The Agent Liability Gap: Nobody Has Decided Who Pays When Software Acts

An agent issues a refund that should not have been issued. An agent emails a customer a commitment the company cannot honour. An agent runs a data migration and deletes a table that was not in scope. In every case something of value moved, somebody is worse off, and the money to fix it comes from a specific budget. The question of whose budget has no settled answer anywhere in enterprise software right now, and the absence of an answer is not a legal curiosity. It is the reason a large share of agent pilots stop one step short of doing anything that matters.

The pattern is consistent enough to be diagnostic. A pilot runs with a human approving every action, performs well, and produces a business case that depends entirely on removing the approval step. The removal never happens. It is rarely blocked by model quality, and rarely by security, which has a mature process for saying yes with conditions. It stalls because no executive will sign the document saying this system may take unreviewed action on behalf of the company, and no such document exists in a signable form, because the answer to what happens when it goes wrong is currently that the deploying enterprise absorbs it entirely, with no recourse worth exercising.

That is the gap. Not an unanswered legal question in the abstract, but an unpriced risk sitting between three parties who have each quietly assumed somebody else holds it. The gap is closing, slowly, through contracts rather than legislation, and the shape it takes will decide which vendors get to sell autonomy and which ones keep selling copilots.

Where the Loss Lands Today

Three parties participate in every agent action, and their exposure is wildly asymmetric.

The deploying enterprise holds almost all of it. It authorised the deployment, granted the credentials, configured the scope, and to the counterparty on the other side of the action it is simply the company that did the thing. Nothing about an agent changes the enterprise's obligation to its own customers, which is the most important fact here and the one most often skipped. A wrongly denied claim is a wrongly denied claim. A regulator examining an adverse decision does not accept "the model produced it" as an account of what happened, any more than it accepts "the junior analyst produced it".

The model vendor holds nearly none of it. Standard enterprise terms disclaim consequential and indirect damages, cap total liability at a multiple of fees paid over a trailing period, and place output accuracy on the customer. The indemnities that exist are narrow: intellectual property indemnity on output, which several vendors now offer with conditions, protects against a copyright claim, not against the agent having sent the wrong wire. That is rational from the vendor's side, which cannot see the customer's data, the tools it connected, or the authority it granted. It is also how enterprises discover that a platform fee cap is a rounding error next to one mispriced recommendation shipped ten thousand times.

The tool and integration provider is usually out of scope entirely. The payment API, the CRM, the internal service the agent calls: each executed a properly authenticated request from a credential the enterprise issued. There is no defect to point at. The system did exactly what it was asked, which is the whole problem, and this is the layer where the identity and access architecture is doing the real work, because the credential the agent presented is what converted a model output into a consequence.

Read down the middle column and the structure is clear. Every party except the enterprise has capped its exposure, and the enterprise has no counterparty capable of absorbing what it holds. That is not a market that has allocated risk badly. It is a market that has not allocated it at all.