In November 2022, on the day his grandmother died, Jake Moffatt asked the chatbot on Air Canada’s website about bereavement fares. It told him he could buy a full-price ticket and apply for the discount afterward. The airline’s actual policy did not allow that, and when he applied, Air Canada refused. In the dispute that followed, the airline argued that it could not be held liable for what the chatbot said. British Columbia’s Civil Resolution Tribunal read that as a claim that the chatbot was a separate entity responsible for its own actions, and rejected it. Tribunal member Christopher Rivers wrote that the chatbot “is still just a part of Air Canada’s website.” The airline paid Moffatt about C$812 in refund, interest and fees (Moffatt v. Air Canada, 2024 BCCRT 149).
That was one chatbot answering one question. Companies are now deploying AI agents that act: they send email, change records and pay invoices. Many of these agents can also start other agents, called subagents, and hand them part of the job. AI agent delegation is where the Air Canada defense will come back, and it should fail again. A company should treat every action a subagent takes with company credentials as an action the company took. It follows that no subagent should inherit its parent’s access. Each handoff needs its own narrower grant, traceable to the person who approved the original work.
In 2023 I oversaw the first commercial launch of GPT-4, inside Bing. That system answered questions, and the risks we managed were about what it said. An agent that delegates raises a question most companies cannot yet answer from their own records: who gave the second agent permission?
What the subagent was allowed to do
Take a hypothetical accounts-payable workflow. An employee approves an agent to review incoming invoices and flag discrepancies. The agent finds a mismatch and, to save time, starts a subagent to email the supplier about it. The subagent writes from the company’s accounts-payable address, using credentials it inherited from the first agent. A reply arrives with an explanation and a new bank account for future payments. The subagent records the new account and closes the query. The employee who approved the review never sees the exchange.
That last step is how invoice fraud works. A message from a plausible sender changes the payment details, and the money follows. The FBI’s Internet Crime Complaint Center counted about $3 billion in reported business email compromise losses in 2025 (2025 IC3 Annual Report, summarized by Alston & Bird). In this version no employee was fooled. The subagent carried the fraudster’s request into the payment system on the company’s behalf, and the only human approval on record covers reviewing invoices.
The employee authorized a review. Nobody authorized the agent to recruit help, and nobody authorized anything to change a supplier’s bank details.
Who pays when a subagent gets it wrong
The law already has a rule for anyone who acts on your behalf, and it is very old. If you send someone to act for you, you are responsible for what they do, as long as you gave them permission or the other side had good reason to think you had. A company that sends a salesperson to sign a contract is usually bound by that signature. That holds even if the salesperson went further than the company wanted, because the customer had no way to know.
At the AI Infra Summit in Santa Clara in September, Gauri Manglik, who runs legal, privacy and AI governance at GoFundMe, applied that rule to AI agents. Her example was simple: if an agent spends $10,000 on someone’s behalf, that person owes the $10,000 (Broadband Breakfast).
Go back to the invoice example. The supplier received an email from the company’s own address. It had no way to know that software wrote it, or that no person at the company had approved it. To the supplier, the email came from the company. That is the situation in which a court is most likely to hold the company responsible.
No court has yet ruled on a case where a subagent acted for a company. Until one does, the safe assumption is that the company owns whatever its subagents do. Air Canada argued that its chatbot acted on its own, and it lost.
The objection from IT
A chief information officer will say this problem is solved. Companies have run software under service accounts (logins that belong to a system rather than a person) for decades, and robotic process automation bots already pay invoices. The controls built for those systems are the right place to start. They were designed for software that follows a script someone wrote and approved. An agent decides while it runs whether to delegate, to which system, and with what access. Nobody approved that decision, because nobody knew in advance it would be made.
The technical pieces to fix this exist. An internet standard called OAuth 2.0 Token Exchange (RFC 8693) lets one system act on behalf of another while the credential records both who is acting and whom it is acting for, so a chain of handoffs can carry its history with it. The practice lags the standard. Nicky Pike, field chief technology officer at Coder, told the same summit audience that a single agent’s action can still be traced to the employee who requested it. Asked whether any product preserves delegated authority across a full chain of agents, he said he had not seen the problem solved. His summary: “We’re giving AI way too much authority.”
Who can stop it
Management should name one executive accountable for each agent workflow that can reach a customer, a supplier or the company’s money. That executive owns the response plan: which actions stop for human approval, who receives the alert, who can suspend the chain, and who investigates afterward. I’ve argued that boards need stop authority over AI systems. Delegation is where that authority gets tested, because the stop has to reach every subagent the original agent started.
Withdraw the original human approval and time how long it takes for the last subagent to stop acting. If management cannot produce that number, the company does not have stop authority.
The pressure against all of this is internal. A team paid on automation volume will treat each approval step as a cost against its target. An analyst who questions a delegated action is, in practice, questioning the executive who sponsored the system. Broad permissions stay in place because narrowing them breaks something, exceptions go unrecorded, and people learn to let the chain run. Some workflows will slow down when each delegation needs its own grant. Where a team pushes back hard, look closely at its business case. It was probably counting on authority nobody approved.
What to ask management
Start with a count: how many of our agents can start other agents today? If the answer is “we would have to check,” the board has its first finding.
Then choose one workflow with consequences outside the team that built it, and ask to see a single delegated action traced from end to end: the person who approved the work, each agent in the chain, the access each one held, what it did, and how many minutes it took to stop the chain once that approval was withdrawn.
How ready is your board to oversee AI agents? Take the Free Assessment
FAQ
What is AI agent delegation? AI agent delegation is when one AI agent hands part of its task to another agent, called a subagent, which then acts with some of the first agent’s access. The subagent may send messages, change records or move money without a person approving that specific step.
If the company approved the first agent, does that approval cover its subagents? Not automatically. Leadership should decide whether an agent may delegate at all and what limits travel with each handoff. On liability, the safer operating assumption is that the company is bound by what a subagent does with company credentials. Legal counsel should assess the specific facts and applicable law.
Who should own an incident involving a subagent? One named executive should own the response plan for the workflow, with defined routes to legal, security, privacy and the affected operating team. The plan should say who can pause the whole chain and who preserves the records needed to reconstruct what happened.
What should a board ask management to show? A count of agents that can start other agents, and one delegated action traced from the approving person through every agent in the chain, including how long it took to stop the chain when the approval was withdrawn.
Liat’s book: The Bias Advantage.
