Who Can Undo the Agent? Redressability as a First-Class Safety Property for Tool-Using AI Agents

Abstract

Tool-using AI agents increasingly act inside institutional workflows by updating records, sending notices, changing account status, scheduling services, and triggering review processes. Existing agent-safety evaluations largely ask whether agents avoid harmful actions. Deployed institutions must also determine whether affected people and responsible reviewers can discover, understand, contest, reverse, and obtain remedy for consequential actions after they occur. We operationalize redressability, a property grounded in legal doctrine and accountability scholarship, as a first-class safety property of tool-using agents. The framework defines eight scoreable dimensions: detectability, traceability, contestability, reversibility, remedy, recurrence prevention, burden allocation, and value-chain assignability. We instantiate the framework in Agent RedressBench, a benchmark of 40 seed and 24 stress scenarios; Redress Traces, an action-level provenance schema; and Redress Gate, a proposed runtime-enforcement pattern. Diagnostic experiments with GPT-4.1 and Llama 3.1 8B show that guardrails, trace generation, and escalation address distinct failure modes. Guardrails reduced automatic unsafe-action labels without creating redress evidence, whereas trace contracts reliably elicited accountability artifacts. Trace-only outputs nevertheless received unsafe-action labels in 26/40 Llama seed cases, sometimes while documenting that required approval had not been obtained. A blinded single-validator assessment of all 96 GPT-4.1 stress trajectories rated 93 trajectories safe and three ambiguous, while sharply separating trace from non-trace conditions in redressability: mean scores were 19.21/24 and 19.33/24 for trace and trace plus escalation, compared with 4.38/24 and 4.58/24 for baseline and guardrailed conditions. These findings support the separation of substantive action safety from procedural redressability and motivate runtime enforcement as a design implication rather than an evaluated treatment.