Your Agent Cannot Be Bribed. It Has Nothing to Lose.

You set a number this week. A spend cap, a batch size, a limit above which somebody is asked to look at what the thing you hired is about to do. Perhaps you chose it, or perhaps you accepted the figure a vendor suggested, which amounts to the same thing. Either way the number decides how much goes through unread, and you will not think about it again until something goes through that should not have.

That arrangement is the oldest one in commerce. One party wants something done, another does it on their behalf, and economists call the first the principal and the second the agent. Agency here means something narrower than the word usually carries. It is not autonomy. It is acting on somebody else's behalf, with their money and their name. The literature on what goes wrong inside that arrangement is a century deep and unusually good, so everybody reaching for it to explain AI agents is reaching for the right shelf. The difficulty is that every book on the shelf was written about agents who wanted something.

I went looking for the reassuring version of this and found the opposite in a paper about the people doing the supervising. Margaret Mitchell, Avijit Ghosh and Samir Passi, writing for Hugging Face and Data & Society in August 2026, found that sustained oversight of agents degrades the person doing the overseeing. Approval fatigue sets in. Fluent output starts reading as accurate output. The reviewer becomes the part of the arrangement easiest to exploit. mitchell-oversight The control everyone is relying on is the one that gets worse the more it is used, and that is not a problem you can solve by using it more carefully.

So the claim is this. Handing work to an AI agent is not a cheaper edition of an old relationship. It is that relationship with one of its two controls gone, and the law's answer to the gap is what makes it bite rather than what closes it. In April 2026, American Express released a developer kit for agent-driven purchasing along with a commitment to cover erroneous purchases made by registered agents on its network. amex-ace A card company had looked at the arrangement and concluded that somebody was going to have to stand behind the agent, because the agent could not stand behind itself.

An Airline Argued That Its Chatbot Was a Separate Legal Person

Jake Moffatt's grandmother died on 11 November 2022. Needing a flight at short notice, Moffatt asked Air Canada's chatbot about the bereavement policy and was told a bereavement rate could be claimed back within ninety days of the ticket being issued. The real policy required the request before booking, not after. Air Canada refused the difference. At the British Columbia Civil Resolution Tribunal it argued that it could not be held liable for information provided by one of its own agents or representatives. The chatbot, it said, was a separate legal entity responsible for its own actions. The tribunal called that a remarkable submission. It found negligent misrepresentation, and held that the chatbot was simply part of the website the airline was answerable for, however the words had been generated. On 14 February 2024 it awarded roughly 650 Canadian dollars against a claim of about 870. moffatt-air-canada

It is tempting to file that as a company trying something stupid and getting caught. I think the argument was more serious than that, and I think it comes back with more money attached. The European Parliament's resolution of 16 February 2017 on civil law rules of robotics floated giving sophisticated autonomous machines a status of their own, an idea usually shortened to electronic personhood. Specialists in robotics, law, medicine and ethics signed an open letter against it. They argued that the proposal rested on the incorrect claim that liability for damage would otherwise be impossible to prove. They called it ideological, non-sensical and non-pragmatic. robotics-open-letter Ugo Pagallo, writing in the Royal Society's Philosophical Transactions in 2018, worked through why the debate keeps producing bad answers. People compare unlike things, and the demand for a new kind of person is usually a demand for somebody to be responsible. pagallo-apples Air Canada was not being absurd. It was pointing at a hole and calling the hole a person.

The Frame Is Right. That Is Exactly the Problem.

The principal-agent frame is being applied honestly by people who know it well, which is why this is not a story about villains. It survives because it is flattering. It tells the buyer that the thing they have just bought is a worker, and they already know how to manage workers. It suits the seller too, whose product is priced against a salary it is not structurally comparable to. OpenAI's Services Agreement, effective 1 January 2026, caps each party's total liability at the amount the customer paid in the twelve months before the event that caused the loss. openai-liability That is ordinary commercial drafting and it is in almost every enterprise contract you have ever signed. It also means the most you can recover from the company that built your agent is a year of your own spending. Dan Davies gave the broader pattern its name in The Unaccountability Machine in 2024. An accountability sink is an arrangement that severs the connection between a decision and anybody who can be asked about it. davies-unaccountability Organisations do not stumble into these. They are comfortable, because nobody has to sit in the room afterwards.

The precise accounting is older. In 1976, Michael Jensen and William Meckling defined the cost of any such arrangement as three things added together: what you spend watching the agent, what the agent spends convincing you it is safe, and whatever loss is left over once both of you have finished. jensen-meckling Two of those are moves you can make. The third is the bill. The second move is the one nobody notices, because in working life it is free to the person paying. It is the deposit on the flat. It is the licence that can be pulled, the reference that follows you into your next interview, the surveyor who signs off a wall that later falls down and has to answer for it in front of people whose opinion of him is his living. That is the part an AI agent cannot supply. It owns nothing, it is not going anywhere afterwards, and no professional body will ever strike it off.

The Most Watchable Worker in History

Take the optimistic case seriously, because it is strong. If the first of those three is watching, then AI agents ought to be the best supervised workforce ever assembled. Every action is logged. Every step can be replayed. There is no privacy interest to respect, no morale to protect, no resentment at being monitored, and no limit on how often you can ask what it just did and why. Bengt Holmström's 1979 result on moral hazard says that a contract should be conditioned on whatever signals carry information about the agent's effort. holmstrom-moral-hazard An AI agent emits more such signals in an hour than a graduate produces in a year.

Then notice what that sentence needs in order to work. It is a result about contracts, and a contract has to attach to something the agent minds about. You supervise a junior so that praise and consequence can find them later, and the supervision works partly because they know it is happening. Watching an agent that minds nothing does not change the agent at all. It changes you. What it produces is information, arriving at you, at machine speed, for you to do something about. I should say here that I consult for a company that sells agent verification, so this argument runs against my own commercial interest. I have tested it harder for that reason rather than less.

The Part of a Colleague That Costs You Nothing

Think about what your colleague is actually staking. Not the lawsuit, which almost never happens, and not the disciplinary process, which is slow and rare. It is that they are a person with a future in the same industry as you, and that future is quietly on the table every time they do the work. Nassim Nicholas Taleb popularised the shorthand for this in Skin in the Game in 2018, and the shorthand has been repeated often enough that it has stopped being examined. taleb-skin What is worth examining is how quiet it is. It costs you nothing. It runs at three in the morning when nobody is looking. It covers the enormous surface that supervision cannot reach, which is precisely the surface where things go wrong.

Delete it and the watching has to cover everything alone. Here the arithmetic turns unpleasant. The cost of watching rises with how much you delegate and how fast the agent moves, and volume and speed are the entire reason anyone buys an agent. You cannot purchase the saving without also purchasing the supervision load that eats it. Every organisation that has told itself otherwise has simply not finished counting.

The Number Nobody Was Ever Going to Read Behind

The number in the first paragraph is not a natural feature of the world. Somebody chose it. Somebody decided how much would flow through before a person was asked to look. That decision usually gets made in a room where the client wants the figure high. Saying out loud that nobody will read the queue at that volume would cost you the next phase of the work.

Half a Tonne of Opinion

A horse will refuse a fence. You have committed, you are three strides out, and the animal decides against it and plants its feet, and your stomach carries on forward without you. It is infuriating in a way that is difficult to describe to anyone who has not felt it. You were in charge right up until you were not.

That refusal is also the reason you are alive on top of something that weighs half a tonne and can read the ground better than you can. The horse is not being difficult. It does not want to break its own legs, and it is that wanting, rather than anything that passes down the reins, which has been doing most of the safety work all afternoon. The reins reach an animal that can be hurt. You have spent years calling the refusal an obstacle, and it was the thing keeping you on.

The Law Already Answers This

Agency law never required the agent to be solvent. It required the principal to be answerable, which is exactly why the airline lost. A company that puts an agent in front of the public is the principal, and the loss lands on it by operation of law. Nothing is missing. The loss has simply been placed where it is placed for every other tool a business uses. A hammer has nothing to lose either, and nobody has ever thought hammer delegation was a new problem in economics. The operational version of this is already published. Mohammad Hossein Jarrahi and Paavo Ritala argued in the California Management Review in July 2025 for guided autonomy. The agent works inside clear limits. Those limits widen as it demonstrates reliability. A person is required at defined decision points, and the whole thing sits under a central review team. jarrahi-ritala That is not naive, it does not depend on the agent minding anything, and it is what a serious organisation will actually implement.

The second version of the objection is fairer still, and it is the one that gives me trouble. Human agents are not well secured either. Employees are effectively judgment-proof, limited liability is the norm rather than the exception, references have become so cautious that they carry almost nothing, and people leave. If the stake is thin on both sides, then I am describing a difference of degree, and degrees get managed with process rather than alarm.

Where That Answer Runs Out, and Where It Holds

Putting the loss on the deployer works when the deployer is the party who could have prevented it. That is the condition, and it is doing all the work. Read Jarrahi and Ritala's list again and notice what is on it: clear limits, decision points, review teams, dashboards, an orchestrating agent supervising the other agents. Every item is a form of watching. Not one of them puts anything at stake for the agent, and the orchestrator is watching performed by a second thing that also has nothing at stake. So the whole proposal rests on the control that Mitchell, Ghosh and Passi found degrades under use. Liability without effective control is strict liability wearing a process diagram, and a firm facing that does what firms do: it moves the loss to the cheapest absorber it has. Madeleine Clare Elish, writing in Engaging Science, Technology, and Society in 2019, studied Air France 447 and the Uber vehicle in Tempe. She found that responsibility in these systems gets misattributed to a human operator who had very little real control over what the system did. elish-operator That operator is the person reading the queue, and they did not set the number.

On the second version, I think the objection partly wins and the honest thing is to say where. It wins on the salaried generalist. A junior analyst's stake really is thin, and an essay that pretended otherwise would be flattering its own argument. It loses wherever the human alternative was licensed or reputationally exposed: the surveyor, the solicitor, the pharmacist, the engineer who signs. There a body can end the career, and that is a different object from a reference nobody reads. So the claim narrows, and it is sharper narrow than broad. Delegation to an agent loses its second control decisively where it replaces somebody who could be struck off, and changes rather little where it replaces somebody who could only be let go. The uncomfortable part is that the first group is exactly where the savings look biggest.

The Number You Chose

The arrangement lacks one of the two things that ever made delegation safe, and the law routes the shortfall to whoever is nearest the queue. Whoever picks the number has to price the supervision before the saving. Jake Moffatt asked a chatbot about a bereavement fare after a death in the family, and the tribunal's award still came in short of the claim.