The Vanishing Defendant — and How It Reappears
Keel Editorial Team
Research on AI governance, budgets, and auditability
A Davis Polk partner just gave the AI-accountability problem its sharpest name yet.
In a June 2026 Law360 piece, Joseph Hall — a partner at Davis Polk and head of the firm's corporate governance practice — examines what happens when an autonomous AI agent does something a regulator would normally prosecute. He calls it the vanishing defendant.
His argument is uncomfortable and clean. Almost all of securities law — and most of liability law generally — works by tracing an act back to a person. You identify who did it, then you ask what they intended and what they controlled. Intent and control are the hooks the whole system hangs on. Agentic AI quietly removes the hook: when a system decides and acts on its own, across steps no human directly supervised, there may be no person to whom the conduct, the intent, and the control cleanly attach. The act happened. The harm is real. But the defendant has vanished.
This is not a securities footnote
Read it broadly and it is every AI-accountability question, stated by someone whose job is to win in court.
Who answers when the agent moves the money, sends the email, approves the transaction, touches the data?
The organization is on the hook. IBM's latest C-suite research found that many CIOs and CTOs are already accountable for AI systems they do not fully control. But "accountable" and "able to point to who did what" are not the same thing.
The space between them is the vanishing defendant in plain clothes.
"The AI did it" is not an answer
The tempting move is to treat the agent as the actor.
It answers nothing.
An agent is not a person. It has no intent to weigh, no assets to recover, no standing to defend itself. Pointing at the agent does not make a defendant appear. It just confirms one is missing.
That is why the accountability question cannot stop at the model, the tool, or the workflow. Those are execution surfaces. The harder question is authority:
- who allowed this agent to act?
- what was it allowed to do?
- what limits applied before execution?
- what evidence shows the action stayed inside that authority?
If those answers only exist after an incident team reconstructs them, attribution is still fragile.
How the defendant reappears
The defendant comes back into focus the moment you can do one thing: trace the action back through an unbroken chain of authority to a human who permitted it.
Not "the AI decided."
This agent was allowed to do this, within these limits, because this person delegated that authority — and here is the record of what it actually did.
That chain is what restores attribution. It turns "no one did this" into "this action was authorized here, by this party, and carried out as recorded." The defendant stops vanishing the instant the authority is legible and the action is provable.
The control has to exist before the action
This is where most AI governance programs are still behind the risk.
They collect logs. They write policies. They review vendors. They hold steering meetings. Those things matter, but they do not by themselves prove that a specific autonomous action was authorized before it happened.
For agentic systems, the pre-action decision is the control surface. The record that survives after the fact is the accountability surface.
That is the practical bar:
- decide what the agent can do before it acts
- bind the decision to actor, scope, policy, and limits
- record what happened afterward
- make the chain reviewable without asking everyone to trust a reconstruction
This does not make the agent a legal person. It does not pretend the model has intent. It does something narrower and more useful: it keeps the thread between a human delegation of authority and the autonomous action that followed.
That is the whole task, stated plainly. Not anthropomorphizing the agent. Not giving it a lawyer. Just never losing the thread between what the agent did and the human authority behind it.
Decide what your AI can do. Prove what it did. Then there is always someone to answer the question, because the record already does.