The anticipatory accountability problem

Accountability architecture for AI agents has been built almost entirely in retrospect. Tamper-evident logs, forensic reconstruction, audit trails — these mechanisms ask what the agent did and whether it can be explained after the fact. This is appropriate when the cost of post-hoc review is low relative to the cost of the decision: a recommendation reviewed by a professional before acting, a document reviewed before filing. But AI agents deployed at the three crossings — post-quantum security, hardware, and physical-world care — increasingly act in domains where post-hoc review is structurally too late. The audit trail arrives after the irreversible moment has passed.

What retrospective accountability assumes

Standard accountability frameworks assume a temporal gap between agent action and consequence. The agent makes a recommendation; a human reviews it; the human acts. The accountability record captures the recommendation, the review, and the action. Even in more automated contexts, the assumption holds that something can be checked before it matters: a flag can be raised, an alert can halt a workflow, a human can intervene.

This assumption holds in low-stakes, reversible, or inherently delayed domains. It fails precisely in the domains where AI agents are most valuable.

Where the assumption breaks

Post-quantum migration decisions can take effect across a distributed system faster than a human reviewer can be notified. Hardware configuration changes in large fleet deployments can propagate to thousands of nodes in seconds. In physical-world care, an agent's intervention — a medication adjustment, a care escalation, a safety alert — happens in real time, at the moment a person needs it. Review that arrives after the decision is not oversight; it is forensics.

The consequence is not that accountability becomes impossible — logs can still record what happened. The consequence is that retrospective accountability has already accepted the risk. If the decision was wrong, the log tells you it was wrong after the harm occurred. This is accountability in name only.

At the post-quantum crossing

Cryptographic migration is both irreversible and time-sensitive. Once an agent has deprecated an algorithm across a production system, the rollback cost is not equivalent to the forward cost. An agent operating in this domain acts on technical knowledge that post-hoc reviewers may lack, at a speed that prevents timely review, with consequences that are difficult to reverse. The audit trail of a migration decision is valuable for retrospective analysis. It provides no anticipatory protection.

At the hardware crossing

Hardware fleet agents executing configuration changes operate on a cadence that human oversight cannot match at scale. A change pushed to ten thousand devices is a physical-world fact before any reviewer has assessed it. The accountability record is complete — but the opportunity to prevent a bad decision has already passed. Retrospective accountability for fleet operations is the discipline of learning from disasters, not preventing them.

In physical-world care

Physical-world care agents act on behalf of people who cannot oversee their actions in real time. An overnight care agent making a decision at 3am does not have the option to wait for a human review before acting. The value of the agent is precisely that it can act when humans cannot. The accountability record of that action is produced after the decision was made and cannot undo it.

What anticipatory accountability requires

Addressing the gap requires shifting some accountability burden from post-hoc audit to pre-action constraint. This takes several forms.

Pre-deployment certification asks: has this agent's behaviour been sufficiently characterised, across a distribution of inputs relevant to its deployment domain, that deployers can assert what it will do before it does it? This is distinct from testing for past performance — it is a forward-looking claim about future behaviour.

Runtime attestation asks: can the agent demonstrate, in real time, that it is operating within its certified parameters? Hardware-rooted attestation at the security crossing means not just "this is the model we deployed" but "this model, on these inputs, is behaving as characterised."

Action envelopes ask: before the agent acts, can it verify that the proposed action is within a pre-committed domain of safe actions? An envelope is not a policy — it is a boundary. An agent that cannot confirm an action is within its envelope should not act unilaterally.

Human-on-the-loop thresholds ask: which decisions are consequential enough to require a human decision point before action, not just a human review after? Setting these thresholds is an accountability design question, not only a risk management one.

None of these mechanisms is sufficient alone. Together, they constitute an anticipatory accountability layer — one that acts before the irreversible moment, not after. Retrospective accountability is about what happened. Anticipatory accountability is about what can happen — and what must be prevented from happening without appropriate oversight. Agents deployed at the crossings need both. Building only the retrospective layer and claiming accountability is complete is a common and serious design error.