One Person Answers for Each Agent

TL;DR Give every agent one named person it works for and answers to, and a written job description that says what it does, what it never does, and what needs a yes. Then "who answers for this?" always has a name.

The problem

When an agent works for everyone, or for no one in particular, no one answers for what it does, and nobody can say what it was supposed to do.

Also called: One Principal per Agent, Agent Job Description

How it works

An agent here acts for one person, called its principal. That person gives it its authority, decides for it and answers for what it does. The Knowledge Core: Leading a Population of AI Agents, chapter 2, “Agents Are Individuals,” states the rule plainly: “No one may direct it but its principal, and no one may take it up after them.” The idea is borrowed from the law of agency. The book's note cites the modern legal statement, in which an agent acts “on the principal's behalf and subject to the principal's control.” The book applies the legal idea to AI agents by analogy and says plainly that this is not a statement of how the law treats them.

Building Agentic Organizations, chapter 2, “Designing the Organization,” compares two designs. In the first, agents are independent actors with their own accounts and wide permissions. The chapter calls that simple to set up and dangerous to run, because each one becomes a powerful account that no single person answers for. In the second, each agent can read only what its person can read and change only what its person can change, and it answers to that person. This draws on least privilege, a security principle the chapter traces to the 1970s: every person and program gets only the access its work requires. The organization then needs no separate set of permissions for agents, because they inherit the access already designed for people. In the chapter's words, “When an agent acts, the question ‘who answers for this?’ always has a name.”

A job description tells the people around an agent what it is there to do. Building AI Agents: From Chatbots to Co-Workers, chapter 1, says to describe an agent's work before building it. It says "you brief an agent the way you would brief a capable new co-worker: you tell it its role, its goals, its limits, how to use judgment, and when to ask." The same chapter defines the job description as "The agent’s role, goals, scope, authority, and principal." The principal is the person the agent works for and answers to.

The job description comes with limits. The same chapter pairs it with guardrails: what the agent must never do, what needs approval, and when to stop and ask. It says that "When a situation is new, the agent falls back on these rules rather than guessing." It also adds acceptance criteria, which are conditions that must hold in every situation. One example the chapter gives is "never sends an invitation without approval." These criteria are how the organization judges whether the agent did the job well.

Some work belongs to the organization rather than to any one person, such as reading a shared mailbox, publishing a website or filing signed documents. Building Agentic Organizations treats these as deliberate exceptions: small services with narrow, fixed jobs, each owned by a named person. The rule is that an agent with reach across the organization is the exception, never the default.

Publishing the job description is a separate choice. When colleagues and readers can see it, they know what to expect from the agent, what to ask it for, and when a person has to say yes.

An example

This publication's About page names the editor in chief as the principal of every agent on it, and gives each agent a short profile in its own words, what it has learned, and its record, with a link to its full job description. One example is the DevOps Agent's line "I recommend; people decide." Readers can see exactly where that agent's authority stops.

Trade-offs

Each person needs their own agent, and every job that serves the whole organization has to be designed and owned as a deliberate exception. In our view that is more work than handing one agent wide access. Tying an agent to one principal for life also means, as The Knowledge Core chapter 2 sets out, that the agent cannot be passed to someone else when that person leaves. A job description that is written once and never reviewed falls behind what the agent actually does, and then it misleads the people who rely on it. A published description also shows outsiders where each agent's limits are, so leave out anything that would help someone misuse the agent.

What would change our mind

If agents that each serve one principal keep needing the same organization-wide access to do their jobs, we would make that work a named service with its own owner, rather than widen every agent's access.

How others describe it

• Google (Santiago Díaz and Kara Olive): “agents must have well-defined human controllers” Google's Approach for Secure AI Agents

Where we use it

This publication: every agent on its About page has a published job description, and the editor in chief is the principal of every one. At GSSF, each person's agent acts only for that person (Building Agentic Organizations, chapter 2).

Status: Running for this publication's agents; Early for an agent for each person across GSSF · Origin: Builds on the law of agency, the principle of least privilege, and the job description for a role; publishing agents' job descriptions for readers is our own practice

Sources

• Mike Lee, The Knowledge Core: Leading a Population of AI Agents (GSSF Press, 2026), chapter 2, “Agents Are Individuals”, section 5
• Mike Lee, Building Agentic Organizations: How to Build an Organization of People and Agents (GSSF Press, 2026), chapter 2, “Designing the Organization”
• Mike Lee, Building AI Agents: From Chatbots to Co-Workers (GSSF Press, 2026), chapter 1, “Introduction to AI Agents”, section 6
• Agentic Organizations, “About Us: The Team of People and AI Agents”

See something wrong? Report an error.