In regulated finance, the most important question a record can answer is deceptively simple: whose instruction was it? When a human pays, the answer is usually obvious. When software pays, it is not — unless the system was built to make it so. Attribution, knowing which human or company stands behind every machine instruction, is what separates autonomy that can be supervised from autonomy that cannot. The alternative, attribution-free autonomy, has no place where money is regulated.

Attribution beats attribution-free autonomy

The appeal of an agent is that it acts without asking. The risk is the same. If an operation cannot be traced to a responsible party, then when something goes wrong there is no one to hold to account, and nothing to review. Attribution resolves this without removing autonomy: the agent still acts, but every instruction carries a principal behind it. Autonomy is preserved; accountability is added.

The record that answers the question

Answering "whose instruction?" needs three facts held together:

  • the principal — the person or company legally behind the operation;
  • the agent — the registered identity that acted;
  • the policy version — the mandate in force at the time.

With these, an operation is fully attributable. It can be reviewed against the rules that applied, not against rules invented afterwards, and any escalation to a human is visible in the record.

What regulators gain

For supervisors, attribution converts a scattered flow into something legible. Instead of chasing instructions across systems, they gain a point of observation where operations are traceable to principals and mandates. Regulated money has always required this accountability; the difference now is that the actor is software. The requirement does not change — the design has to. Attribution is not a new burden so much as an old obligation expressed in a new setting.

In short

  • Attribution answers whose instruction every operation was.
  • Autonomy survives accountability when the principal is always identified.
  • A record needs principal, agent and policy version together.
  • Regulators gain one point of observation, not a maze.

This is general information, not legal or compliance advice.

See the accountability model on institutions.