As organisations give AI agents access to tools and data, a model's task score says little about whether each action was authorised or reviewable. Current official work points to controls across the complete workflow.
Observed fact: governance questions now follow the agent's actions
On 8 October, the UK Information Commissioner's Office opened a call for evidence on agentic AI, closing on 20 November 2026. It asks how organisations handle data security, transparency, accountability, automated decision making, fairness, purpose limits and lawful processing when AI systems execute tasks and share data. The ICO says the responses will inform future guidance. This is a consultation about practical questions, not a new final rule or a finding that every deployment breaches data protection law. [1]
The OECD's September 2026 working paper draws on interviews with 25 organisations developing or using agentic AI. It reports applications across enterprise productivity, supply chains, cybersecurity and other fields, alongside challenges in evaluation, security and accountability between organisations and agents. The paper describes incremental autonomy and human checkpoints among emerging responses. Its authors expressly call the findings an illustrative qualitative snapshot, not a representative survey or independent measurement of system outcomes. [2]
Observed fact: an agent needs its own accountable access
An August 2026 NIST article identifies a recurring identity problem: people and organisations sometimes give agents human credentials or long-lived tokens so they can reach tools quickly. Shared credentials make it harder to establish which actor made a request and under whose authority. NIST's authors argue for agent identifiers, credentials and permissions linked to the person or system operating the agent. They point to existing identity and authorisation patterns as a foundation while new agent-specific practices are still developing. [3]
Identity alone does not establish that every requested action is appropriate. An agent may read one document, call another tool and pass information onward during a single task. The ICO's consultation asks how accountability and transparency can be evidenced across such systems and supply chains; NIST discusses the risks of broad permissions and repeated human approval prompts. Together, these sources support checking both who or what acted and the scope of authority for each consequential step. That last operating test is our inference, rather than a rule stated verbatim by either body. [1][3]
Observed fact: a pass rate cannot explain the path taken
The UK AI Security Institute says average task pass rates are useful but can conceal why an agent failed, whether it took disruptive actions, or whether a test bug affected the outcome. Its transcript work examines the instructions, agent messages, tool calls and tool outputs from evaluation attempts. In one case study it analysed 6,390 samples across 71 capture-the-flag tasks using agents based on nine models. Those are research evaluation conditions, not a measured failure rate for business deployments. [4]
The OECD interviewees likewise called for system-level evaluation and clearer traceability across multi-agent settings, beyond model-level performance. Neither source shows that storing more logs by itself makes an agent safe or lawful. Their shared implication is narrower: outcome counts need enough process evidence to distinguish a successful authorised route from a shortcut, refusal, tool failure or unauthorised action. This is an inference about evaluation design, grounded in the limitations each source describes. [2][4]
Oakhampton inference: test one bounded workflow end to end
A practical first review is to pick one real workflow and map its full route: the human request, agent identity, permitted data, tools, approvals, external recipients and final record. For each material action, the team can ask what permission was available at that moment, what source data supported the action, what was actually sent or changed, and how a reviewer can reconstruct it. This proposed checklist translates NIST's identity concerns, the ICO's accountability questions and AISI's transcript evidence into an operational test; none of those sources certifies the checklist as sufficient. [1][3][4]
Next, replay representative cases with limited authority, including a routine success, a missing permission, misleading retrieved material and a partial tool failure. Compare both the final answer and the action trail with an agreed acceptance rule, then record which deviations require a human decision. The OECD reports that organisations are expanding autonomy incrementally and using human checkpoints for high-stakes actions. Our proposed replay is a way to make that progression measurable in a particular organisation, not a claim that the interviewed organisations used this exact method. [2]
Uncertainty: guidance and evidence are still developing
The ICO has asked for evidence before finalising agentic AI guidance, so its open questions should not be presented as settled legal requirements. The OECD study reflects a selected group already engaged with the technology and does not establish adoption rates or productivity gains. NIST's article describes identity practices and unresolved design challenges; AISI's transcript findings come from controlled evaluations. These limits prevent a general claim that a particular control set will eliminate failures across sectors. [1][2][3][4]
The useful near-term question is therefore specific: can an organisation show, for a defined agent and task, who authorised each material action, which data and tools it touched, what result it produced and how exceptions were handled? If those records cannot be reconstructed, a high task score is weak evidence of controlled operation. If they can, the next step is still to test whether the permissions, data use and escalation rules were appropriate for that setting. That conclusion is Oakhampton's inference from the cited evidence, not an audit or legal determination. [1][2][3][4]
Sources
- Agentic AI call for evidenceUK Information Commissioner's Office · 8 October 2026
- Agentic AI in organisations: Early insights from practitioner interviewsOrganisation for Economic Co-operation and Development · 16 September 2026
- Back to the Future: Why Agentic AI Needs a Strong Identity FoundationUS National Institute of Standards and Technology · 27 August 2026
- Transcript analysis for AI agent evaluationsUK AI Security Institute