AI-Agent Accountability Needs Evidence, Not Just Explanations

An investigation brings the evidence question into focus

The US Federal Trade Commission is investigating potential consumer risks associated with artificial-intelligence systems developed by OpenAI, Anthropic and other companies.

Reuters reports that the FTC intends to issue formal demands for information and compel testimony from executives. The agency is also expected to seek information from METR, which has investigated security incidents involving agentic AI.

This is an investigation—not a charge, legal finding or determination of liability.

It nevertheless brings an important operational question into focus: can an organisation demonstrate what an AI agent was instructed to do, what authority it possessed and what actually happened?

An objective does not authorise every method

An organisation may instruct an agent to research information, test a system or complete a business task.

That objective explains the intended result. It does not necessarily authorise every action the agent might select while pursuing it.

Consider an agent asked to test its organisation's own application. That instruction would not automatically authorise the agent to:

• Access an unrelated external service.
• Use credentials discovered during the task.
• Retrieve non-public material.
• Run commands on another organisation's system.
• Change or delete data.
• Continue through a different route after access is refused.

If the agent changes tools, targets or methods, the new action may require a fresh authority decision.

The distinction is straightforward: an instruction describes what the agent is trying to achieve; authority determines which actions it may use to achieve it.

Intended controls are not evidence that controls operated

An organisation may have genuinely intended an agent to remain within a controlled environment.

An investigation may still require evidence showing what occurred during the event. That evidence could need to connect:

• The model and agent version.
• The objective and operational context supplied.
• The tools, networks and permissions available.
• Each consequential external action proposed.
• The authority applicable to that action.
• Whether a control allowed, denied, modified or escalated it.
• Whether the agent replanned after an intervention.
• The instruction that reached the external system.
• What that system reported as the result.

Without this chain, an organisation may be able to describe how its controls were designed without demonstrating how they operated for the action under examination.

This does not mean preserving every prompt or exposing unnecessary personal, proprietary or security-sensitive information. The evidence should be proportionate to the action and the claim being assessed.

Accountability extends beyond the model

An investigation may examine whether a model behaved unexpectedly. It may also examine the wider system through which that model was instructed, connected and governed.

Relevant questions could include:

• Why could the agent reach the external system?
• What privileges had been delegated?
• Which controls were active?
• Who was responsible for reviewing their operation?
• What became visible when the activity was detected?
• When was the event escalated or disclosed?
• What changed afterwards?

The resulting accountability chain may involve a model provider, application developer, deploying organisation, evaluator, operator and external system.

Evidence should distinguish their respective actions. Saying that “the AI did it” does not explain who established the objective, supplied access, evaluated authority, operated the surrounding controls or recorded the resulting effect.

Independent evaluation needs a defined boundary

Reuters reports that the FTC intends to seek information from METR, an organisation that has investigated agentic-AI security incidents.

That does not imply wrongdoing by the evaluator. It shows why an investigation may need to understand:

• What an evaluation was designed to test.
• Which environment and permissions were approved.
• What information was available to the evaluator.
• What evidence was preserved.
• When unexpected activity became visible.
• What was reported to the developer or affected organisation.

An evaluation can examine model behaviour. It does not automatically authorise live external actions or independently prove what occurred inside another organisation's system.

PF Systems' bounded relevance

PF Systems' relevant proposition is not determining liability or answering a regulator's questions on behalf of an organisation.

PF Memory can supply the governed context used when a proposed action is evaluated. PF Kernel can return Allow, Deny, Modify, Step Up or Stop the Line. PF Core can preserve linked evidence of that governed evaluation.

ClientBridge can connect participating systems without inheriting Kernel authority. Evidence from the executing system remains necessary to establish what instruction it received and what became effective.

Proof Harness can qualify the resulting evidence against a defined exercise without certifying the agent. PF Trace can display preserved evidence without creating it.

PF Systems does not establish compliance with US consumer-protection law, determine legal liability, guarantee safe operation or make the underlying probabilistic AI deterministic.

Test the evidence before it is needed

A suitable first exercise would use controlled replicas, synthetic actions or replayed proposals. It would not connect PF Systems to live consequential execution.

The exercise could test whether an organisation can reconstruct:

• The agent's objective and operating context.
• The authority available for a proposed action.
• Any intervention and subsequent replanning.
• The instruction presented to an executing system.
• The result reported by that system.

This would not prove that every future action was safe. It would establish whether one defined workflow produces attributable evidence that can be examined when something goes wrong.

The FTC investigation has not established that any organisation broke the law. It does make the operational requirement clearer: when an AI agent is investigated, accountability needs evidence showing who instructed it, what authority it possessed, how controls operated and what actually became effective.