Gravitee has published Agent Accountability, an open framework aimed at a problem most enterprises deploying AI agents haven't solved: who answers for what an agent did. The framework defines five principles — Identity, Role, Authority, Oversight, and Recourse — and treats them the way an organization would treat a new hire's onboarding: assign a job description, grant scoped access, supervise the work, and keep a record that survives audit. The numbers behind the release are the interesting part. Gravitee's own research puts the count at over 7 million AI agents already running inside major enterprises, more than double the figure from six months earlier. Yet despite that growth, only about 11% of enterprises actually run agents in production. The gap between agents deployed in pilot and agents trusted in production is, per Gravitee, an accountability gap rather than a capability one: agents typically have no verified identity, no defined authority, and no consistent record of what they did or why. Each of the five principles comes with a concrete test. Identity means a unique, verifiable identity registered before an agent's first action, with an accountable human sponsor at all times. Authority means access that's enumerated, role-derived, time-bounded, and revocable in real time. Oversight means every action recorded with its full delegation chain, with deviations surfacing as they happen rather than in a postmortem. Recourse means an agent can be stopped in seconds, rolled back or contained, and reinstated only by deliberate decision. What distinguishes this from a typical vendor governance pitch is the framing: Gravitee explicitly argues that existing instruments — governance programs, technical protocols — each cover only part of the problem, and that no shared answer currently exists to the basic question 'is this agent accountable?' Every enterprise, auditor, and vendor currently improvises its own bar, and none of those bars are comparable to each other. The framework is released under a Creative Commons license as a concept paper, open for public and industry input, with Gravitee inviting practitioners and standards bodies to weigh in and future plans to map its principles onto existing and emerging protocols. That last point matters: a framework that stays a single vendor's checklist doesn't move the needle, but one that gets adopted as a common audit vocabulary across tools could. It's the same instinct behind other accountability work in the field — Identity, Role, Authority, Oversight, Recourse only becomes useful if it's the language auditors and regulators start asking for by name, not just what one company's product happens to check. Whether that adoption happens is the open question. Right now it's a concept paper, not a standard with teeth.