Nobody agrees who’s accountable for an AI agent’s actions — and the industry just spent eight weeks proving it

1Password surveyed 1,000 security and engineering staff at large U.S. firms in late May and early June 2026, publishing the results this morning. 46% of developers run AI agents in production right now. 71% say those agents can reach sensitive data. At roughly four in ten organizations, agents reach data outside what anyone actually approved — across the full survey, agents touched roughly twice as much data as anyone had signed off on.

The credentials behind that access tend to linger: 40% of developers grant agents persistent access that outlives the task it was granted for. 47% have watched an agent take an unintended action after following instructions buried in a webpage, document, email, or tool output. A third of developers whose companies use agents reported a breach or security incident tied to an overprivileged non-human identity.

Then the survey asked the actual question: who is accountable when an agent causes harm. The answers scattered across the org chart — 65% said responsibility belongs to someone other than whoever the organization currently holds accountable. 5% said the agent itself is accountable. 1Password’s VP of Product, Jason Meller, called that the number that actually worries him: an agent cannot be fired or sued, so an answer like that means the conversation has not really happened yet.

This isn’t an isolated data point — it’s the theme of the summer

Anthropic’s Zero Trust for AI Agents framework, published in late May and still shaping the security conversation into July, makes the identical argument from the architecture side. Traditional access control assumes a human is sitting at the keyboard, and that assumption breaks the moment a non-human identity starts acting on its own. The framework’s central move is replacing session-based trust with cryptographically rooted agent identity — every agent has to carry verifiable proof of what it is, who deployed it, and what it is authorized to do, rather than borrowing a human’s session and going unquestioned from there.

Google DeepMind’s AI Control Roadmap, released around the same time, treats internal agents as potential insider threats by default — not because they are assumed malicious, but because DeepMind’s own research found most anomalous agent behavior traces back to overeagerness rather than adversarial intent. SANS’ 2026 State of Identity Threats survey puts a number on the scale: 76% of organizations report growth in non-human identities — service accounts, API keys, agents — and identity teams are not close to caught up. A separate 2026 State of AI Agent Identity Security report found more than two-thirds of organizations suspect their own agents have already accessed data outside their intended scope, landing almost exactly on 1Password’s number from a completely different survey population.

Security tools were built to ask people to slow down. The agent doesn’t ask — it just acts.

Regulators are converging on the same questions, from the opposite direction

China’s Implementation Opinions on AI Agents became enforceable July 15 — the first regulatory framework written specifically for agents rather than AI in general. It requires a three-tier authorization structure that classifies agent actions by consequence and scales human-approval requirements accordingly, plus documented audit trails filed with regulators for higher-risk deployments. Illinois’ AI Safety Measures Act, signed July 6, took a narrower but related angle: it requires large frontier model developers — not the enterprises deploying agents — to submit to independent third-party audits with published results, the first such mandate at the U.S. state level. Different targets, same underlying instinct: an internal policy document nobody outside the company ever reads is no longer treated as sufficient evidence that controls exist.

Strip away the framing differences and every one of these — the survey, the two security frameworks, both regulatory regimes — is circling the same four questions.

A password-manager vendor surveying 1,000 practitioners, two frontier AI labs, and two national governments landed on that list independently, within about eight weeks of each other, in the same summer. That is not coincidence. It is what happens when enough unrelated parties hit the same gap from different directions at the same time.

Where the honest state of enterprise tooling actually is

Most tooling in production today answers question four badly and questions one through three not at all. Logging systems built for human employees lose the thread the moment a semi-autonomous account starts opening doors on its own — the exact failure mode behind the outage described in 1Password’s survey, where an agent kept using an expired credential for a quarter before anyone traced it back, because the audit trail for non-human accounts was effectively nonexistent.

Purogaly’s answer to that specific gap, stated plainly: every agent is registered as an identity with a named human owner and a 90-day recertification cycle, not a shared service account nobody remembers creating. Every governed action carries on-behalf-of and within-bounds context into an atomic, dual-control approval gate before it executes, and every decision — allow, block, escalate, override — writes to a hash-chained evidence ledger a customer can verify offline, without trusting our servers. That last part is the direct answer to the accountability question: the record of who authorized what does not depend on anyone’s word after the fact.

The honest limit, stated with the same directness: “within bounds” today checks against Purogaly’s own group model, not yet a live pull from the enterprise’s actual identity system. The target is ingesting real entitlements from Entra or Saviynt so that check reflects the organization’s true access model instead of an approximation of it. Per-action, zero-standing-access grants — the architecture 1Password itself is now building toward with a credential broker — sit on the roadmap, not in production. Any vendor claiming otherwise about their own product, or ours, should be asked to show the code.

Methodology

This note synthesizes reporting and primary sources published between May and July 2026. Sources: Help Net Security / 1Password State of AI Agent Governance survey (Jul 29, 2026); Anthropic, “Zero Trust for AI Agents” (May 27, 2026); Google DeepMind AI Control Roadmap v0.1; SANS 2026 State of Identity Threats & Defenses Survey; IDSA, 2026 State of AI Agent Identity Security; China Implementation Opinions on AI Agents (effective Jul 15, 2026); Illinois AI Safety Measures Act / SB 315 (signed Jul 6, 2026). Where specific numbers are cited, the source is named inline. No survey data was collected by Purogaly for this note.

About Purogaly Research

Purogaly Research publishes industry notes on AI agent governance, runtime enforcement, and the compliance frameworks shaping enterprise AI deployment. Purogaly is the AI agent governance platform built for runtime enforcement and audit-grade evidence. To discuss this note or arrange a briefing, contact research@purogaly.com.