In Depth
There is a meaningful line between an agent that drafts and an agent that acts. A drafting agent proposes; a human decides; the human's review sits between the model and the consequence. An acting agent removes that buffer. It issues the refund, sends the email, books the appointment, updates the record, moves the money, and the effect lands in the world before any person sees it. Autonomy closes the gap between a model's output and a real-world consequence, and liability flows straight through that gap.
The legal frame is continuous with how the law already handles delegated action. Vicarious liability holds a business responsible for acts performed on its behalf, and an autonomous agent is acting on the vendor's and the deployer's behalf. Autonomy does not transfer the liability to the machine; there is no party to push it onto. Moffatt v. Air Canada (2024 BCCRT 149) made the point even for mere speech: the company owned what its bot said. An agent that acts only raises the stakes, because now the company owns what the bot did.
This is why autonomy is weighted so heavily in Ollive's Agent Trust Score. Two agents can run on the same model and carry very different risk depending on what they're permitted to do unsupervised. A read-only assistant that surfaces information is one thing. An agent with tools that can spend money, change records, or contact customers without approval is another, because every other failure mode (hallucination, prompt injection, drift) gets an action attached to it. The same injected instruction that makes a chatbot say something wrong makes a tool-using agent do something wrong.
What It Looks Like
A vendor sells an AI agent that manages vendor payments for its enterprise customers end to end, reading invoices, matching them, and releasing payment without a human approving each one. A malformed invoice, a misread amount, or a prompt injection buried in an invoice PDF leads the agent to authorize a payment it shouldn't: wrong amount, wrong recipient, duplicate. The money is gone before anyone reviews it. This isn't a misleading sentence a customer might have caught. It's a completed action with an immediate, concrete loss, taken autonomously on the customer's behalf.
Contrast the safer design: the same agent, but it stages the payment and a human releases it. Now there's a checkpoint where the error gets caught, the consequence is averted, and the agent's exposure drops. The difference between the two versions isn't the model. It's how much the agent is allowed to do alone.
Why It Matters For AI Vendors
Autonomy is the feature vendors race to ship and the one that scales liability fastest. Every increment of "the agent can now do X without asking" is an increment of consequence the vendor absorbs when X goes wrong. The product pressure pushes toward more autonomy and less human friction, while the liability runs the other way.
It's also the dimension enterprise customers scrutinize hardest, because an autonomous agent inside their systems can take consequential actions in their name. Their security review wants to know what the agent can do unsupervised and what stops it, and a credible answer often involves human-in-the-loop controls on the highest-stakes actions. Legacy coverage, meanwhile, wasn't written for software that independently executes transactions, and the AI exclusions added through 2025–2026 push autonomous-action harm further outside it.