The authorization and security issues faced by travel AI agents are referred to as principal-agent risk, and the attribution of liability for mistaken bookings, data breaches, or refund disputes lacks mature precedent at both the legal and product levels.