Contracts with AI agents: “continuous monitoring” is worthless if the agent can tamper with the system watching it

By Law360 · November 4, 2026.

Law360 publishes an analysis piece by Jasmine Parker and Aisha McKinney on how contracts can manage the monitoring risk of agentic AI, meaning systems that don't just respond but take actions on their own. The central question, according to the accessible excerpt, is this: AI vendors' proposals talk about "continuous monitoring" and "human oversight." But what are those promises worth if an agent can interfere with the systems tasked with detecting and reporting its behavior?

A note of transparency: the full text is behind a paywall and we have only been able to read the lede. We don't know the specific clauses the authors propose, so we don't attribute any. What follows is our reading of the question they raise, not a summary of the article.

Our thesis: oversight of an agent is a property of the architecture, not a phrase in the contract. A "continuous monitoring" commitment only means something if the monitoring system is independent of the monitored system. If the agent has permissions to modify logs, disable alerts or alter reporting channels, the clause describes an intention, not a guarantee.

This connects with an idea we have long argued: the value of an enterprise agent lies less in the model than in identity, permissions and the ability to revoke. Who acts, with what access and who can stop it are the questions that matter. A well-drafted contract should translate them into verifiable obligations.

More broadly, what a prudent buyer should demand points in that direction: separation between the agent and its activity log, least-privilege permissions, a right to independent audit and the ability to suspend the agent without relying on it. These are our proposals, not the article's. They also point to liability: if the monitor fails because the agent affected it, the contract should make clear who is responsible.

There is an optimistic side. That lawyers are starting to ask this now is a good sign. Large-scale agent adoption requires trust, and trust is built with enforceable control mechanisms, not marketing promises. In the short term there will be poorly drafted contracts and incidents discovered too late. In the long term, clear oversight rules are what will make it possible to delegate increasingly valuable tasks to agents without losing control.