The professional boundary problem: accountability when AI agents act within credentialed domains

Every licensed profession rests on a social contract: the state grants a monopoly on certain activities in exchange for the profession's commitment to minimum competence, ethical obligations, and accountability when things go wrong. A physician can prescribe medication, carry malpractice liability, and be sanctioned by a licensing board. A security engineer can certify compliance, carry professional liability, and be held accountable against a professional standard. A cryptographer can approve key management procedures and bear responsibility for their correctness.

AI agents are now performing, at scale, the functional equivalent of many of these credentialed activities. A care agent that identifies medication non-adherence and recommends a care escalation is doing something recognizably similar to clinical judgment. A security agent that certifies a software component as safe for deployment is doing something similar to what a certified engineer would do. A cryptographic migration agent that determines which systems have satisfied post-quantum transition requirements is doing something similar to what a credentialed security architect would do.

None of these agents hold credentials. None carry professional liability. None can be sanctioned by a licensing board. This is the professional boundary problem.

The credential gap

The credential system was designed to solve a hard problem: how do you ensure that someone making high-stakes decisions in a technical domain is minimally qualified, and how do you create accountability when their decision causes harm? The answer was to require demonstrated competence, register practitioners publicly, and create a direct line of accountability from decision to decision-maker.

AI agents disrupt this structure without resolving the underlying problem. The decisions that require credentials are high-stakes because they require domain expertise, ethical judgment, and accountability under uncertainty. These properties do not become less important because an agent is making the decision. They become harder to locate.

When an agent makes a care decision, the accountability chain looks like this: the agent is developed by a company, contracted by a care provider, which has a relationship with the patient. The specific decision — this escalation, this alert, this recommendation — connects to no licensed practitioner. The credential structure has been bypassed, but the need for accountability has not.

At the care crossing

In physical-world care, the professional boundary problem appears wherever agents make decisions that functionally resemble clinical judgment. A care agent that monitors vitals and generates care recommendations is performing activities that, executed by a human, would require clinical training and licensure. The agent's output — "this pattern suggests worsening function; suggest contacting the care team" — is functionally equivalent to a clinical alert generated by a nurse or physician assistant.

The distinction matters for accountability. When a licensed practitioner generates a clinical alert that turns out to be wrong, there is a clear accountability pathway: the practitioner's judgment is evaluated against professional standards, and the outcome connects to a specific credentialed actor. When an agent generates the same alert and turns out to be wrong, the accountability pathway is unclear. No credential was issued. No professional standard applies directly. No licensing board has jurisdiction over the agent.

The problem is not that agents cannot perform these functions well — they often can. It is that the accountability architecture for when they perform them badly does not exist in the form that credential systems provide. The care recipient's recourse is narrower, the evidentiary standards less clear, and the responsible party harder to identify.

At the hardware crossing

Hardware security involves activities with corresponding professional credentials — certified system administrator, certified security analyst, certified penetration tester. An agent that performs security assessments, evaluates vulnerability severity, or signs off on compliance configurations is performing activities with credentialed equivalents. The outputs of these activities — a compliance status, a vulnerability rating, a security recommendation — carry weight in downstream operational decisions.

When an agent produces a hardware security evaluation that turns out to be wrong — a system declared adequately secured that was not, a vulnerability rated low-severity that was later exploited — the accountability question is the same. No credentialed practitioner signed off on the specific judgment. The accountability pathway that credentials provide is absent, and the harm that follows cannot be traced back through a professional accountability structure that never existed.

At the post-quantum crossing

Cryptographic infrastructure is one of the most credential-intensive areas of information security. Cryptographers, security architects, and compliance officers who certify cryptographic controls are accountable through professional and contractual channels when those controls fail. An agent that manages cryptographic migrations — recommending algorithm deprecations, certifying transition completion, approving the sequencing of key management changes — is performing work that, in human hands, would carry this professional accountability.

When a migration agent recommends a transition sequence that leaves a window of cryptographic exposure, or certifies a system as migration-complete before it actually is, the missing accountability is not incidental. It is structural. The work was performed outside the credential framework that exists precisely to create accountability for high-consequence technical decisions. The organization that relied on the agent's certification has no professional recourse against the agent and no direct recourse against the practitioner, because no practitioner was involved.

What accountability requires

The professional boundary problem does not have a simple solution, and it does not have a credential solution. Issuing credentials to AI agents is not coherent — credentials certify demonstrated competence and impose ongoing obligations on an entity capable of bearing them. An agent cannot sit an examination, carry malpractice insurance, or be subject to disciplinary proceedings in any meaningful sense.

What is coherent is requiring that agent actions within credentialed domains remain connected to a credentialed human who can bear the accountability. This is not the same as requiring human approval for every agent action — that would eliminate most of the value agents provide. It is requiring that the accountability chain remain intact: that somewhere in the decision hierarchy, a credentialed practitioner can be identified who has reviewed the agent's work at sufficient depth to bear responsibility for its quality.

Where no such review exists — where the agent acts within a credentialed domain and no credentialed human is in the accountability chain — the credential system has not been replaced. It has been circumvented. The accountability that credentials provide does not disappear because agents don't hold them. It becomes unlocatable. And unlocatable accountability is, in practice, no accountability at all.