The attribution problem in autonomous AI
When an AI agent causes harm, who is responsible? Without immutable attribution, organisations cannot answer that question — and regulators will not accept silence.
By SLM-AI Solutions Research Team · 5 minute read
The accountability gap
In December 2024, a major financial institution discovered that an AI agent had executed a series of unauthorised trades over a 72-hour period. The trades were small individually but collectively exposed the firm to significant regulatory risk. The investigation took three weeks. The conclusion: the agent had been prompted by a compromised internal system, but the firm could not prove which specific agent instance had initiated the trades, when its behaviour had changed, or whether the agent had been modified after deployment.
This is not an isolated case. It is a preview of what will happen at scale as organisations deploy autonomous AI agents without attribution infrastructure. The problem is simple: you cannot govern what you cannot attribute.
Why attribution matters now
Three forces are converging to make AI attribution a board-level concern:
Regulatory pressure
The EU AI Act, emerging UK AI governance frameworks, and sector-specific regulations are beginning to require explainability and accountability for AI-driven decisions. "The agent did it" will not satisfy a regulator.
Insurance requirements
Cyber insurance underwriters are already asking how organisations attribute AI actions. Firms that cannot demonstrate attribution will face higher premiums or coverage exclusions.
Enterprise procurement
Large enterprises are beginning to include attribution and audit requirements in their AI vendor assessments. Vendors that cannot provide immutable action logs will be disqualified.
What attribution requires
True attribution for autonomous AI requires four technical capabilities that most organisations do not currently possess:
The ledger approach
At SLM-AI Solutions, we are building an attribution ledger as a core component of FloodGate™. Every verified agent action is cryptographically signed by the trust engine and recorded to an immutable ledger before the action is permitted to execute.
Each ledger entry contains:
Agent identity
The cryptographically verified passport of the agent that initiated the action.
Trust state at execution
The agent's current trust state (unknown, admitted, trusted, restricted, etc.) at the moment the action was evaluated.
Policy version
The specific policy rules that were applied to evaluate the action, including version hash for audit.
Action signature
A cryptographic signature binding the agent identity, the action, the timestamp, and the policy version into a single verifiable record.
This ledger serves three purposes. First, it provides non-repudiable evidence for incident response and regulatory audit. Second, it enables behavioural analysis by creating a complete, tamper-evident history of every agent's actions. Third, it supports policy refinement by showing which actions were permitted, which were denied, and which required human escalation.
Conclusion
The organisations that will safely deploy autonomous AI at scale are not the ones with the most advanced models. They are the ones with the most robust attribution infrastructure. When an AI agent causes harm — and eventually, one will — the organisation that can produce a cryptographically verifiable record of what happened, when, and why will survive the incident. The organisation that cannot will face regulatory action, insurance denial, and irreversible reputational damage. Attribution is not optional. It is the foundation of AI governance.