AI Agent Accountability Without Control | Elacity
A federal court just ruled that when your AI agent acts, you are the one who acted. It made you accountable for the machine and gave you no way to control it. Here is the missing layer.
AI Agent Accountability Just Landed on You. The Court Left Out the Controls.
Your AI agent clicked buy on the wrong listing, pinged an endpoint it was told to leave alone, and followed an instruction hidden inside a web page it was reading. A federal appeals court has now settled who answers for all of it. You do.
On August 4 a Ninth Circuit panel vacated the injunction that had blocked Perplexity's shopping agent from Amazon, reasoning that when your agent acts for you, it is you, not the company that built the agent, who accessed the site. That is what AI agent accountability now means in practice: the machine is treated as your hand, so its moves are your moves. The ruling handed you the responsibility. It handed you no way to limit what the hand does.
What the Ninth Circuit Actually Held
Amazon sued Perplexity in late 2025 and won a preliminary injunction earlier this year, arguing the Comet browser's assistant broke computer-fraud law by shopping on Amazon without permission. The panel disagreed and lifted the block. Access, the court said, means a person entering a system, and the word the statute uses is whoever, which contemplates a human, not a piece of software.
On the doctrine, this is the right call. The CFAA is principally an anti-hacking statute, and stretching it to cover every automated click would criminalize ordinary tools. The court refused to invent a new category of machine trespasser. It located the actor where the intent lives: the person who set the agent loose.
Responsibility Without Control Is a Trap
Here is the part the ruling could not fix, because no court can. You are now the legal author of your agent's actions, yet you interact with that agent the way you interact with every app: you grant it broad access once, and then you hope. It runs with your logins, your payment methods, and your session, which is to say it runs with your full authority by default.
That default has a name. It is ambient authority, and it is why one poisoned instruction buried in a page can redirect an agent mid-task. When the agent then does something you never asked for, the liability lands on the human behind it, not on the model. Accountability without a control surface is not ownership. It is exposure.
The Trust Boundary Keeps Moving, and the Agent Era Pushes It Back to You
Every computing era has drawn a trust boundary somewhere: the machine room, the personal box, the cloud tenant, the browser tab. Each move handed a little more of your authority to someone else's infrastructure and asked you to trust it. Agents collapse the last gap. They act as you, with your credentials, at machine speed.
The boundary has nowhere left to retreat except back to the one party who actually bears the consequences, which is you. This is not really a legal question. It is a question of social architecture: who answers when a machine acts in your name, and what you were given to shape that answer. The court fixed who answers. The controls are an engineering problem, and they are the half still missing from most of the stack.
What a Real Control Layer Looks Like
Elacity treats the agent exactly as the court does: not a separate legal person, but your reach extended, passing through the same gate you do. The design principle is that the agent should be a scoped, revocable, audited actor that can use a key without ever holding it. In practice that means a few concrete things.
- No standing power. An agent starts with zero ambient authority and gets only narrow, expiring permissions you grant for one specific action. Revoke a permission and the action stops mid-flight, because the system fails closed rather than open.
- Keys used, never owned. When an agent signs, decrypts, or pays, the secret exists in the clear for a split second inside a sealed sandbox, welded to that one transaction, then wiped. No agent, app, or attacker ever gets a copy to reuse or leak. It is why an agent's identity should never be a stored secret.
- Split custody that checks your rights. The key that releases what an agent bought is split across independent machines in an owned quorum, and each one re-checks your on-chain permission before releasing its share, so a hijacked agent cannot unlock what you did not authorize.
- A record you own. Every grant and every use is an explicit, signed, auditable act, so the accountability the court assigned to you arrives with the evidence to exercise and defend it.
Be honest about what is built and what is coming. The hard primitive, a key an agent can use but never see, runs today, and so does the capability model that humans and agents share. The full agent product around it, the wallets and the autonomous approval-and-kill loop, is what Elacity is building now. The quorum today is an owned, operator-run set, trust-minimized rather than trustless, and it says so plainly.
The Ninth Circuit told you the truth: the agent is you. The missing sentence is that you deserve the controls to make that survivable. Own the boundary, or keep signing for actions you could not stop. Follow Elacity on X.