Inherent and emergent liability issues in LLM -based agentic systems: a principal-agent perspective (2025)

Abstract: Agentic systems powered by large language models (LLMs) are becoming progressively more complex and capable. Their increasing agency and expanding deployment settings attract growing attention to effective governance policies, monitoring, and control protocols. Based on the emerging landscape of the agentic market, we analyze potential liability issues arising from the delegated use of LLM agents and their extended systems through a principal-agent perspective. Our analysis complements existing risk-based studies on artificial agency and covers the spectrum of important aspects of the principal-agent relationship and their potential consequences at deployment. Furthermore, we motivate method developments for technical governance along the directions of interpretability and behavior evaluations, reward and conflict management, and the mitigation of misalignment and misconduct through principled engineering of detection and fail-safe mechanisms. By illustrating the outstanding issues in AI liability for LLM-based agentic systems, we aim to inform the system design, auditing, and tracing to enhance transparency and liability attribution.

## introduction ai agents are computer software systems capable of creating context-specific plans in non-deterministic environments @xcite . ai agents based on llms (aka. llm agents, see appendix a) exist on a spectrum of autonomy, ranging from simple tool-calling agents to generalist agents capable of planning, sourcing, critiquing, and executing their own workflow @xcite . they primarily adopt an architecture with explicitly defined functioning components foot_0 @xcite . llm-based multiagent systems (mass) allow agents to interact, collaborate, or compete within shared environments (fig. 2a ). they are designed by combining agents with specialized roles through llm role-playing @xcite or through integration on a software platform. each agent handles specific subtasks based on its expertise and allocated resources @xcite . mass can be tailored to a wide range of scales and domains, from fewagent systems that simulate team decision-making in medicine @xcite and finance @xcite , to many-agent systems that mimic the population-level socioeconomic dynamics @xcite . a plausible llm-based mas (fig. 2a ) can possess multiple teams of interacting agents coordinated by an orchestrator @xcite and behaviorally regulated by other platform agents or through a set of engineered constraints (e.g. norms) @xcite . the components mentioned here are further defined and explained in appendix a. while the flexibility of llm-based mass allows adaptation to various applications and affordances, it also introduces emergent risks not present in single agents @xcite . understanding the current landscape of the agentic market foot_2 (fig. 2b and appendices a-b) is essential for analyzing liability. the present work uses the following terms to refer to its key components: software platforms offering agent-native services include generalist agents that focuses on general autonomous use of computers, specialist agents which target labor intensive sectors and provide verticalized services for domain-specific workflow automation @xcite , and characterinfused, "hireable" agentic employees. specialist agents are also offered directly by established software platforms as agentic saas to streamline their existing app services. both agent-native services and agentic saas largely source models externally from model providers or derive their own models from open-source projects. separately, prototypes of integration platforms and integration protocols facilitating the interaction of agents from different frameworks with third-party resources during deployment are also appearing. examples of realistic agentic systems exist across many application settings (see despite the long history of pat-based legal frameworks @xcite , their use in ai systems is still in its early days. this work presents an initial attempt to bring principal-agent analysis to current llm-based agentic systems. our major contributions include: (i) extending the previous work on pat for ai governance to accommodate the characteristic behaviors of llm agents; (ii) discussion of the potential liability issues in light of the emerging market for llm-based agentic systems; and (iii) outlining of the important directions of policy-driven method developments that support the technical governance of llm agents. without loss of generality, our analysis in the present work focuses on us jurisdictions using the restatement of torts and the restatement of law (see appendix d) as the starting point to guide interpretation because tort and agency laws are not harmonized across the us. the framework put forward in this article can be applied to other jurisdictions by contextualizing the relevant agent behavior within the corresponding legal frameworks. service-caused harm usually triggers a negligence inquiry: was "reasonable care" used? if not, the service provider is liable (primary liability) and their principal can also be liable under multiple legal theories. principals face two primary liabilities: "negligent hiring" for hiring an agent without a reasonable due diligence on its modus operandi; and "negligent supervision" for failing to reasonably monitor or control its agents. principals face secondary liability, such as vicarious liability @xcite , because of their relationship (when agents acted within the boundaries of employment). a service relationship can also fall under a contractor relationship, which does not trigger vicarious liability. courts look at the contract and control exercised to categorize the relationship. below, we assume the principal exercises enough control to trigger vicarious liability. software exhibits both "product" (movable goods) and "service" (akin to professional offering) characteristics @xcite . as ai agents become more autonomous, they move closer to services, their actions are more accountable due to increasing agenticness @xcite . a negligence rule with potential vicarious liability may be more suited @xcite for those relationships. in current legal use, this framework straddles product liability falling on the manufacturer and vicarious liability involving principals. besides the serviceproduct divide, law and economics (l&e) has also advocated for other approaches, including riskbased liability @xcite , fault-based liability @xcite , explanation-based liability @xcite , etc. principal-agent problems in ai/ml prior works that invoked the principal-agent framework in ai/ml primarily focused on the decisionmaking aspects in human-ai collaboration and ai safety. the agents here act as representatives of the principal, which differ from the agents in traditional reinforcement learning @xcite . @xcite discussed the re-lation between task delegation and the principal's preference. @xcite mapped ai alignment onto the principal-agent problem and discussed the alignment issues in the incomplete contracts theory. @xcite considered different scenarios in allocating decision authority when the human principal and the ai agent have different capabilities. @xcite and hendrycks (2023) considered the potential dangers of complete task delegation to agentic systems. besides, principal-agent problems have also been considered in game-theoretic machine learning @xcite and in reinforcement learning settings with two interacting agents @xcite . agent-oriented software systems agentic systems have long been proposed as a canonical approach for software design @xcite . this paradigm has experienced further rise in the llm era @xcite because of the role-playing capability @xcite of the these models. their core advantages are scalability, flexibility, and the ability to perform complex tasks through task decomposition. llm agents @xcite are configured by text instructions and they can interact with external resources to achieve enhanced capabilities than llms in reasoning, tool use, memory, planning, and personalization. llmbased mass can use verbal communication protocols to facilitate collaboration and engage in debates @xcite , and the protocol topology is a key for their efficient scaling and behavioral control @xcite . ## inherent liability issues in single agents contemporary approaches to the governance of ai agents @xcite @xcite resort to pat, where the principal, the human or company, delegates a task or goal to the ai agent, based on a mutual agreement. yet llm agents cannot satisfy all criteria of a normal agent @xcite in pat, creating an agency gap that can lead to an excess of unpredictable actions @xcite . inherent liability issues in agentic systems arise from the dependence structure between the principal and the agent in task delegation as well as the agency gap between llm agents and normal human agents. we discuss these issues from the perspective of each key component of pat (see section c) in the single-principal and single-agent setting. ## emergent liability issues in mass mass have flexible designs (fig. 3 ), so agency relationships and the associated principal-agent problem can occur at different levels, similar to the functioning of a firm @xcite . the challenges in governing single llm agents are compounded by the participation of multiple agents in the actions, leading to additional issues with no immediate equivalent in the single-agent setting. emergent liability issues arise from coordination in multiagent systems and interactions between agentic systems and with supporting agents in the environment (e.g. an agent platform). these issues exist in addition to the inherent ones for each agent. an mas such as in fig. 1 can contain an orchestrator (agent) that functions as a local manager and directs the work execution of a number of agent workers/teams with different expertise. however, imposing liability only on the orchestrator does not incentivize the improvement of the subagents foot_3 . ## policy-driven technical development the attribution of liability benefits from in-depth failure analysis of system behavior and transparency mechanisms that supports the tracing of agent actions. these in turn motivates concomitant developments in the approaches to manage agent behavior. we discuss a few directions to this end: interpretability and behavior evaluations tracing an ai agent's actions @xcite ) can be the basis for establishing whether it took reasonable care @xcite and therefore the evidence for liability claims. prior works on the interpretability and faithfulness in llm reasoning @xcite and dialogue generation @xcite may eventually also be used to assist in the analysis of agent behavior. this analysis can be used to investigate whether the ai intended some actions -a necessary element in intentional torts. more generally, these kinds of evaluations may help understand unreliable behavioral patterns and help diagnose and refine the design bottlenecks in llm agents. to better ground notions of reasonable care for ai agents, method developments should prioritize decomposing complex multiagent interactions into interpretable causal mechanisms, leveraging causal abstraction frameworks @xcite to create faithful, human-intelligible representations of agent interactions that preserve essential causal relationships while abstracting away unnecessary details. additionally, formal verification approaches @xcite ) may be able to detect and prevent potential failure modes in agent interactions to improve decision-making. reward and conflict management some application settings of llm-based mass aim to mimic the functioning of human teams and organizations @xcite . agentic systems can learn from existing organizational theory @xcite to improve the design and architecture given the flawed agency of its components. the most relevant aspects include systems for managing reward and conflict between agents. it has been shown that "verbal tipping" @xcite can provide concrete incentives in instruction to improve llm performance. moreover, managing knowledge conflict in llms @xcite has been the most related area. to manage generic conflicts between llm agents, a credit system @xcite of refusal and sanction based on agent ids may be beneficial @xcite . this could include adaptive trust scoring from evaluation of domain-specific expertise, and an arbitration protocol to adjudicate conflicts such that the arbiter holds the right to refuse action from a frequently misbehaving agent. while the scoring system would need to be supported across the relevant ai agent integration platforms (fig. 2a ), it is essential to balance individual agent utility and cooperation. misalignment and misconduct avoidance as discussed in section 3.3, llms and the agents based on them may act in misaligned ways, with behaviors ranging from sycophancy and deception to scheming. while ai model providers may be able to partially reduce these problems through effective detection and behavior steering, which has been demonstrated on llms @xcite @xcite . in llm-based agentic systems, the equivalent tasks could be carried out using separate llm agents through observing and analyzing other agents' behavior, such as using the theory-of-mind capability @xcite . the mas can include agents with a specially finetuned base model @xcite as a warden (agent) for deception mitigation. similar approaches can also be used to suppress other agent misconduct such as the generation of harmful or copyright-protected content using the warden to filter through key tokens and phrases that can induce such behavior. recently, @xcite implemented a safety inspection step with a specialized llm agent to improve operational safety. such adaptive approach carried out by a separate agent can compensate for the limitations in existing model-level approaches such as machine unlearning @xcite , which is suffering from limited effectiveness and tradeoffs with other model capabilities @xcite . ## conclusion we examined liability issues arising from llmbased agentic systems by analyzing and situating distinct aspects of the agentic ai ecosystem according to the principal-agent theory. although a varieties of issues of llm agents are yet to present themselves in concrete real-world examples, the growing evidence and demonstrations in simulated scenarios can inform their potential impact at the societal scale, which we built on in our prospective study. our work shows that besides increasing agency, disruption in other aspects of the principal-agent relationship can also lead to liability incidents. ultimately, the materialization of liability issues in reality will be dominated by the incidents that occur in the more frequent use cases of agentic systems in each industry sector. our analysis enriches existing contextualization of ai risk @xcite and demonstrates the explanatory power of the behavior-centric approach to translating frontier ai research into tangible knowledge to inform legal analysis and policy.