Gravitee, an AI agent management vendor, published an open framework this quarter called Agent Accountability, aimed at a question enterprises keep improvising answers to: what actually makes an AI agent accountable? The company's own framing is blunt: there's no shared answer to "is this agent accountable?" and every enterprise, auditor, and vendor currently improvises its own bar, so no two bars are comparable. The framework breaks the problem into five testable principles: Identity, Role, Authority, Oversight, and Recourse. The logic borrows directly from how organizations already manage human employees — assign a role and responsibilities, grant access, and maintain accountability, then apply that same structure to software actors holding real authority in production. Each principle gets broken into specific, assessable controls, so an organization can verify conformance for every agent it runs rather than treating governance as a one-time policy statement. What makes this notable isn't the five-word framework itself — plenty of vendors have shipped their own taxonomy this year — but the scale numbers behind the announcement. Gravitee's own research puts the count at more than 7 million AI agents already operating inside major enterprises, more than double the number six months earlier. Yet only about 11% of enterprises run agents in production today. That gap — explosive proliferation against a fraction of firms confident enough to deploy for real — is the same signal SailPoint's readiness numbers pointed to last week, but Gravitee's framing puts the blame specifically on the accountability vacuum: unlike human employees, agents typically have no verified identity, no defined authority, and no consistent record of what they did or why. The framework is being positioned as vendor-neutral and released under an open license, naming no vendor, product, or architecture, including Gravitee's own. That's a deliberate move to avoid the fate of proprietary agent-governance schemes that never get adopted outside their originating company. Gravitee is inviting practitioners, standards bodies, and enterprise security and platform teams to help define the specific controls that will carry it toward a 1.0 release. The unresolved question is the one every open-framework-from-a-vendor faces: whether "identity, role, authority, oversight, recourse" becomes a genuine interoperable checklist that auditors and competitors adopt, or stays a marketing document that happens to describe features Gravitee's own gateway already sells. The concept paper alone won't settle that — the 1.0 controls will.