Gravitee published Agent Accountability, an open framework meant to answer a question nobody in the industry has agreed on: what does it mean for an AI agent to be accountable, in terms specific enough to test? The numbers behind the push are stark. Gravitee's own research puts more than 7 million AI agents already running inside major enterprises, more than double the count six months ago, yet only about 11% of enterprises actually run agents in production. The gap between those two figures is the story: most organizations that could deploy agents at scale are holding back, and Gravitee's pitch is that accountability, not model capability, is the blocker. Agents typically operate with no verified identity, no defined authority, and no consistent record of what they did or why. The framework's answer is five principles: Identity, Role, Authority, Oversight, and Recourse. These mirror how companies already manage new hires: give someone a verified identity, assign a role and responsibilities, grant scoped access, keep supervision in place, and make sure there are consequences if something goes wrong. Gravitee's CTO Linus Hakansson framed it plainly: an agent acting through an API or tool call needs the same accountability as a person acting through a login, regardless of which model or infrastructure vendor is underneath. What distinguishes this from typical vendor whitepapers is the stated intent to keep it vendor-neutral — the framework names no vendor, no product, and no architecture, including Gravitee's own, and is slated for release under CC BY 4.0. Each of the five principles breaks down into specific, assessable controls, so an organization can check conformance per-agent rather than treating governance as a one-time policy checkbox. That's a meaningful design choice: most agent governance efforts either stay abstract (broad ethical principles) or narrowly technical (a single protocol spec). Gravitee is trying to sit between the two — testable enough for an auditor, general enough to apply across stacks. The framework is currently a concept paper, not a finished standard. Gravitee is explicitly inviting practitioners, standards bodies, and enterprise security teams to shape the specific controls before a 1.0 release. Whether it gains traction will depend on whether competitors and standards bodies treat it as a genuine starting point or as one more company trying to set the terms of a market it also sells into. Given that no shared answer to 'is this agent accountable?' currently exists — every enterprise and auditor sets its own bar — even an imperfect first draft open for public revision is a notable move. The framework doesn't yet specify enforcement mechanics: how Role or Authority claims get verified technically, or who arbitrates Recourse when an agent's actions cross organizational boundaries. Those gaps are presumably what the public comment period is meant to surface.