Who's accountable when AI acts with credentials

Accountability for AI decisions is the central unsolved problem in enterprise cyber security. When an AI agent acts autonomously — accessing systems, making decisions, executing workflows with legitimate credentials — existing security frameworks don't answer the question: who is accountable?

This session addresses that gap directly.

Drawing on P&L-accountable AI transformation work across Australian enterprises, this presentation maps the accountability void between AI governance policy and operational security programs. Most organisations have invested in governance frameworks. Few have built the operational structures needed to enforce them when AI acts with credentials.

1. The accountability gap: Why existing RBAC, PAM and identity frameworks were designed for humans — and fail when applied to AI agents acting at machine speed with legitimate access.
2. Incident anatomy: What actually happens when an AI agent causes a security event. Who gets called? What does the audit trail show? What does the governance policy say versus what the operational runbook requires?
3. The E.A.R. framework applied to AI security governance: Eliminate (which AI-agent access points can be removed), Automate (which oversight functions can be systematised), Reallocate (which human accountability checkpoints must be preserved).
4. Practical implementation: A working model for organisations at different stages of AI deployment maturity — from AI-pilot to AI-at-scale — with specific controls and accountability ownership models.

Attendees leave with a concrete framework for assigning accountability to AI-agent actions before the first incident, not after.