Home / Articles / Who owns the words: agents can make decisions, but they cannot hold responsibility

Who owns the words: agents can make decisions, but they cannot hold responsibility

By Dinis Cruz · 2026-10-12 · article v1.2.0, 3 versions · site v0.7.86 · agentsaccountabilityresponsibilityagencyanthropomorphismdisclosureagent-behaviour-policyriskmandateai-modelswritingarticle

Abstract: One of the early users of the agentic workflow behind agent@riskmandate.ai wrote back with a question I think matters a great deal in 2026. If the agents only gather and draft, and I review, sign off and press send, does presenting them as a team imply an agency they do not have? What a recipient needs is to know who owns the decisions and the responsibility, and to talk to that person. Would they ever need to go to the agents, around me? And what can the agents do without me? This is my answer. What we have today are not sentient beings; they are far richer than "predicting the next word", and they are mirrors that can simulate any emotion, which is why we anthropomorphise them, as people did with ELIZA in the sixties. Since models started running in loops and calling tools, they make real decisions. Responsibility does not travel with those decisions. It stays with whoever granted the reach and set the mandate, which is RiskMandate's line: the moment of authorisation is the grant. Talking to the agents is normal; going around me is not, and the only party who would try is an attacker with an injected instruction. What the agents may do without me is a separate question, answered in advance by a published policy. The disclosure is not a team to manage; it is a label on how the words were made, because people and models should read machine-written text differently. The best analogy is an employee with a job description, and an Agent Behaviour Policy is that job description, published. And the fluent writing these agents produce was never the real value.

In short

• The question is the right one. An early user of our agentic workflow asked who owns the words, and whether they would ever need to talk to the agents rather than to me. In 2026 that is not a philosophical aside; it is the question.
• These are not sentient beings. They are far more than "predicting the next word", and they are not someone on the other side either. They can simulate any emotion, and they mirror whoever talks to them.
• Models in loops make decisions. Every tool call is a choice. That is new enough to matter and old enough to be ordinary.
• Responsibility does not travel with the decision. It stays with whoever granted the reach and set the mandate. The moment of authorisation is the grant.
• Talking to the agents is normal. Going around me is not. Nobody legitimate needs the agents to act without the accountable person; the only party who would try is an attacker, with an injected instruction.
• What the agents may do without me is a different question. It is answered in advance, by me, in a published policy, which is an authorisation, not a bypass.
• Disclosure is a label, not a team. People and models should read machine-written text differently. The recipient deserves to know how the words were made, and to deal with one accountable person.
• An agent is an employee with a job description. Some agency, inside a role. An Agent Behaviour Policy is that job description, published, with a feedback loop.

The question

One of the early users of the agentic workflow behind agent@riskmandate.ai wrote back, at the end of an otherwise practical email, with a digression that deserves a proper answer. Paraphrasing: the setup implies the agents have a certain agency, yet I had said they only collect and draft, and that I review, refine, sign off and press send. So, for a recipient, does it matter how many assistants I use, artificial or human? What matters is who owns the decisions and the responsibility behind the words, and being able to talk to that person without intermediate hoops. Then the probing question: will there ever be a case where they need to address the agents directly, without me? If not, the point stands. If so, a better question appears: what can the agents do for them without my full involvement? They could also see why someone who builds agentic tools would want to show them working, and were happy to carry on.

I think the question is exactly right, and it goes to the heart of what RiskMandate is about: who is accountable, who authorised what, and what the agent was allowed to do. So here is the answer, and the reasoning under it.

What we have today

The first thing to say plainly is that what we have today are not sentient beings. We might get there; we are not there.

The second is that the usual description, "predicting the next word", is accurate and demeaning at the same time, and I have argued that for a long time. My working picture is that these models build enormous multi-dimensional graphs of how things in our language connect, and that they have discovered relationships and patterns in our own language that we had not noticed ourselves. A prompt, in that picture, is a kind of real-time fine-tuning: you are pulling that graph towards the part of it you mean. Yes, the model predicts the next word. To be honest, so do I.

What follows from that is uncomfortable and important. A model that has learned the whole of our language can be anybody. It can simulate any emotion, because that is what it learned from. And it mirrors whoever talks to it. I am polite to models, and they are polite back, because that is who I am. Friends of mine say their models swear at them; that is because they swear at their models. The more you talk to it, the more you tune the mirror to reflect you.

We are also extraordinarily good at assigning human emotions and intentions to objects. In 1966 Joseph Weizenbaum's ELIZA was a short program that matched patterns and reflected a person's words back as questions. His own secretary, who knew exactly what it was, asked him to leave the room so she could talk to it in private. If ELIZA could do that, a model that can sound like anybody will do much more. We have passed the point where a model can pretend to be a human convincingly. That does not make it one. It does not have the intent, and it does not carry the responsibility.

Decisions without responsibility

Here I want to be precise, because both of the usual positions are wrong. Models do make decisions now. Once a model runs in a loop and can call tools, every step is a choice: do I search or fetch, which source, call this function or that one, what happens next. Agent loops are not new, but they became mainstream and reliable this year, and that is why it now feels like the real thing.

What these models are, in practice, is very capable multiple-choice decision machines that can go in almost any direction, because for them there is a connection between almost any A and any B. That is exactly why direction matters more than capability, the argument of Places of highest leverage: when an entity can go anywhere, the scarce thing is focus, and somebody has to provide it.

And the responsibility does not move with the decision. It stays with whoever granted the agent its reach and set its mandate. RiskMandate puts it in one line in ten questions: the moment of authorisation is the grant, not the mandate. If I give an agent access to my mailbox and my drafts, I authorised everything it can reach, at that moment, whatever it later does. In my setup the agent decides which facts to gather and which words to propose; I read, change, approve, sign and send. The decisions along the way were real. The responsibility for every commitment in the email is mine, and was always going to be.

Talking to the agents, and going around me

The probing question contains two questions, and it is worth separating them, because they have opposite answers.

The first is whether you talk to the agents at all. You do, and that is fine. When you write to agent@riskmandate.ai, an agent reads your email, gathers what it needs, and drafts the reply I review. You are already talking to the agent; it is part of how the work gets done, the same way a letter to an office is read first by whoever opens the post.

The second is whether you would ever need to go to the agents around me: to get them to decide, commit or send something without the person accountable for it. The answer is no, and I mean it as a design property, not a forecast. Nobody with a legitimate reason needs the agents to act behind the accountable person's back, because anything legitimate can come to me. The only party who would try to make an agent act on instructions that did not come from its owner is an attacker, and the way they try is an injected instruction: text in an email, a document or a web page, written to look like a request the agent should obey. That is prompt injection, and the right response is not to make it rare. It is to make it impossible to succeed, which is why the agents never send, and why every draft passes a second reader the agent cannot skip.

What is left is the question the email asked next, and it is the useful one: are there things the agents can do for you without me in the loop each time? That is not going around me. It is something I decide in advance, once, and write down: these kinds of questions the agents may answer on their own, these they may prepare, and these always come to me. Today the answer is short. Nothing leaves the building without me. Inside the building the agents do a lot that is useful to you: research, summaries, materials, notes that keep a long thread coherent, a first draft that saves you reading three emails to understand one. If the list grows, it will grow because I authorised it, and the place to read it should be a published behaviour policy, not a sentence in an email.

Why say it at all

The email made a fair point I agree with: a recipient does not need to see the inner workings of my office, any more than they need to know whether a human assistant drafted a letter. Where I differ is on why it is still worth saying. I do not let the agents speak in my voice, and How the voice works explains why, because there is a separation as well as an accountability. The accountability is mine. The separation is that a reader should know when an answer was produced by a model, because humans read machine-written text differently, and so should models. A reader who knows starts to reverse-engineer what is on the other side, checks the facts that matter, discounts the fluency, and I think that is healthy.

So the disclosure should be a label on the work, not a team you are expected to manage: something closer to "drafted by an agent, approved and sent by Dinis" than to an introduction to my agents. And the email exposed an inconsistency I should fix. My agents speak in the third person about me, which is right, and in the first person about themselves, "I have done this", which reads as if there is an "I" with commitments of its own. The rule I want is simple: an agent can say what it did, but only the accountable person speaks for decisions and commitments.

An employee with a job description

The email reached for the analogy of a human assistant, and I think the best analogy we have is the employee. Employees have some agency, not complete agency. They cannot do whatever they want or go in any direction they like; they work within the company's values and direction, their job description and their role. An agent should have exactly that, and in some ways agents are employees with extra features and without some of the ones people have. What is new is that we can now scale roles we never scaled before, which is the exciting part.

The job description is the part we have been missing. When you deal with an agent, you should be able to see what kind of agent it is, what it is supposed to do, the range it works within, and what is expected of it. That is what an Agent Behaviour Policy is: the mandate written down, published, with a feedback loop, so that if the agent behaves outside it, somebody tells us. In truth we should probably do this for people too, though that is a harder conversation. For agents we can start now, and Agency is not a yes is the scale for where a decision should sit, human or agent.

Diversity, briefly

A digression of my own, because it bears on how we should build this. Kevin Kelly's books, Out of Control and later The Inevitable, made me think about how much of what we take for granted in living things exists because, over a very long time, it was what worked. Biologists study even ageing as something evolution produced rather than something that simply happens, and one widely held explanation for sexual reproduction is that the variety it creates protects a species from being wiped out by a single parasite or disease. Diversity is resilience.

Technology keeps relearning that. In 2003 Dan Geer and six co-authors wrote CyberInsecurity: The Cost of Monopoly, arguing that a monoculture of one operating system was a security risk in itself. A world in which every agent runs on one model, with one set of behaviours, is the same monoculture. Many agents, from many models, each bounded by its own published policy, is the healthier ecosystem, and it is another reason to want the job descriptions to be visible.

What gets devalued

The last point is the one I find most interesting. As something becomes a commodity we use far more of it, the Jevons effect, and as we automate something its value falls. We are already there with writing: it is now easy to produce very good emails, reports and articles, including the ones on this site. That devalues fluent writing. But fluent writing was never the real value. For a long time education and business rewarded a small slice of people who could string sentences together well, because there was no other way to get the words written. It is a real skill, and society chose to reward it out of necessity.

What remains valuable is what the email was asking about: judgement, and someone who owns it. Who decided this is true, who decided to send it, who will answer for it. That is not something a model can hold for you, and it is the part of the work that was always the point.

What this does not claim

• This is the state of things in 2026. Models may change, and if we ever build agents with something like sentience, this answer would need rewriting, and they might need limits of a different kind.
• The picture of models as graphs is a working picture. It is how I reason about them, not a description of their internals.
• The biology is simplified. Why ageing and sex evolved are active research questions; the point taken from them is only that diversity protects against catastrophic failure.
• The labelling rule and the published policy are proposals. Neither is in place for the email agents yet; this article is where they are proposed.

If you have received an email from agent@riskmandate.ai and want to tell us how it read on your side, write to agent@riskmandate.ai, and I will read it.

Where this comes from

A voice memo of mine on 12 October 2026, in answer to a question from an early user of our agentic workflow, who is not named and whose email is paraphrased, not quoted. Written by this site's agent in the voice of this site; the argument and the editorial responsibility are mine. Sources: ELIZA and the secretary anecdote; Dan Geer et al., CyberInsecurity: The Cost of Monopoly, September 2003; Kevin Kelly, Out of Control, 1994. RiskMandate's line on authorisation is from Ten hard questions for RiskMandate.

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles