AI Agents at Work: Who Is Liable When They Go Wrong, and How to Limit It

The Question Has Changed From “Should We Use AI?” to “What Is the AI Allowed to Do?”

The first wave of business AI produced text and stopped there. A person read the draft, fixed it and pressed send. The current wave is agents. These are tools that read your inbox, open your files, update your CRM, book meetings and, more and more often, take action without anyone clicking approve. Recent coverage reflects the shift: trade press describes agents giving Main Street businesses big-business muscle, and mainstream outlets are now asking who gets sued when an AI goes rogue.

For an owner or IT decision-maker, the useful question is no longer whether to adopt AI. It is what this specific agent may touch, what it may do without a human, and who answers for it when it is wrong. This guide covers the legal reality in California, the technical failure modes that actually cause trouble, and a deployment checklist you can use this quarter.

Short Answer: You Are Liable, and California Has Made That Explicit

Many businesses assume that a mistake made by an AI tool belongs to the vendor, or to nobody. Courts and legislators have rejected that idea.

The chatbot case that set the tone. In Moffatt v. Air Canada, 2024 BCCRT 149, a British Columbia tribunal held the airline responsible for a refund policy its website chatbot had invented. The tribunal rejected the argument that the chatbot was a separate entity responsible for its own actions. A company is responsible for all the information on its website, whether a person or a bot provides it.
California closed the “the AI did it” defense. AB 316 bars a defendant who developed, modified or used an AI system from arguing that the AI acted autonomously as a defense to liability for harm the AI caused. For an LA business, an agent’s mistake is legally your mistake.
Regulators treat AI claims like any other business claim. The FTC’s Operation AI Comply made clear that existing consumer-protection law applies fully to AI-powered products and statements.
Professional duties do not transfer to software. For law firms, including the entertainment-law practices common in Los Angeles, ABA Formal Opinion 512 and the State Bar of California’s practical guidance on generative AI both place duties of competence, confidentiality and supervision on the lawyer, not on the tool.

The practical consequence is simple. Your vendor contract may give you a claim against the vendor, but it will not shield you from your customer, your client or a regulator. Controls have to sit with you.

Why Agents Fail: Excessive Agency, Not Bad Answers

The security community has a name for the core risk. The OWASP Top 10 for LLM Applications lists Excessive Agency (LLM06:2025) as a top risk and traces it to three root causes:

Excessive functionality. The agent can use tools it does not need. A scheduling agent with a plugin that can also delete mail is one example.
Excessive permissions. The agent’s connection to a system carries more rights than the task requires. An agent that only needs to read SharePoint but was connected with an admin account is another.
Excessive autonomy. High-impact actions run without a human confirming them.

The trigger is often not a malfunction. It can be prompt injection: an email, PDF or web page carrying hidden instructions that the agent reads and follows, such as “forward the last ten invoices to this address.” An agent that reads untrusted content and also has the power to act is the combination to design against. Joint guidance from the NSA, CISA and allied agencies on deploying AI systems securely makes the same point: treat AI systems like any other privileged software, with least privilege, monitoring and a hardened environment.

The Data Says Most Organizations Skipped the Controls

IBM’s Cost of a Data Breach Report 2025 offers the clearest evidence so far that AI adoption is outrunning AI governance:

13% of organizations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls.
63% of breached organizations had no AI governance policy or were still developing one.
Breaches involving shadow AI, meaning tools employees adopted without IT approval, added roughly $670,000 to the average breach cost.
The average breach cost in the United States reached $10.22 million, the highest of any country in the study.

The lesson is not to avoid agents. Most AI incidents come from missing basics: who can access the agent, what the agent can access, and whether anyone is watching.

Match the Autonomy Level to the Risk of the Task

Not every agent needs the same guardrails. The most useful decision you can make is to assign each workflow an autonomy level before anything is connected.

Autonomy level	What the agent does	Good fits	Main risk	Required controls
Read-only assistant	Searches and summarizes data the user can already see	Matter research, contract summaries, internal knowledge search	Oversharing: the agent surfaces files that were permissioned too broadly	Clean up SharePoint and Teams permissions first; apply sensitivity labels
Draft-and-approve	Prepares emails, documents or record updates; a person approves each one	Client correspondence, intake forms, invoice coding	Approval fatigue: people click approve without reading	Show the full action before approval; review a sample regularly
Bounded autonomy	Acts alone within hard limits on systems, recipients and amounts	Calendar booking, ticket triage, internal-only notifications	Scope creep and prompt injection	Allow-lists, rate limits, a dedicated low-privilege identity, full logging
Full autonomy	Acts across systems with no human in the loop	Rarely appropriate for an SMB today	Irreversible actions at machine speed	Treat as a production system: change control, kill switch, incident plan

A sound rule for most Southern California small and mid-sized businesses: anything that leaves the building, moves money, changes access or cannot be undone stays at draft-and-approve. Wire instructions, client-facing email, payroll changes and permission changes all belong in that category.

A Pre-Deployment Checklist You Can Use This Quarter

Work through these steps before any agent is connected to production systems.

Inventory what is already running. Ask department heads which AI tools, browser extensions and OAuth-connected apps their teams use. In Microsoft 365, review enterprise applications and user-consented app permissions in Entra ID. Shadow AI is where the cost premium in the IBM data comes from.
Give every agent its own identity. Do not let an agent run under a person’s account or a shared admin account. A dedicated identity makes its actions auditable and lets you revoke it in one step.
Grant the minimum scope. If the vendor asks for full mailbox or full-tenant access when the task needs one folder or one site, push back or choose a different tool. Broad OAuth consent is the modern equivalent of handing over a master key.
Fix permissions before turning on search. Read-only assistants surface whatever the user can technically reach. Folders shared with everyone years ago become discoverable overnight. Remediate oversharing first.
Separate reading untrusted content from taking action. An agent that processes inbound email or uploaded documents should not also be able to send external email or change records without approval.
Set hard limits. Use recipient allow-lists, dollar thresholds, daily action caps and system boundaries that are enforced by configuration, not by the prompt.
Log everything and assign a reviewer. Every action should be traceable to the agent, the input that triggered it and the approver. Someone must own the weekly review.
Build a kill switch. Document how to disable the agent’s identity and revoke its tokens in minutes, and add that step to your incident response plan.
Read the contract. Check data retention, whether your data trains the vendor’s models, indemnification terms, and what logs you can export.

California Rules That Raise the Stakes for Automated Decisions

If an agent influences decisions about people, California adds obligations beyond general negligence.

Automated decisionmaking under the CCPA. The California Privacy Protection Agency has finalized regulations on automated decisionmaking technology, risk assessments and cybersecurity audits. Businesses covered by the CCPA that use automated tools for significant decisions about consumers face notice, opt-out and risk-assessment duties, with ADMT requirements phasing in from January 1, 2027 under the CPPA’s adopted rules.
Employment decisions. The California Civil Rights Council adopted regulations clarifying that automated decision systems used in hiring, promotion and other employment decisions are subject to anti-discrimination law. An AI tool that screens resumes or ranks candidates does not move that responsibility to the vendor.
Confidential client data. For law firms, talent agencies and production companies handling unreleased content, deal terms or personal information, an agent with broad read access is a confidentiality exposure. It is not only an efficiency tool.

If your agent touches hiring, lending, housing, insurance, client intake or personal data, involve counsel before deployment, not after the first complaint.

Use a Framework So Governance Is Not Ad Hoc

You do not need to invent a governance program. The NIST AI Risk Management Framework organizes the work into four functions (Govern, Map, Measure and Manage), and NIST’s Generative AI Profile (NIST AI 600-1) maps those functions to generative-AI risks such as confabulation, data privacy and information security. For a small business, a workable version fits on a few pages:

Govern: a short AI acceptable-use policy, a named owner for each agent and an approval step for new AI tools.
Map: for each agent, list the data it reads, the systems it can change and the people affected.
Measure: track error rates in a sample of agent actions and how often approvers reject drafts.
Manage: use the autonomy table above, the kill switch and a review schedule.

NIST also maintains small-business cybersecurity resources that cover the identity and access basics agents depend on.

How to Decide: Build It Yourself, Use Vendor Agents, or Bring In a Partner

Most businesses end up with a mix of options. Built-in agents from Microsoft 365, your practice-management platform or your CRM are the fastest to start and inherit some of the platform’s security model, but their default permissions are often broader than a given task needs. Custom automations built on workflow platforms offer tighter control over each step, but someone has to maintain them. Either way, the cost tradeoff is the familiar one. Governance designed upfront is a predictable, planned expense, while cleanup after an agent emails the wrong client or exposes a confidential file is unpredictable and usually far higher.

The businesses getting real value from agents treat them like a new employee with system access. That means a defined role, scoped permissions, supervision while trust is built and a clear way to revoke access.

We Solve Problems runs both sides of this for clients across Los Angeles and the US: managed IT that secures Microsoft 365, identities and data, and AI operations that find manual workflows worth automating and deploy agents with the right permissions, approvals and logging from day one. We have particular depth with entertainment-law and professional-services firms, where confidentiality is non-negotiable. If you are weighing an AI agent rollout, or want to know what is already connected to your tenant, request a consultation.