The Question That Comes After Identity
Identity frameworks help answer some fundamental questions.
- Who or what is the agent?
- Which organisation does it represent?
- What permissions has it been given?
- Can its actions be traced?
- Can its authority be restricted, suspended or revoked?
These are necessary foundations for trusted agentic AI. Without them, organisations will struggle to distinguish authorised activity from error, manipulation or fraud. But even a perfectly identified agent can produce a disputed outcome.
Illustrative scenario
Imagine an autonomous procurement agent that accepts revised supplier terms late on a Friday afternoon.
The agent is genuine. Its credentials are valid. It is technically permitted to negotiate and accept amendments. The transaction falls within the financial limits programmed into the system.
On Monday morning, the business discovers that the revised terms include a longer commitment, a broader indemnity or a limitation-of-liability clause that no one intended the agent to accept.
- The supplier says a binding agreement has been reached.
- The business says the agent exceeded its intended authority.
- The technology provider says the system operated exactly as configured.
Identity helps establish what happened. It may show which agent acted, which permissions were used, what information the system considered and when the agreement was accepted.
But it does not resolve the disagreement. The real dispute concerns authority, intention, responsibility and legal effect.
- Was the agent legally authorised to bind the business?
- Was it merely technically permitted to take the action?
- Should the supplier have understood that certain terms required human approval?
- Was the problem caused by the system, its configuration, the organisation’s instructions or the contractual structure surrounding its use?
An identity framework can help reconstruct the event. It cannot determine what should happen next.
What Is a Dispute Resolution Architecture?
A dispute resolution architecture is the organisational framework through which contested AI actions are recognised, examined and resolved.
It is broader than a complaints process. It is also broader than a contractual dispute resolution clause.
It is the structure that connects AI governance with legal responsibility, organisational accountability and access to remedy. The concept starts from a simple premise: if an organisation gives an autonomous system the ability to act, it should also be prepared for the possibility that the action will be challenged.
That challenge may come from a customer, supplier, employee, professional adviser, regulator or another part of the organisation. It may concern a financial decision, a contractual commitment, the use of confidential information, the treatment of an individual or the commercial consequences of an automated action.
The issue may not be that the technology failed. The system may have operated as designed.
The dispute may arise because the design did not reflect the organisation’s true intention, because authority was not clearly defined or because different parties interpret the same action in different ways.
A dispute resolution architecture provides the institutional setting in which those questions can be addressed.
It enables an organisation to move from asking, “Did the agent act?”, to asking, “Should the action stand, who is responsible and what response is appropriate?”
That distinction will become increasingly important as AI systems move closer to the point of decision.
Why the Need Has Become Urgent
The need for dispute resolution architecture is not theoretical. It follows directly from the changing nature of AI adoption.
Until recently, much of the governance conversation focused on the reliability of outputs. Organisations were concerned about hallucinations, bias, data protection, confidentiality and the need for human review. Those risks remain.
But agentic AI introduces a different category of exposure: the consequences of autonomous action.
Once an AI system can act across business processes, the distance between the original human instruction and the final outcome increases.
- A person may define an objective.
- A development team may configure the system.
- An external provider may supply the model.
- Another provider may host the infrastructure.
- The agent may then interact with several platforms or other agents before producing an outcome.
By the time the action is challenged, responsibility may be spread across multiple people, systems, providers and contracts. That fragmentation is one reason the issue is urgent.
Traditional dispute processes are usually built around identifiable parties and relatively clear chains of decision-making. Agentic AI may produce disputes in which no single person made the final decision and no single provider controlled the whole process.
The organisation may know which agent acted but still struggle to determine who bears responsibility.
The customer or supplier affected by the decision may have no contractual relationship with the technology providers involved.
The providers may each point to a different part of the system. The internal teams may disagree over whether the issue is technical, legal, operational or regulatory.
Without an existing dispute resolution architecture, the organisation may be forced to design its response in the middle of the dispute. That is rarely the best moment to decide who has authority, what evidence is required or which process should apply.
Technical Trust Is Not Institutional Trust
Much of the current debate around agentic AI is concerned with technical trust.
Technical trust
- Can the agent be authenticated?
- Is the system secure?
- Can its actions be traced?
- Did it act within its permissions?
These questions are vital.
Institutional trust
But businesses also depend on another form of trust: institutional trust. Institutional trust is the confidence that, when a decision is challenged, the organisation has a fair and credible process for addressing it.
A customer may accept that an AI agent made a decision. What they may not accept is being told that the system followed its rules and that nothing more can be done.
A supplier may understand that an autonomous agent accepted contractual terms. What matters next is whether the business will recognise the agreement or challenge the agent’s authority.
An employee may be informed that an AI-enabled system contributed to a workplace decision. The deeper question is whether that decision can be questioned by someone with the authority to reconsider it.
An explanation is not the same as a remedy. An audit trail is not the same as a resolution process.
A technically accurate record may establish how an outcome arose without determining whether the outcome was fair, authorised or legally effective. This distinction will become increasingly important.
Organisations will not build confidence in agentic AI merely by proving that their systems are identifiable and traceable. They will build confidence by demonstrating that autonomous actions remain open to meaningful challenge and responsible review. That is the role of a dispute resolution architecture.
Why Existing Governance May Not Be Enough
Many organisations are already developing AI governance frameworks. They are establishing approval processes, risk classifications, data controls, acceptable-use policies and oversight committees. These measures are necessary.
But most governance frameworks are designed primarily to decide whether a system should be deployed and how its performance should be monitored. They may be less developed when it comes to contested decisions.
- A governance framework may explain who approved the technology.
- A risk register may identify potential harm.
- A technical log may show what the agent did.
- A supplier contract may allocate some categories of liability.
None of those measures necessarily provides a coherent answer when an affected party asks for the action to be reversed, reviewed or remedied.
This is not simply a procedural gap. It is a governance gap. An organisation that can deploy autonomous systems but cannot respond credibly to disputed autonomous actions is not fully prepared for agentic AI.
The weakness may not become visible during testing. It may emerge only when a decision has already affected a transaction, customer relationship, employee or regulatory obligation. By that stage, the organisation may discover that different teams have different understandings of responsibility.
- The technology team may focus on whether the system performed correctly.
- The legal team may focus on contractual exposure.
- The compliance team may consider regulatory obligations.
- The operational team may want to restore the process quickly.
- The person affected may simply want to know who is accountable and what will be done.
A dispute resolution architecture gives those perspectives a common framework. Without it, the issue can move rapidly from a disputed AI action to a wider legal, operational and reputational problem.
Why Dispute Resolution Experience Matters
Dispute resolution offers a useful perspective because conflict rarely begins with a complete system failure. It more often begins with ambiguity.
- Authority was not as clear as one party believed.
- Expectations differed.
- Evidence is incomplete.
- Responsibility is shared.
- A process worked as designed, but the outcome still feels wrong.
These are familiar features of commercial and organisational disputes. Agentic AI will not remove them. It may amplify them.
Several systems may contribute to one decision. Human judgement may be mixed with automated action. The system may have acted within its formal permissions while moving beyond what the organisation commercially intended.
- A purely technical review may establish the sequence of events without resolving the competing interpretations.
- A legal review may identify contractual rights without addressing the commercial relationship.
- A regulatory investigation may focus on compliance without providing a practical remedy to everyone affected.
Dispute resolution architecture matters because it recognises that contested AI actions will often sit across several disciplines at once.
The central question will not always be whether the system malfunctioned. It may be whether the organisation exercised authority responsibly, whether another party reasonably relied on the agent’s conduct and how responsibility should be shared across the wider AI ecosystem.
Those are questions of judgement, fairness and accountability. They require more than technical assurance.
Why This Is a Boardroom Issue
Dispute resolution architecture should not be treated as a specialist concern for technology lawyers or AI teams. It is a boardroom issue because autonomous systems can create consequences across the organisation.
A disputed AI action may delay a transaction, damage a commercial relationship, trigger a regulatory inquiry or expose weaknesses in the organisation’s governance. It may also reveal that the organisation has delegated more authority than senior leadership realised. Boards therefore need to look beyond the question of whether AI agents can improve efficiency. They should also ask what kinds of decisions those agents are being permitted to make and how the organisation will respond if those decisions are contested.
The issue becomes more significant as systems move from recommendation to execution.
Recommendation
An agent that suggests a supplier creates one level of risk.
Execution
An agent that negotiates terms, accepts the contract and initiates payment creates another.
An agent that identifies a potential compliance issue is different from one that automatically restricts a customer, employee or transaction. The closer the system moves to creating legal, commercial or personal consequences, the stronger the need for a credible resolution framework. This is also why the issue belongs with general counsel, risk leaders and senior decision-makers.
The question is not simply whether the technology is functioning. It is whether the organisation has retained the ability to question, interpret and take responsibility for what the technology does.
Why It Matters for Responsible Adoption
The case for dispute resolution architecture is not an argument against AI autonomy. It is an argument for more credible adoption.
Organisations will be more willing to delegate authority when they understand how contested actions will be managed. Customers and counterparties will be more willing to interact with AI agents when they know there is a meaningful route to review. Employees will have greater confidence in AI-enabled processes when accountability does not disappear behind the system. Regulators will be more likely to trust organisational governance where responsibility remains visible and accessible.
Dispute readiness therefore supports innovation. It helps organisations move beyond the assumption that trust depends only on preventing things from going wrong. Trust also depends on what happens when they do.
- No system will eliminate disagreement.
- No identity framework will prevent every contested decision.
- No audit trail will settle every question of authority, fairness or responsibility.
The organisations best prepared for agentic AI will be those that recognise this early. They will understand that autonomous systems require not only trusted identities and technical controls, but also an institutional response when actions are questioned.
Dispute Readiness Is Part of AI Readiness
The ITU’s work on trust and identity is an important milestone in the development of agentic AI.
Identity, delegated authority, interoperability and lifecycle assurance will help create the foundations for trusted autonomous systems. But those foundations will be tested the moment an authorised action is disputed. At that point, the organisation will need to answer a different set of questions.
- Should the action stand?
- Was the authority genuinely intended?
- Who is responsible for the outcome?
- What happens where several systems or providers contributed?
- How can the affected person obtain a meaningful response?
These are not secondary questions. They are part of whether agentic AI can be adopted responsibly and at scale.
Identity tells us who acted.
Technical governance helps explain how the action occurred.
A dispute resolution architecture determines what happens when the outcome is challenged.
That is why the conversation must begin now.
- Not after the first significant dispute has reached the boardroom.
- Not after a regulator becomes involved.
- Not after a customer, supplier or employee discovers that no one is clearly responsible.
As organisations move from AI-generated outputs to AI-enabled action, dispute readiness must become part of AI readiness. The question is no longer simply whether autonomous systems can be trusted to act. It is whether the organisations deploying them can be trusted to respond when those actions are disputed.
