Who decided: attribution and the agentic estate

Regulators ask institutions to explain, contest and attribute automated decisions. Explanation is a model question. Contestation is a process question. Attribution is neither — it is an identity question, and it is the one most programmes defer.

Explanation asks why the system produced this output. It is genuinely difficult, but it is also the most delegated of the three: model documentation, vendor attestations and validation reports all speak to it. An institution can buy its way to a defensible answer.

Contestation asks how a customer or an employee challenges the outcome. It is a process question: a channel, a deadline, a human with authority to reverse the decision. Uncomfortable, but designable.

Attribution asks something older and simpler: under whose authority did the system act? When an automated decision is disputed, the institution must be able to say who decided that this system may act, on what mandate, with what limits. That answer does not live in the model documentation. It lives in the identity record — if there is one.

An agent that acts on a customer record does so under a credential. If that credential is shared, unowned, or standing, the attribution trail ends before it reaches a person or a mandate. The documentation may be complete and the answer still unavailable.

Consider the three failure modes. A shared credential tells you which key acted, not which system, team or decision stood behind it. An unowned credential tells you a project existed once; it cannot tell you who continues its mandate. A standing credential — authority granted once and never revisited — tells you the institution decided something years ago and has not asked since whether it still agrees.

In a human process, attribution is reconstructed from the employment record: the role, the delegation, the approval chain. For non-human actors, no equivalent record exists unless the institution builds one. Most have not.

The record is not elaborate. Each agent identity needs an owner, a mandate, a defined scope of authority and a review date. The mandate is the important part: it is the written answer to the question of who decided this system may act, and it exists before the system acts, not after the dispute arrives.

The practical remedy is unglamorous: ownership, lifecycle and review applied to the non-human population before agents are given standing authority over regulated processes.

Institutions sometimes treat this as a brake on adoption. It is the opposite. The programmes that stall are the ones that cannot answer the attribution question when it is first asked — by a regulator, an auditor or their own board. The programmes that move are the ones that can answer it without an investigation.

When the question comes — who decided? — the answer should be a name and a mandate. If producing it requires a forensic exercise, the estate was never governed. It was only documented.