Who’s the Defendant When Your AI Agent Clicks “I Agree”?

Imagine your browser copilot logs into your bank, clicks through a new fee schedule you did not read, and signs you up for a product that later costs you hundreds of dollars. The bank justifiably relies on the logs, while you claim that such actions were never authorized. Such disputes are only expected to become more commonplace with the proliferation of agentic AI, but global governance regimes do not yet have the answers. This op-ed argues that liability in such cases should be influenced by two design choices – where the agent runs and the nature of the user’s approval – and that regulators should require auditable records of these choices to effectively adjudicate such cases.

Two design choices that impact how liability is attributed

First, technical architecture – whether the agent is cloud-based, local on the user’s system, or operates with delegated access – is a critical component of determining liability. Cloud-based agents (e.g., agentic browsers and browser extensions) operate from the provider’s servers and interact with websites from the provider’s IP addresses. Local agents live in the user’s operating system and act through the user’s cookies and session, so the website should ideally see the user’s unique user agent string. Delegated agents use explicit authentication tokens – like OAuth – that the website issues to a third-party app, so the site sees the user “via App X” with a defined scope and the ability to revoke approvals.

Second, approval granularity – the actions expressly approved by the user and the mode of approval. In per-action approval modes, the agent proposes concrete steps, and the user approves each high-risk action before it happens (either as a plan or step by step during execution). Anthropic’s Claude “computer use” feature, where each click and keystroke can be reviewed for confirmation, is a clear example. In contextual approval modes, the user approves or communicates a goal (e.g., “find me a flight and book a reasonable option”) and the agent fills in intermediate steps on its own, checking in only at key moments like final purchase. In blanket approval modes, the user sets broad preferences once and gives the agent standing authority to act within that scope without real-time approval.

These dimensions can be visualized as a simple matrix:

	Per-action	Contextual	Blanket
Remote agent	User	Shared, but default to provider	Provider
Local agent	User	Shared	Primarily provider
Delegated agent	User + website	Primarily user	Primarily user; provider, if agent breaks scope

A remote agent with blanket authorization, holding user credentials on its servers and acting whenever it sees fit, looks like a classic software intermediary; when harm arises as a result of such an agent’s actions, the provider should usually be the default defendant. On the other hand, a local agent operating with per-action approval looks more like a very fast pointing device, and courts ought to be inclined to treat those actions as the user’s.

The hard cases typically involve contextual agents that make decisions by executing their own plan of action. Here, the key question is how much discretion the system was operating with and what information users were required to see before delegating authority.

Oversight governance should pay attention to the architecture and approval

Existing computer fraud law is mainly concerned with bypassing technological “gates”; however, this lens does little when the agent is acting through the user’s logged-in session. Newer AI regimes, such as Article 14 of the EU AI Act and Singapore’s new Model AI Governance Framework for Agentic AI, released in January 2026, have made an attempt at addressing this gap by emphasising that ultimate accountability for agentic actions lies with natural persons. 

Two policy steps follow. First, high-risk agentic systems should maintain an auditable “context graph” for each session: a structured log of what pages or APIs the agent interacted with, what it proposed, what the user saw, and approved at each checkpoint. Cryptographic hashing and zero-knowledge technology can make these trails tamper-proof without exposing sensitive data. Second, regulators and courts should acknowledge approval granularity and technical architecture as factors in deciding whether oversight is meaningful and how agentic liability is attributed. 

Agentic AI is advancing at an unprecedented pace. Before courts retrofit nineteenth-century agency doctrines onto systems of the future, we should build the infrastructure – and legal standards – that bring clarity to these open questions.

Author Bio: Anita Srinivasan is a lawyer currently pursuing an LL.M. at UC Berkeley School of Law. She researches and writes on emerging technologies and her work has previously appeared in Tech Policy Press and Berkeley Technology Law Journal blog.