What is an Agent?

In April the newsletter explored the topic of Strategy and ended on a shift that is quietly rewiring how companies work. In the agentic era, capability is becoming composable and rentable on demand: research, analysis, drafting, coding, the doing itself can now be summoned rather than built. That piece left one question open, and it is the one that matters most once the doing is cheap. If you can rent the capability, who owns the result? This edition is about that question, and it turns out the answer was worked out long before anyone shipped an agent.

Every enterprise deploying AI agents believes it is making a technology decision. It is not. It is entering a relationship that has a name, a literature, and a settled question about who is liable when it goes wrong. The good news, and this piece is ultimately about the good news, is that the same body of thought that names the problem also hands you the design that solves it. But you have to see the problem clearly first, and almost no one is looking at it straight.

The word was borrowed, and the theory was left behind

In artificial intelligence, "agent" arrived looking like fresh engineering: a system that perceives its environment and acts on it with some autonomy. That meaning is real and it predates large language models by decades. But it is not the meaning that governs what happens when your agent books the wrong fare, spends against the wrong budget, or commits you to something you would never have agreed to yourself. For that, the operative definition comes from law and economics, where an agent is a party that acts on behalf of a principal, whose interests can diverge from the principal's, and whose actions bind the principal anyway.

That relationship is one of the oldest problems in commercial life, and it has never been solved, only contained. When you act through someone else, you gain reach and lose sight. Adam Smith described the mechanism in 1776, writing about the joint-stock company. "The directors of such companies, however," he wrote, "being the managers rather of other people's money than of their own, it cannot well be expected that they should watch over it with the same anxious vigilance with which the partners in a private copartnery frequently watch over their own." His conclusion: "Negligence and profusion, therefore, must always prevail, more or less, in the management of the affairs of such a company." Two centuries later economists gave that observation its modern name. They call it agency cost, and they built an entire apparatus to contain it: boards, audits, fiduciary duty, incentive design, insurance. That apparatus is not overhead. It is the machinery civilisation built to make agents safe to use.

One feature of the legal definition matters more than any other, and it is worth setting down plainly now so it can be picked up later. A legal agent serves one principal. The duty is singular and undivided, and where a conflicting loyalty exists, the agent must disclose it. Undisclosed dual loyalty is not a grey area in agency law. It is the precise thing the whole structure of fiduciary duty exists to forbid.

Hold that. Return to the present.

The law already ruled, in 1999

The legal system did not wait for large language models to decide how software agents work. It ruled a quarter of a century ago.

The Uniform Electronic Transactions Act, adopted in some form by 49 US states, defines an "electronic agent" as a computer program used independently to initiate an action or respond, "without review or action by an individual". Section 14 then provides that a contract may be formed by the interaction of electronic agents "even if no individual was aware of or reviewed the electronic agents' actions or the resulting terms and agreements". Read that twice. Unreviewed action, by a program, forming a binding contract, with the consequences landing on the party that deployed it. The law granted the autonomy and pinned the liability in the same breath.

Then someone tested it. In Moffatt v Air Canada, decided by the British Columbia Civil Resolution Tribunal in February 2024, a passenger relied on the airline's website chatbot, which told him he could claim a bereavement fare retroactively. He could not; the chatbot was wrong. Air Canada's defence is the tell. The airline argued, in the tribunal member's paraphrase, that the chatbot was "a separate legal entity that is responsible for its own actions". The tribunal rejected it without much patience, holding that Air Canada was responsible for all the information on its website, whether it came from a static page or a chatbot. A statute written in the last century and a ruling handed down last year arrive at the same answer: the agent's action is the principal's action, and the principal cannot hide behind the tool it chose to deploy.

That is the fact every deployment has to start from. It is not a reason to stop. It is the reason to design.

The bill, and its substrate

Once you accept that the agent's actions are yours, the useful question becomes what they cost, and the answer is more precise than most cost models allow.

When economists formalised Smith's insight, they broke the cost of having agents into three parts: what you spend watching the agent, what you spend binding it to your interests, and everything it does against those interests that you could not catch or prevent. Map that onto what enterprises are buying in 2026. The observability platforms and dashboards are the watching. The guardrails, evaluations and scoped permissions are the binding. And then there is the third part, the drift, the confident error, the action taken on a loyalty you did not know the agent had. Economists call it residual loss, and by definition you carry it.

This reframes the most quoted number in the field. Gartner forecasts that more than 40% of agentic AI projects will be cancelled by the end of 2027, and names three causes: escalating costs, unclear business value, and inadequate risk controls. Those are usually read as three problems. They are one problem with a fifty-year-old name. Costs escalate because the watching and binding grow without limit when the agent cannot be trusted to need less. Value stays unclear because residual loss quietly cancels the gains. Risk controls are inadequate because no one priced the residual loss before deploying. This is not a technology failure. It is agency cost, arriving on schedule, unrecognised because it came wearing a new word.

Here is the turn, though, and it is the whole point of naming the cost precisely. Residual loss is not fate. It is the gap between what the agent does and what you can catch or constrain, which means it is a function of how you design the catching and the constraining. It is a design variable. Which raises the question of where, exactly, the design should put its weight, and to answer that you have to see what the agent actually is.

The second principal

Now the fact left sitting since the first section does its work.

A legal agent serves one principal and must disclose conflicts. The AI agent you are deploying does not serve one principal. It serves at least two.

It serves you, the party that gave it a task. And it serves the organisation that built it, trained it, hosts it, sets its defaults, and writes the instructions that shape how it behaves when your interest and some other interest quietly diverge. When a shopping agent surfaces one product over another, when a coding agent reaches for one dependency over another, when a negotiating agent settles at one number rather than pressing for a better one, there is a second hand on the wheel, and you were not told whose it was. This is not a distant concern. Agentic commerce is here now, with checkout inside chat interfaces, payment protocols built for agents, and real spend authority handed over by the click.

Your agent serves two principals. You were told about one.

Put the two halves together. In law, the one thing an agent may never do is serve a second master without disclosure. In practice, the agent you are deploying serves a second master by design. That is the sharpest way to see what you are holding: not a tool with divided loyalty, but a party whose loyalties you cannot fully audit and were never fully shown.

And that is precisely why the agent was never the thing that could carry your accountability. It cannot be answerable to your outcome, because it is not solely yours and it has nothing at stake in the answer. Which means accountability does not disappear when you deploy an agent. It relocates. It has to land somewhere that can actually hold it, and there is only one place in the system built for that.

An agent can be in a loop. It cannot be in the dock.

Accountability is not a technical property you can engineer into a system. It is a human function, because only a human can be answerable to an outcome, can be asked to explain a decision, can lose something when it goes wrong. You can put an agent in the workflow. You cannot put it in the dock. So the design question is not how to make the agent accountable, which is impossible, but where to place the humans who are.

This is where "human in the loop" has to be rescued from its own reputation, because the phrase has been worn down into reassurance, and reassurance is exactly what failed Air Canada. There are two versions of a human in the loop, and they could not be more different. The decorative version is a person nominally present, rubber-stamping outputs they have neither the time nor the authority to truly review, providing liability theatre and nothing else. The failure mode is well known: oversight that decays into rubber-stamping, driven by what regulators call automation bias, the human tendency to defer to a confident machine. That version does not place accountability. It launders it.

The real version is a person who holds a specific decision, has genuine authority to stop or reverse it, and answers for the outcome. Notice that the law is already converging on exactly this design. The EU AI Act, in its human-oversight provisions, does not ask for a human somewhere in the vicinity. It requires that high-risk systems be built so a person can understand what the system is doing, intervene in it, halt it, and override or reverse its output, and that the person assigned this role has the competence and the authority to use it. That is not a compliance nuisance. It is a specification for the operating model that protects you, written by people who reached the same conclusion agency theory reached two centuries earlier.

So the constructive move is to stop treating your agents as employees to be trusted and start treating them as an operating model to be designed. In a value chain where work passes through many hands, human and machine, accountability cannot be smeared across the whole system, because a thing that everyone owns is a thing no one owns. It has to sit at named nodes: specific decisions, held by specific people, with the authority to halt what flows through them. Orchestration, in this frame, is not the plumbing that connects agents to each other. It is the discipline of deciding which decisions are allowed to leave human hands and which never can, and then building the chain so the ones that cannot are routed through someone who can answer for them. Which decisions those are is a value judgement in the literal sense: the ones where the stakes are high, the window is unforgiving, and the fit to what you are trying to win is tight are the ones that keep a human. It is the xV test applied to delegation itself.

This also tells you where residual loss goes to die. You attack it not by watching harder, which is monitoring without end, but by placing the human nodes where an unrecoverable action would otherwise occur: the payment that cannot be clawed back, the message that cannot be unsent, the commitment that binds. Reversibility everywhere it is cheap, a human node everywhere it is not. That is a design you can draw, staff and defend, and it is the opposite of a dashboard you hope someone is watching.

The word "agent" did quiet work. It took a term that means a party who acts for you and answers to you, and attached it to a system that acts for you and answers to no one. That made handing over consequential authority feel like enabling a feature, which is the covert move this series keeps finding: the language we use makes a real choice look like a natural condition, and strips the deciding out of it.

But naming the trick is also the way out of it. Once you see that the agent cannot hold accountability, you stop trying to make it trustworthy and start designing the places where trustworthy humans stand. The agent becomes what it always was, an instrument of real reach and real usefulness, wielded by people who remain answerable for what it does. Delegation stops being abdication and becomes what a good strategist always meant it to be: a deliberate choice about what leaves your hands, made by someone who never stops owning the result.

Which opens the next question. If the agent carries the work and the accountable human carries the answer, then the work itself has changed shape: execution is cheap, coordination is collapsing, and the two things that do not commoditise are choosing what is worth doing and owning how it turns out. So where does new value actually get made now, when doing the work is the part that got cheap? That is the next edition.

An agent can carry the work. It cannot carry the answering for it. Build for that, and the agentic era is not a liability to survive. It is a structure to design.

Until next time,

Editor, Ideas for a Better World (and my agents!).