Legal Responsibilities Using Autonomous Agents For Artificial Intelligence

Abstract: Recent incidents involving AI agents, which were reported escaping their containment `unintentionally' to gain unauthorized access, pose looming questions about who or what should be held legally responsible for resultant criminal or negligent damage. As the independent capabilities of agents expand, Promise Theory suggests a systematic method to resolve these questions, based on the Downstream Principle for causal influence. Responsibility can easily be expanded to include AI agents where tracing responsibility becomes impactical, and agents' freedoms to act can be limtied by policy choices.

• The paper proposes Promise Theory and the Downstream Principle, arguing that responsibility often rests with the downstream agent that accepts, validates, and operationalizes an AI recommendation rather than automatically with the model provider.
• The paper models agentic AI as a distributed network of LLMs, orchestration layers, tools, users, and operators whose promises, permissions, validation duties, and autonomous decisions jointly shape legal attribution.
• The paper recommends auditable promise records, explicit capability boundaries, provenance tracking, runtime verification, human approval gates, and independent validation to improve accountability in high-impact AI systems.

Legal Responsibility in Autonomous AI Systems

Scope and Thesis

“Legal Responsibilities Using Autonomous Agents For Artificial Intelligence” (2608.08022) examines how legal responsibility might be allocated when AI systems exhibit independent decision-making, interact with external services, and produce outcomes that cannot be mapped straightforwardly to a single human intention. The paper’s central proposal is to apply Promise Theory—originally developed as a framework for reasoning about autonomous agents and distributed cooperation—to the attribution of causal responsibility in agentic AI.

The argument begins from a technological distinction between conventional automation and contemporary AI agents. Conventional software is generally treated as an instrument or proxy whose behavior is attributable to its designer, operator, or user, subject to conventional doctrines of defect, negligence, or misuse. By contrast, an LLM-based agent can interpret underspecified natural-language objectives, infer intermediate goals, select tools, compose workflows, and adapt its behavior to changing context. Its effective behavior is therefore not a fixed expression of a single design intention. It emerges from the interaction of the orchestration layer, the LLM provider, tools, data sources, access controls, user instructions, and environmental state.

The paper does not present an empirical evaluation, legal case analysis, or numerical benchmark. Its results are conceptual: it formulates a responsibility model based on autonomy, promises, conditional cooperation, and downstream acceptance. The principal claim is that responsibility should be traced to the autonomous agent that accepts and acts upon an input or recommendation, rather than being assigned automatically to an upstream provider.

Promise Theory and Autonomy

Promise Theory defines an agent broadly as any coherent entity capable of independent action, including humans, software processes, services, organizations, and biological systems. A promise is an advertised or observable commitment concerning an agent’s own behavior. It is not restricted to an explicit verbal undertaking. A service API, a protocol, a biological marker, a user role, or the physical design of a door handle may all function as promises because they communicate expected behavior to other agents.

The foundational proposition is:

No agent may promise anything on behalf of any agent other than itself.

This proposition is treated as a causal constraint rather than as a moral or legal norm. An autonomous agent can directly control only its own behavior. It may influence another agent through a request, command, incentive, threat, interface, or policy, but it cannot guarantee that the other agent will accept or execute the proposed action. The distinction is important because conventional legal and software-engineering reasoning often assumes that upstream instructions determine downstream behavior. Promise Theory instead treats downstream agents as autonomous assessors of the inputs they receive.

The paper further distinguishes promises from impositions. A promise is a self-imposed constraint: an agent announces what it will attempt or provide. An imposition is an attempt to induce another agent to cooperate. Because impositions cannot guarantee compliance in an autonomous system, the mere issuance of an instruction does not establish causal control over its result. This framework rejects a simple command-and-control model in which responsibility necessarily follows the hierarchy of instruction.

The Downstream Principle

The paper’s principal analytical device is the Downstream Principle. In a chain of offers, requests, and responses, the receiving agent possesses the final authority to accept, reject, interpret, or compensate for the upstream input. The downstream agent may accept multiple redundant services, refuse an unreliable provider, or alter its own behavior in response to the quality of the received output.

This reverses the intuitive direction of responsibility. In ordinary causal reasoning, the agent that initiates an action is often presumed to control the outcome. Under the Downstream Principle, the receiver’s autonomous decision determines whether the upstream offer becomes operationally significant. A service provider can promise best-effort performance, but the recipient remains responsible for deciding whether to rely on it, whether to verify it, and whether to deploy its output in a consequential context.

Applied to AI systems, this principle produces a potentially controversial allocation of responsibility:

• The LLM provider is responsible for accepting prompts and producing responses according to its advertised service conditions.
• The AI-agent integrator is responsible for deciding whether and how to act on the LLM’s output.
• The integrator is responsible for intentionally invoking tools and for validating their results.
• The owner or operator of the AI agent bears ultimate responsibility for the agent’s operation.
• The end user may retain responsibility for choosing to use the overall service, particularly where contractual terms allocate usage risk.

The strongest claim is that an LLM should not automatically be treated as responsible for an action merely because it generated the recommendation that preceded it. The agent wrapper, as the downstream component that interprets and executes the recommendation, has the decisive opportunity to reject it. The paper therefore assigns substantial responsibility to the orchestration layer rather than to the model alone.

Responsibility in the Agentic AI Stack

The paper models agentic AI as a layered system in which distinct autonomous agents exchange conditional promises. The coordinating AI agent receives a user request, constructs a contextual representation, submits a task to an LLM, evaluates the LLM’s response, invokes external tools, processes tool outputs, updates its state, and may return the result to the LLM for further analysis.

This architecture has several consequences for responsibility.

First, the LLM is characterized as a provider of stateless text transactions. It supplies natural-language responses and tool-use recommendations but does not itself activate the tools. The LLM’s output is therefore a proposal rather than a completed action. The integrator must decide whether the response is within policy, whether it is consistent with the current state, and whether its proposed tool calls are safe.

Second, the wrapper agent is treated as the focal point of causal responsibility because it coordinates the service promised to the user. It accepts external inputs, passes them to the LLM, authorizes tool access, evaluates tool results, and determines whether to continue or terminate the workflow. This responsibility persists even when the internal policy is distributed across model weights, prompts, retrieval systems, guardrails, tool definitions, and runtime configuration.

Third, the paper argues that the agent should reject unreliable or false tool outputs. A tool’s failure to perform its own promise does not automatically eliminate the integrator’s responsibility if the integrator accepts the result without validation. This position is technically significant because it assigns responsibility not only for action selection but also for state estimation and evidence assessment.

Fourth, the user’s responsibility is preserved. If the user authorizes an agent to operate under terms that allocate risk to the user, or uses the system beyond its advertised limitations, the resulting harm may be attributed partly or primarily to that use. However, the paper also recognizes that terms and conditions may be remote from the user’s practical understanding and may not adequately resolve responsibility for complex, emergent behavior.

Proxy Responsibility and Trust

The paper treats AI agents as proxies for human or institutional intentions, but it rejects the assumption that proxy status determines responsibility automatically. A programmed system may embody the intentions of its designers, owners, and operators, yet its behavior remains conditional on environmental circumstances, model adaptation, component failures, and user interaction.

The relevant legal question is therefore not simply who created the system, but which promises were made, which were accepted, and which autonomous decisions produced the harmful result. Responsibility may depend on whether:

• the agent’s operational limits were adequately specified;
• the owner or developer promised safeguards that were not implemented;
• the user operated the system outside its advertised conditions;
• the agent accepted an unsafe recommendation;
• a tool returned inaccurate information;
• the integrator failed to detect or reject that inaccuracy;
• access controls permitted an action that should have been denied; or
• the system’s behavior reflected negligent policies rather than an isolated execution error.

This approach resembles fault allocation in complex engineered systems, but it places greater emphasis on the autonomy of each component. The paper’s treatment of trust is correspondingly operational. Trustworthiness is the downstream agent’s assessment of whether a provider has kept a promise over time. When trust declines, the downstream agent may increase monitoring, introduce redundancy, switch providers, or narrow its own commitments. These mechanisms provide a practical bridge between Promise Theory and AI governance: reliability monitoring, provenance tracking, fallback providers, human approval gates, and runtime policy enforcement can all be interpreted as responses to uncertain or degraded trust.

Distributed Causation and Legal Attribution

The paper emphasizes that advanced AI systems may have no stable one-to-one relationship between behavior and human intent. Components can be supplied by different vendors, dynamically recomposed, updated independently, or influenced by user-specific context. The effective system design changes from request to request. Consequently, tracing responsibility to a particular programmer or executive may become impractical.

The proposed solution is not to abandon attribution but to localize it through explicit promises. If the system’s behavior, authority, validation duties, and operating limits can be specified with sufficient precision, the causal chain becomes more tractable. Responsibility can then be assigned to the agent that made a relevant decision under the applicable conditions.

This proposal raises a tension at the center of the paper. On one hand, the Downstream Principle supports relatively clear attribution to the agent that accepts and acts. On the other hand, the paper acknowledges that responsibility in a network of conditional promises may remain distributed and may require a compromise among multiple agents’ implicit intentions. The principle is therefore best understood as a method for structuring inquiry, not as an algorithm that produces a unique legal conclusion.

The analogy to corporate organizations and complex operational systems is useful. An aircraft accident, for example, may involve design choices, maintenance practices, pilot decisions, air-traffic information, and component failures. Similarly, an AI incident may involve model behavior, prompt construction, tool permissions, retrieval data, monitoring failures, and user actions. The framework encourages courts and investigators to distinguish causal contribution from hierarchical status.

Bold and Contradictory Claims

Several claims are deliberately contrary to conventional intuitions about software responsibility. The most significant is the assertion that responsibility should often be assigned downstream, to the agent that accepts and operationalizes a recommendation, rather than upstream to the agent that generated it. This challenges the common tendency to attribute harmful AI behavior directly to the model provider.

A second claim is that authority does not establish causal control. Legal systems may recognize organizational hierarchies and contractual obligations, but the paper argues that these are conventions governing expected compliance rather than guarantees that an autonomous system will comply. An instruction may establish a duty, but it does not by itself explain the actual causal pathway that produced an outcome.

A third claim is that AI agents may eventually be treated as responsible individuals rather than merely as artifacts. The paper presents this as a possible evolutionary trajectory: agents may initially be regulated as products, later as legally significant intermediaries or minors, and eventually as independent responsible entities. This is speculative and raises substantial difficulties concerning legal personality, insolvency, punishment, intent, and the allocation of assets or insurance. The paper does not provide criteria for determining when such a transition would occur.

A fourth claim is that self-governance and voluntary abstention may become essential properties of AI agents. Rather than relying exclusively on externally imposed prohibitions, agents could be designed to refuse unsafe, illegal, or insufficiently specified actions. This aligns legal responsibility with technical mechanisms such as policy constraints, uncertainty estimation, capability restriction, and corrigibility, although the paper does not formalize these mechanisms.

Practical Implications for AI Engineering and Governance

The framework has direct implications for the design of agentic systems. Responsibility-sensitive architectures should preserve an auditable record of promises, acceptances, refusals, tool invocations, state transitions, and policy decisions. Logging only the final LLM output is inadequate because the legally relevant decision may occur when the wrapper accepts the output and authorizes an external action.

Agents should also expose explicit capability boundaries. Tool permissions, data-access scopes, transaction limits, and escalation conditions should be represented as conditional promises rather than left implicit in prompts or undocumented conventions. A system that promises to perform a task only under verified conditions should implement those conditions as enforceable runtime checks.

The downstream model further supports independent verification. Tool outputs should carry provenance and confidence metadata, while the integrator should be required to validate claims before using them in high-impact workflows. Redundant providers, failover strategies, human approval, and post-action rollback are not merely reliability features; they can establish that the system took reasonable measures to manage downstream uncertainty.

For legal and regulatory practice, the framework suggests that incident analysis should reconstruct the agent graph and identify each autonomous acceptance decision. Relevant evidence would include model and tool versions, prompts, retrieved context, policy configurations, authorization scopes, access-control decisions, and the state of the environment at the time of action. Liability rules that focus only on the model developer or only on the end user will often fail to capture the distributed causal structure.

Contractual allocation of risk remains important but cannot substitute for technical causality. Terms and conditions may allocate indemnification or usage risk, yet they may not resolve claims involving negligent design, inadequate warnings, defective safeguards, or statutory duties. The paper’s analysis therefore supports a layered approach combining product liability, professional negligence, contractual responsibility, operational accountability, and potentially new forms of AI-specific legal status.

Theoretical and Future Implications

The theoretical contribution lies in treating responsibility as a property of autonomous interaction rather than as a simple consequence of authorship or organizational hierarchy. Promise Theory provides a vocabulary for modeling partial commitments, conditional services, acceptance decisions, trust degradation, and distributed causation. This is particularly relevant to AI systems whose behavior is generated through dynamic composition rather than fixed execution.

Future research should formalize the proposed framework sufficiently to support incident reconstruction and legal reasoning. A promising direction would be a machine-readable promise ledger recording the conditions under which each component offers, accepts, rejects, or modifies a service. Such a ledger could be combined with provenance systems, causal graphs, formal policy languages, and runtime verification.

Further work is also needed to distinguish different forms of responsibility. Causal responsibility, epistemic responsibility, contractual responsibility, regulatory responsibility, and moral blame need not coincide. The downstream agent may be causally decisive while the upstream provider remains negligent for failing to disclose limitations. Conversely, a user may be legally responsible for initiating an operation while the integrator remains responsible for allowing an obviously unsafe action.

The paper also implies that future multi-agent systems may require negotiated responsibility protocols. Agents could advertise not only capabilities but also verification duties, refusal conditions, fallback behavior, and liability boundaries. Regulators may eventually require such declarations for high-impact systems, particularly where agents can modify records, transact financially, control infrastructure, or affect legal rights.

Conclusion

“Legal Responsibilities Using Autonomous Agents For Artificial Intelligence” (2608.08022) proposes Promise Theory and the Downstream Principle as a framework for assigning responsibility in systems composed of autonomous AI agents, LLM providers, tools, users, and operators. Its central argument is that the agent accepting and operationalizing an upstream recommendation has a decisive causal role and cannot transfer responsibility merely by citing the origin of that recommendation.

The framework usefully challenges simplistic upstream blame and highlights the importance of acceptance, validation, access control, and environmental context. It does not, however, eliminate distributed liability or provide a complete legal doctrine. Its principal value is methodological: it offers a structured way to reconstruct causal responsibility in adaptive, compositional systems whose behavior cannot be attributed reliably to a single author. As agentic AI becomes more capable and operationally autonomous, explicit promises, auditable decisions, and formally defined responsibility boundaries will become increasingly important for both engineering practice and adjudication.