An AI agent can't be held to account. It has no job, no manager, and nothing to lose. So the accountability has to sit with a person, and that person has to be named before the agent starts work rather than found afterward.
What the accountable human owns
What the agent is allowed to reach, and what it isn't
The review of what the agent actually did, on a set schedule
The call to shut it off when the work it was built for ends
The answer to "who said this agent could do that" when someone asks
Where teams get it wrong
The name on the record is a team, not a person. "Platform Engineering owns it" feels like an answer. It isn't one. When something goes wrong, a team can't be asked what it was thinking, and every member of it reasonably assumes someone else was watching.
Here's a concrete one. An engineer builds an agent to clean up stale cloud resources, then changes jobs. The agent keeps running. Its credential stays valid because the credential belongs to a service account, not to the engineer who left. Eighteen months later it deletes something that was still in use, and nobody on the current team knows why the agent exists or who approved its access.
The fix is small and unglamorous. One column in the agent inventory, holding one human name, kept current the same way an on-call rotation is.