and a timed off switch is a better conversation than a promise.

For the disclosure side of board oversight, Kayne McGladrey of Hyperproof talked about why SEC 10-K disclosures matter on episode 56. For governance, Abhi Sharma of Relyance AI covered what businesses need to trust AI on episode 70. And if you’re building the board deck itself, the ownership and claims row of our security slide is this map in one line.

Five working days to a signed map

Most of this is writing down decisions you’ve already made, and making the two or three you haven’t. A week is enough if one person owns it.

1. Day 1: list every agent. Product features and internal tools, including the one a single engineer set up on a Friday. The 30-minute inventory gets you most of the way, and shadow AI detection finds the rest.
2. Day 2: owners and identities. One named owner and a backup per agent. Move every agent off borrowed and shared credentials onto its own identity.
3. Day 3: decision rights. Tier each agent’s actions by consequence, put a named approver on the irreversible few, and write down what it never does.
4. Day 4: off switches and evidence. Turn each agent off and time it. Write the pause conditions. Check that the logs show the agent, the person it acted for and any approval. Test each agent’s limits and record the date.
5. Day 5: sign it. The executive reads every row and signs. Send the board its one-page summary, draft your DDQ answers from the map, and put the next review on the calendar.

If you’d rather do it with people who have done it before, our AI access control audits cover the identity and reach columns, and our EU AI Act program covers the human oversight duties if you sell into Europe.

See you Friday in Playa Vista

The AI LAX Summit is this Friday, October 16, at Google in Playa Vista, Los Angeles. It’s an official LA Tech Week event. I’m on the panel for the summit’s Governance, Trust & Security theme, “Fiduciary Oversight in the Agentic Era,” from 2:50 to 3:25 PM Pacific. Registration is approval-based through the summit’s site, and the panel is on our events calendar.

I’ll bring the map. If you’ve drawn yours, bring it too. I’d love to hear which column was hardest to fill in, because that’s the one your next buyer will ask about.

The agent does the work. A person answers for it. Put both on one page and sign it, and the hardest question in your first enterprise DDQ becomes the easiest one to answer.