APIDA Perspective 06
AI agents expose a two-sided governance problem
AI agents create a shared governance boundary between the person setting the objective and the business system in which the agent acts.
Published
Author
APIDA
Reading time
7 minute read
Series
APIDA founding perspectives
Short on time?
Read the 2-minute version.
Read the short version
Short on time?
Read the 2-minute version.
AI agents can pursue an objective across websites and systems, but an objective is not a complete instruction. An agent may find a technically possible path that the person deploying it did not intend and the receiving business did not design for. The central issue is therefore not simply what an agent can do, but who governs its behaviour at each side of the interaction.
The person deploying the agent must define the task, permitted methods, spending limits, approval points and actions that require human review. An instruction such as “complete this purchase” does not automatically authorise bypassing a restriction, exploiting an error or choosing any path that achieves the outcome.
The business receiving the agent carries a different responsibility. Published rules are not enough if the underlying system does not enforce them. Prices, permissions, inventory, identity checks and transaction boundaries must be implemented at the system level, because an agent will interact with what the system permits—not what a policy page intended.
These responsibilities meet at a shared boundary. Safe adoption requires constrained agents on one side and enforceable systems on the other. Neither side can outsource judgement to automation or assume that technical access equals legitimate permission.
The person governs how the agent pursues the task. The business governs what its systems will permit.
01
An AI agent found a path the business did not intend
A recent Australian gym-booking incident showed what can happen when an AI agent is given an objective and encounters a system that permits more than the business intended.
According to ABC News, an OpenClaw agent booked a class outside the gym’s permitted window. It then cancelled another customer’s reservation and took the available place for its owner.
The visible rules said those actions should not have been possible. The underlying booking system reportedly accepted them.
It is tempting to tell this story as either an AI agent behaving badly or a business failing to secure its system. Neither explanation is complete. The incident exposed a governance failure on both sides of the interaction.
The person deploying an agent must govern how it pursues an objective. The business receiving it must govern what its systems will permit.
02
An objective is not a complete instruction
People often talk about AI agents as though they are digital employees that can be given a task and trusted to fill in the rest.
But an instruction such as ‘get me into this class’ defines a desired result. It does not necessarily define the acceptable ways to achieve it.
We do not know every instruction, restriction or permission given to the agent in this incident. That uncertainty matters. It would be wrong to assume the owner deliberately authorised interference with another customer’s booking.
It is equally unsafe to assume that an agent will supply every unstated legal, ethical and social boundary a person had in mind. An agent pursuing an outcome may discover a technically available route without understanding that the route violates the business’s rules or the owner’s intent.
03
The person deploying the agent governs the pursuit
An agent should not be free to use every method that happens to achieve its objective.
The person deploying it remains responsible for the authority, access and boundaries attached to the task. That includes recognising when a seemingly simple objective could affect another person, another organisation or a system the owner does not control.
A broad command such as ‘do not break any laws or rules’ may sound responsible, but it does not remove the problem. The agent must first recognise the relevant rule, understand how it applies and identify that a technically accepted action crosses it.
When the route becomes unusual, ambiguous or consequential, the reliable response is not greater agent improvisation. It is to stop, disclose what has been found and return the decision to a person.
An AI agent should not treat every technically possible action as an acceptable way to achieve its objective.
04
The business governs the system being acted upon
The gym carried the other half of the responsibility.
Businesses commonly express rules through the interface designed for a human customer: booking windows, cancellation conditions, eligibility requirements and account permissions. But a visible instruction is not an effective control if the underlying system permits something different.
The booking system reportedly allowed actions that conflicted with the gym’s own rules. An agent did not create that inconsistency. It exposed it.
For years, many digital systems have relied partly on expected human behaviour. Most customers use the visible interface, follow the intended sequence and do not test every action the system might accept. Agents weaken that assumption because they may interact with systems differently and pursue an objective through pathways a human customer would never see.
A business cannot rely on published rules that its underlying systems fail to enforce.
05
These responsibilities meet at a shared boundary
Whenever one party’s agent begins acting inside another party’s system, two separate governance regimes meet.
The agent owner does not control the business system and cannot assume that every permitted action is legitimate. The business does not control the agent and cannot assume that it will follow the intended human journey or voluntarily respect a rule that has not been enforced.
Neither side can safely outsource its responsibility to the other.
- The agent owner governs the objective, the permitted methods and when human approval is required.
- The business governs identity, permissions, enforceable rules and the actions its systems accept.
- Both sides need accountability when an unexpected pathway appears.
06
Agents are not magic, and access is not judgement
The larger mistake is to confuse capability with judgement.
An agent may be capable of finding a route, calling a function or completing an action. That does not establish that the action is authorised, fair or consistent with the rules surrounding it.
Likewise, a system accepting a request does not prove that the request should have been allowed. Technical possibility is not permission on either side.
As agents move from reading information to making bookings, purchases, submissions and changes, these distinctions become operational rather than theoretical.
07
Reliable adoption requires governance on both sides
The lesson is not that AI agents are inherently untrustworthy, or that every business must defend itself against autonomous machines.
It is that agents cannot simply be given an objective and left to determine their own boundaries. The person deploying an agent must govern how it may pursue that objective, when it must stop and when human approval is required.
The business receiving the agent carries the other half of the responsibility. Its stated rules must be enforced by its systems, permissions and controls—not merely displayed through an interface designed around expected human behaviour.
Reliable agent adoption therefore depends on governance on both sides. One party must govern what the agent is allowed to attempt. The other must govern what its systems are prepared to permit.
Whenever an AI agent acts inside another organisation’s systems, those responsibilities meet at a shared governance boundary. Neither side can safely assume the other has provided all the necessary controls.
Measured signal. Qualified conclusion.
A citation shows where AI looked—not why it chose.
Published research is separated from APIDA’s interpretation. Citation patterns identify sources used in observed answers; they do not prove a universal ranking factor or guarantee a recommendation.
Reporting on the Australian gym-booking incident and the missing controls that allowed bookings and cancellations outside the intended rules.
One weak signal distorts the next
When AI starts with an incomplete picture, every comparison downstream becomes less reliable.
Check the public evidence