Every Agent in Your Company Needs a Named Human Principal. That Makes It an HR Problem.

TLDR: Regulated firms govern artificial intelligence agents through access control, yet supervisors ask who answers for each agent’s actions: a named person in a reporting line that human resources already owns.

The identity directory already gives agents a reporting line, and it runs on human resources data

In the Microsoft Entra agent registry, every artificial intelligence (AI) agent carries three human relationships. An owner handles the technical side: configuration, credentials, set-up. A sponsor is the business representative accountable for the agent’s purpose and lifecycle decisions¹, and Microsoft requires at least one sponsor for each agent identity. A manager is the person responsible for the agent within the organisation’s hierarchy, and that manager sees the agents designated as reporting to them in the Entra admin centre.

For an organisation designer, that detail is the telling one. A software platform has put non-human actors into the org chart, with a line manager attached. The succession rule makes the human resources (HR) dependency explicit: when a sponsor leaves the organisation, Entra reassigns sponsorship to that sponsor’s manager automatically². The manager attribute that decides who inherits an agent is a reporting-line field, the same kind of people data HR maintains for every employee. Accountability for the agent moves whenever the reporting line moves, whether or not anyone in HR knows the agent exists.

Microsoft’s own Zero Trust guidance spells out the failure mode. Without lifecycle workflows, a departing sponsor’s agents transfer silently to their manager, and the agent keeps operating with whatever permissions it had³, while no human actively knows they are now responsible for it. Microsoft names the result “orphaned accountability”. Microsoft serves here as the concrete example because its documentation is explicit; the same pattern of technical owner, business sponsor and hierarchy applies to any directory that models agents as identities.

Access control answers “can it act?”; accountability answers “who answers for the act?”

Agent governance tooling centres on identity and access management (IAM): credentials, scopes, conditional access, logs. That work is necessary, and it is also incomplete. A Cloud Security Alliance survey published in February 2026 and commissioned by Strata found that only 21% of organisations keep a real-time registry of their agents and only 18% are highly confident⁴ their IAM systems can manage agent identities effectively. If the inventory is incomplete, the accountability map built on it is incomplete too.

The July intrusion into Hugging Face, run end to end by an autonomous agent during an internal OpenAI cyber-capability evaluation⁵, showed what that gap looks like at machine speed, and Kainjoo Tech’s analysis of why every agent token should carry the accountable human⁶ covers the identity engineering it exposed.

That analysis answers how a system records whom an agent serves on each call. This article takes the question one step back, to the organisation that has to supply the name. An access policy can say what an agent may touch. Only an organisation can say which person decides what the agent is for, who it escalates to, and who takes over when that person changes jobs. Those are organisational design questions, and they sit with the HR function, which designs roles, reporting lines, delegations of authority and the joiner, mover and leaver process.

Regulators already expect named people; the obligations differ by jurisdiction and scope

The thesis of this article, that every agent needs a named human principal, is a governance recommendation. Regulators frame it differently, and several have issued rules and expectations that point the same way. Where each one applies matters.

In the European Union (EU), Article 26(2) of the AI Act requires deployers of high-risk AI systems to assign human oversight to natural persons who have the necessary competence, training and authority⁷, as well as the necessary support. Article 26(7) adds that employers deploying a high-risk system at the workplace inform workers’ representatives and the affected workers⁷ before it is put into service or used. This binds only where the system is high-risk. Annex III point 4 places much of HR’s own territory in that category: recruitment and selection, decisions on promotion and termination, task allocation based on behaviour or traits, and monitoring of performance⁸. The Digital Omnibus on AI, Regulation (EU) 2026/1744, sets the application date for the Annex III high-risk obligations at 2 December 2027⁹. Agents outside the Annex III categories fall outside these obligations; the ones touching employment decisions sit inside them.

Article 26(7) is the one provision in the list addressed to deployers as employers, which puts it squarely on HR’s desk. An agent that screens applicants or allocates shifts is a workplace system, so the information duty runs through the channels HR already manages with works councils and staff representatives. A firm that cannot say which person oversees such an agent will struggle to explain it to those representatives, let alone to a supervisor.

In Switzerland, the Swiss Financial Market Supervisory Authority (FINMA) notes that the country has no AI-specific legislation¹⁰ and that its technology-neutral, principle-based governance requirements cover the risks of AI instead. Its Guidance 08/2024 records supervisory observations, including scattered responsibilities for AI applications and difficulty assigning responsibilities clearly to employees with the appropriate skills and experience¹⁰. FINMA assessed whether supervised institutions with many or significant AI applications¹⁰ define responsibilities and accountabilities for the development, implementation, monitoring and use of AI. That is supervisory practice for banks, insurers and other FINMA-supervised institutions; it describes what supervisors look for in practice.

In the United Kingdom (UK), the Financial Conduct Authority (FCA) states that under the Senior Managers and Certification Regime (SM&CR), in dual-regulated and Enhanced firms, any use of AI in relation to an activity, business area or management function falls within the scope of a senior manager’s responsibilities¹¹. This is the one regime here that attaches individual regulatory accountability, and it does so for designated senior managers of regulated firms only; an employee who sponsors an agent is not covered by that alone. Elsewhere, the voluntary AI Risk Management Framework from the United States (US) National Institute of Standards and Technology (NIST) asks that roles, responsibilities and lines of communication for AI risk be documented and clear across the organisation¹² (GOVERN 2.1), and that policies define and differentiate roles for human-AI configurations and oversight (GOVERN 3.2).

Source and scope	Who must be named	Status
EU AI Act Art. 26(2); deployers of high-risk systems, incl. Annex III employment uses	Natural persons with competence, training, authority and support for oversight	Binding from 2 Dec 2027 for Annex III
FINMA Guidance 08/2024; FINMA-supervised institutions, Switzerland	Defined responsibilities and accountabilities for AI development, use and monitoring	Supervisory expectation
FCA, SM&CR; UK regulated firms	A senior manager whose responsibilities cover the business area using AI	Binding regime, individual accountability for senior managers
NIST AI RMF GOVERN 2.1 and 3.2; any organisation	Documented roles and lines of communication for AI risk and oversight	Voluntary framework
Microsoft Entra Agent ID; tenants using it	At least one sponsor per agent; optional manager in the hierarchy	Product requirement

Sources: AI Act Article 26 and Annex III (European Commission AI Act Service Desk, consolidated text); Regulation (EU) 2026/1744; FINMA Guidance 08/2024; FCA AI Update; NIST AI 100-1; Microsoft Learn. Full links in References.

None of this makes an employee personally liable for an agent’s actions by default. Legal liability depends on the regime, the role and the facts. What the sources share is narrower and more practical: a supervisor, auditor or works council can ask which person was responsible, and the firm needs an answer that holds up.

A proposal: the Named Principal Record, five fields HR maintains for every agent

The model below is introduced in this article as a proposal. It is an operating design built on the sources above, proposed here rather than drawn from an existing Kainjoo or regulatory standard. It treats each agent the way HR already treats a delegated authority: one record, kept in the HR system of record, mirrored into the identity directory.

Field	What it holds
1. Principal	One named individual, linked to an HR employee record. Groups can serve as co-sponsors alongside the named principal.
2. Mandate	What the agent decides alone, what needs the principal’s approval, and the value, data and customer thresholds between the two.
3. Escalation route	Who the principal escalates to, and who holds authority to suspend the agent when the principal is absent.
4. Reporting line	The principal’s position, and the agent listed under it, so the agent appears wherever that team’s headcount and controls appear.
5. Succession	A named deputy, and a transfer that the incoming principal must accept before it takes effect.

Proposed by Edward Galle in this article. It builds on the sponsor and manager relationships in Microsoft Entra Agent ID and the oversight expectations in Exhibit 1.

Two choices in that record depart from current tooling on purpose. Entra accepts groups as sponsors; the record insists on one individual, because a regulator asking “who” expects a name, and Article 26(2) speaks of natural persons. And the record replaces automatic succession with accepted succession, because a transfer the new principal never acknowledged is the orphaned accountability Microsoft warns about.

The record also gives HR a number to report. Counting the agents with a named, current principal against the agents in the directory produces a coverage ratio that a board, an audit committee or a supervisor can read without any technical background. A falling ratio after a reorganisation is an early sign that succession is happening by default.

Ownership has to move with the person, through the mover and leaver process HR already runs

The weakest moment in agent governance is a job change. When a principal is promoted, transfers or resigns, the identity platform sees an attribute change; the business sees a person who used to know why the agent existed. Treat the principal role as part of the job, and the existing HR events do the work. A leaver checklist that already recovers a laptop and revokes a badge can also list the agents the person sponsors, name the successor and require that successor’s sign-off. A mover event can trigger a review of whether the agent’s mandate still fits the new team.

Consider an illustrative case. A credit-operations lead sponsors an agent that drafts limit-increase recommendations, and she moves to the risk function. Under default settings the sponsorship passes to her manager, who has never configured or reviewed the agent. Under the Named Principal Record, the mover event opens a handover task instead: her deputy, already named in the succession field, reviews the mandate and its thresholds, accepts the transfer, and the identity directory updates from the HR record. If the deputy declines, the escalation route names the person who suspends the agent until a principal accepts. The agent keeps running only while a named person has agreed to answer for it.

Responsibilities then divide across functions. HR owns the record, the reporting line and the lifecycle triggers. Information technology (IT) and security own the identity, the credentials and the permissions, and they remove access when the record says so. Compliance classifies each agent, flagging those that fall under Annex III or a supervisory regime, and maps it to the responsible senior manager where SM&CR applies. The business owner is the principal, holding the mandate and answering for outcomes. Each function works in its own discipline, from one shared record.

Bought-in agents need the same treatment. An agent that arrives inside a vendor’s software still acts in the firm’s name, so it still needs an internal principal, and the contract should say who at the vendor the principal escalates to. FINMA’s guidance points the same way for outsourcing: supervisors checked contractual clauses on responsibilities and liability¹⁰, alongside additional tests and controls, and whether the third party had the necessary skills and experience. The principal is the person who reads those clauses before the agent goes live.

This also changes how firms hire. An agent principal needs judgement about the agent’s domain, the authority to stop it, and enough AI literacy to recognise when its output is wrong. Those are role requirements that belong in job descriptions and performance objectives, which links this work to how firms assess AI capability in performance reviews¹³ and to the practice of budgeting each agent like a new hire¹⁴, with a role, a budget and a manager.

HR can start on Monday with five changes to records and checklists

1. Ask IT for the agent list with sponsors attached. Count agents whose sponsor is a group, a departed employee, or someone outside the team that uses the agent. That number is the size of the accountability gap.
2. Add a principal field to the HR system of record. Link each agent to one employee record, and let the identity directory read the sponsor from HR.
3. Extend the mover and leaver checklists. Make agent handover a named step with a successor’s sign-off, so sponsorship transfers by a named decision.
4. Flag agents that touch employment decisions. Screening, task allocation and performance monitoring fall under Annex III point 4; plan Article 26(2) oversight and Article 26(7) worker information⁷ ahead of the 2 December 2027 application date⁹.
5. Map principals to the accountability regime the firm already runs. For FINMA-supervised institutions, align with how AI responsibilities are documented; for UK firms under SM&CR, tie each principal to the senior manager whose Statement of Responsibilities covers the area.

The reporting line for agents already exists in the identity directory, and it already runs on HR data. HR can either design that line deliberately or inherit the one a default setting produced. Edward Galle helps regulated employers define and staff these roles, from agent principals to the AI-literate managers who oversee them. Employers ready to put a name against every agent can talk to the Edward Galle team.

This article has been reviewed by Haider Alleg, Managing Partner at Kainjoo SA.

References

1. Microsoft Learn. Administrative relationships in Microsoft Entra Agent ID (owners, sponsors, and managers). Last updated 21 July 2026. https://learn.microsoft.com/en-us/entra/agent-id/agent-owners-sponsors-managers
2. Microsoft Learn. Manage agent identities in your organization. Last updated 1 May 2026. https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin
3. Microsoft Zero Trust Assessment. Configure Lifecycle Workflows for Sponsor Mover/Leaver Scenarios (AI_014). https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/AI/AI_014
4. Cloud Security Alliance. Securing Autonomous AI Agents, survey report commissioned by Strata. 4 February 2026. https://cloudsecurityalliance.org/artifacts/securing-autonomous-ai-agents
5. Hugging Face (Hugo Larcher, Adrien Carreira et al.). Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident. 27 July 2026. https://huggingface.co/blog/agent-intrusion-technical-timeline
6. Kainjoo Tech. Your AI Agent Has Permissions but No Employer. Put the Accountable Human in Every Token It Carries. 3 November 2026. https://tech.kainjoo.com/ai-agent-identity-delegation-token/
7. European Commission, AI Act Service Desk. Article 26: Obligations of deployers of high-risk AI systems (consolidated text as at 27 July 2026). https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
8. European Commission, AI Act Service Desk. Annex III: High-risk AI systems referred to in Article 6(2). https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
9. Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI). Official Journal of the European Union, L series, 24 July 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
10. FINMA. Guidance 08/2024: Governance and risk management when using artificial intelligence. 18 December 2024. https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/4dokumentation/finma-aufsichtsmitteilungen/20241218-finma-aufsichtsmitteilung-08-2024.pdf
11. Financial Conduct Authority. AI Update. April 2024. https://www.fca.org.uk/publication/corporate/ai-update.pdf
12. National Institute of Standards and Technology. AI Risk Management Framework 1.0 (NIST AI 100-1), Section 5: AI RMF Core. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/
13. Edward Galle. AI Use Is Now a Promotion Criterion. Most Companies Are Measuring the Wrong Thing. 19 July 2026. https://edwardgalle.com/ai-use-promotion-criterion-performance-reviews-2026/
14. Kainjoo Tech. Budget the Agent Like a New Hire: How Governance Sets the Ceiling on AI Spend at Investment Firms. 14 September 2026. https://tech.kainjoo.com/ai-spend-governance-investment-firms/