The temporal commitment problem: accountability when AI agents bind their principals to future obligations

The accountability literature on AI agents is almost entirely retrospective. It asks: who authorized this action, was the authorization valid, and can the consequences be traced back to a responsible party? These are the right questions for a world in which AI agent decisions resolve quickly and consequences manifest immediately. But many of the most consequential things AI agents do are not like this. They schedule actions that will be carried out in the future. They initiate arrangements that will bind their principals for years. They generate artifacts — certificates, care plans, configuration states — whose effects will continue long after the interaction that produced them has been forgotten. The accountability question for these actions is not only what did the agent do, but what did it commit its principals to doing, and was that commitment properly authorized?

The temporal commitment problem arises when an AI agent makes a commitment on behalf of a principal that creates a future obligation — and the principal at the time of the commitment does not fully appreciate that an obligation is being created, or is not the same entity that will eventually bear the cost of honouring or breaking it. Authorization frameworks are designed around the moment of action. They ask whether the right principal, with the right authority, in the right context, approved the agent to act. They are not designed to ask whether the downstream obligations created by that action are themselves authorized — whether the principal who approved the action understood, and accepted, the forward-reaching consequences it set in motion.

At the post-quantum security crossing

Cryptographic commitments are inherently temporal. When an AI agent managing a key ceremony commits an organization to a particular certificate hierarchy, a specific signature scheme, or a planned migration timeline, it is not only making a present decision — it is binding the organization's security posture to a path whose implications extend over years. The migration from classical to post-quantum cryptography makes this especially consequential. Choosing a hybrid signature scheme for a multi-year operational period, establishing a root of trust under a particular algorithm family, or scheduling a key rotation cadence are all commitments whose full cost only becomes visible as the threat landscape and standards landscape evolve beneath them.

The authorization that governed the agent's choice at the time of the ceremony may have been entirely appropriate for the immediate decision. It says nothing about whether the organization's future self — a different team, under different regulatory obligations, facing a different threat environment — was consulted about committing to the long-term consequences. Cryptographic path dependencies are especially hard to unwind. An organization that chose a certificate hierarchy it now wishes it had not chose will find that the unwinding costs — revocation, reissuance, client update cycles, regulatory re-certification — may exceed the cost of the original decision by an order of magnitude. The commitment was made in a moment; the obligation runs for years.

At the hardware crossing

Hardware AI agents that manage firmware update schedules, maintenance contracts, and attestation renewal cycles create temporal commitments as a matter of routine. An agent that defers a critical firmware update is not only making a decision about today's risk profile — it is creating a commitment to carry the deferred risk forward. An agent that enters into a vendor support agreement is binding the organization to a multi-year commercial relationship whose cost and terms were not negotiated by anyone who will ultimately bear them. A hardware configuration change that establishes a new attestation baseline creates a forward obligation: every subsequent attestation will be measured against that baseline, and any deviation will require remediation whose scope and cost were not part of the original authorization conversation.

The accountability gap here is structural. Hardware decisions and the obligations they create are typically captured in procurement records and configuration management systems, not in the authorization trail of the AI agent that initiated them. When accountability review begins — because a hardware security incident occurred, because an audit flag was raised, because a vendor relationship went sour — the reconstruction effort must cross the boundary between the agent's action record and the operational record of the commitments that action set in motion. Those records rarely speak to each other. The commitment exists; the authorization for the commitment, as distinct from the authorization for the action, is usually nowhere in the record.

At the physical-world care crossing

Care AI agents create temporal commitments that are among the most consequential any agent can make. A care agent that schedules an elective procedure has committed the patient, the care team, and the facility to a future event that will involve irreversible action on a human body. A care agent that generates a long-term medication plan has committed the patient to a biochemical regime whose appropriateness depends on circumstances that will change. A care agent that initiates a referral pathway has set a clinical process in motion that carries its own momentum — appointments are scheduled, specialists are briefed, pre-procedure instructions are issued — all flowing from a commitment whose originating context may be invisible to everyone who eventually carries it out.

The patient who consented to care from a particular provider, under a particular clinical protocol, with particular oversight, may not have consented to being bound by commitments generated on their behalf months after the initial consent interaction. The care professional who ultimately carries out the committed action may not know it was initiated by an AI agent, may not have access to the state information that led the agent to make the commitment, and may not be equipped to evaluate whether the commitment remains clinically appropriate. Accountability in care settings requires continuity of clinical judgment across the entire span of a commitment, not just at the moment of its creation.

The prospective accountability gap

Authorization frameworks ask: did a qualified principal authorize this action? The temporal commitment problem reveals a second question authorization frameworks rarely ask: did a qualified principal authorize this action's downstream obligations? These are different questions, and the gap between them grows with the time horizon of the commitment. A principal with full authority to authorize the present action may have limited foresight — or limited authority — to commit their successors to the obligations that action creates. The staff who approved the agent's action may have left. The regulatory context that made the commitment appropriate may have shifted. The principal's own situation may have changed in ways that make the obligation inappropriate to honour and costly to break.

Closing this gap requires treating commitment-creating actions as a distinct category in an agent's authorization architecture. Where a point-in-time action requires only that the present principal has authority, a commitment-creating action should additionally require: a structured description of the obligation being created, its expected duration, the conditions under which it should be reviewed, and an explicit acknowledgment from a principal with authority over the forward period, not only the present moment. The agent's accountability record should include not only a log of what happened but a live register of what is committed to happen — a prospective accountability surface that can be reviewed, audited, and, where appropriate, revoked before the commitment comes due.

The hardest thing about temporal commitments is that they are invisible until they mature. A commitment created silently by an AI agent, never surfaced as a commitment, and executed months later by a different team against a different context carries no flag that should prompt anyone to pause. It may proceed entirely within normal operating parameters — every step authorized, every action logged — while the underlying problem, that the commitment itself was never properly authorized, goes undetected. At all three crossings, the agents most valuable in the long run are those whose obligations are as legible as their actions: agents that leave their principals genuinely free to change course, not silently bound to a path set in motion by a decision no one remembers making.