Working in business process automation and exploring AI agents — reading the research, following the tooling, watching how teams were starting to deploy them — two topics kept surfacing in almost every serious conversation: governance and liability. Who is accountable when an agent makes a consequential decision? How do you prove what context it had? What happens when it acts on data it shouldn't have accessed? How do you satisfy a regulator who wants to see the record? I'm not a veteran agent engineer — I came to these questions from the automation and process side, developing my understanding of how AI agents actually work in production and where the real friction is. But the governance questions didn't require deep hands-on experience to recognise. They were showing up everywhere: in the research, in the compliance conversations, in the gap between what the tooling offered and what real accountability would actually require. I found those questions genuinely interesting.…