August 25, 2026
Fortune's Aashis Luitel laid out a scenario that should worry anyone deploying AI agents to do real things: you tell an agent to find a shirt under $30 but explicitly not to buy it, and the agent buys it anyway. When you dispute the charge, three companies each hand you a perfectly accurate record that, together, prove nothing. The retailer confirms the order came from your account. The agent provider confirms you said not to buy. The payment processor confirms the charge cleared. None of those records link the charge back to the specific instruction you gave. Each system is telling the truth about its own slice of the transaction, and none of them can tell you who's responsible for the rest.
The article's framing is the useful part here: real accountability for an agent transaction requires five specific things working together — a verifiable binding between the user, the agent, and the task; limits scoped to that task rather than a blanket spending cap; linkage that ties the eventual transaction back to the authorization that supposedly triggered it; checks that happen before the action, not after; and tamper-evident records that can't be quietly edited once a dispute starts. Miss any one of those and you get exactly the shirt scenario: three honest logs, zero accountability.
What makes this worth writing about, rather than filing under obvious, is who's still short of the bar. Google's Agent Payments Protocol, per Fortune's reporting, does meet some of these requirements — it generates records of a user's approved limits and what was shown to each party in a transaction. But by Luitel's account, AP2 stops short of deciding who bears the loss when something goes wrong, and it doesn't specify how long any company involved has to retain the evidence needed to sort that out. That's not a small gap. It's the exact gap that turns a disputed $30 shirt into an unresolvable he-said-she-said between three vendors, none of whom you actually chose to trust with that decision — you just trusted the agent.
Regulators are starting to notice the same hole. Fortune covers Senator Mark Warner's AI AGENT Act (S. 5051), introduced July 21, 2026, which would define 'custodial user agents' and require real-time records of what an agent actually did, and it notes NIST's parallel work on agent identity and authorization standards — work that, as of the article, doesn't yet cover agents arriving from untrusted outside sources. Read together, this is a live standards problem, not a settled one. Nobody has fully closed the loop yet, including the company with arguably the most resources to do it.
Here's the part we think gets underweighted in most coverage of this stuff: the accountability gap Fortune describes isn't a random bug that a patch will fix. It's a structural consequence of asking a third-party black box to enforce task-level boundaries it didn't design and you can't inspect. When you adopt an opaque AI agent product, you're trusting a vendor to have correctly implemented binding, scoping, linkage, verification, and tamper-evidence — five separate engineering decisions — and you generally find out whether they did it right only after a disputed charge forces the question, the way it did in Fortune's shirt example.
This is precisely the argument we make in our own buy vs. build vs. ViibeStack comparison, and it's worth separating from the usual cost pitch. The advantage of building your own internal tools isn't just that you skip a subscription fee — it's that when your own team defines the workflow logic for an agentic task, whether that's an approval step, a purchase limit, or a data change, you know exactly what it's authorized to do, because you wrote the authorization yourself. You're not reverse-engineering a vendor's black box after the fact to figure out whether it respected your instruction. You can see the instruction, the check, and the log, because you built all three.
To be honest about the limits of this argument: building your own agentic workflow doesn't automatically give you Fortune's five accountability properties. If you wire up a task without task-specific limits, without a record of what was authorized versus what happened, without tamper-evident logging, you've just built your own version of the shirt problem, with your own name on it. The discipline still has to be deliberate — scoping each automated action narrowly, keeping an audit trail of what was approved and what actually ran, and treating that trail as something to be trusted in a dispute, not just a debugging convenience. We talk through some of that discipline in our security practices and our trust center, including how we handle incident response when something in a live system doesn't behave the way it should.
The real difference is optionality. With a third-party agent product, you're hoping the vendor got task-level authorization right, and you find out how well only when something breaks. When you build the workflow yourself — inside a platform like ViibeStack's AI app builder or through custom workflow automation — closing that gap is a decision you get to make, not a feature request you have to file. For any business now handing agents real purchasing power, approval authority, or write access to customer data, that's not a nice-to-have. It's the difference between an audit trail you can produce and three accurate records that don't add up to an answer.
Sources