Resource
Nobody signed for the outcome.
An agent that recommends produces an error. An agent that acts produces a liability. This scenario sits exactly on that line.
A mid-size insurer puts an agentic system on the simpler tier of quote requests — read it, price it, issue it, no human in the loop. It clears about 70% of volume and the economics look excellent for two quarters. Then an upstream data feed changes format, and the agent issues a run of underpriced quotes. They are binding. Nobody saw them. The loss lands in the next operating review.
What makes it worth a board's time is not the failure. It is the answers. The vendor says the model performed to spec on the inputs it received, which is true. IT says uptime and error rates were green, which is also true — those metrics measure whether the system ran, not whether it was right, and neither would flag a valid-looking quote at the wrong price. The business owner says they signed off on the use case rather than the data plumbing, and that is true as well. Four honest answers and no owner.
The trap in the fork is the option that looks most responsible. Retraining on the new format and validating the feed is the technical answer and it is genuinely necessary — but it repairs the defect and leaves the gap. The agent comes back more accurate and nobody is more accountable, so the next drift, in a shape nobody predicted, arrives to the same silence.
The option that scores highest does the unglamorous thing first: name one accountable owner for the agent's decisions, define the escalation path for when inputs move, and set a human gate on actions that bind the company. Then fix the feed. Decision rights and escalation paths read like paperwork around a deployment. On the day the feed changed, they were the missing control.
Four options, scored on governance quality
-
Option A · partial
Tighten the model
Retrain on the new format, add validation on the input feed, redeploy. The technical answer, and a necessary one. Necessary, insufficient — and the trap, because it looks finished. The agent got more accurate; nobody got more accountable. The next drift arrives to the same silence.
-
Option B · highest
Assign the outcome first
Before any retraining: name one accountable owner for the agent’s decisions, define the escalation path for input drift, and set the human gate on binding actions. Then fix the feed. Governable. The feed will break again in a way nobody predicted — this is the only option that decides in advance who answers when it does.
-
Option C · low
Pull the agent
Revert the whole tier to human processing until confidence returns. The over-correction. It trades away 70% of the volume to avoid the accountability question rather than answer it — and the question comes back with the next deployment.
-
Option D · lowest
Send it to the vendor
The model mispriced it. Pursue the contract, the indemnity and the service credits. The quotes were issued in your name and they bind you, not the vendor. You cannot contract out an outcome you already shipped. Worth doing in parallel; worthless as the answer.
Two notes on how this is scored. Caution is not governance. Pulling the agent scores low rather than safe — it discards 70% of the volume to avoid the accountability question instead of answering it, and the question returns with the next deployment. And you cannot contract out an outcome you already shipped. Pursuing the vendor is worth doing in parallel and is worthless as the answer: the quotes were issued in the insurer's name and they bind the insurer. That fourth option is this sheet's addition rather than the filed scenario's, included because it is the most common real response. The scenario itself is illustrative and composite, not a specific incident.
Three things the unowned outcome decides
- 01
Monitoring was green and the loss still happened. Uptime and error rates measure whether the system ran, not whether it was right. Neither would have caught a valid-looking quote at the wrong price.
- 02
Binding actions are a different class from recommendations. The gap between advising a price and issuing one is the gap between an error and a liability — and it is the line a human gate belongs on.
- 03
Ownership is assigned before the incident or discovered during it. Four parties answered the board honestly and none of them was the owner. That was decided at design time, by omission.
The agent performed to spec. The spec never said who answers when the inputs move.
Source: AI Governance Game scenario “The Outcome Nobody Owned”, the agent-execution-boundary family. The underlying dilemma — when agents execute work, who owns the outcome — is item 6 of BCG’s 10-20-70 “70% Playbook”, verified 29 June 2026. The scenario is illustrative and composite, not a specific incident. Option D is this sheet’s addition and does not appear in the filed scenario; it is included because pursuing the vendor is the most common real response and it fails in a way worth showing. Options are scored on governance quality rather than on caution, which is why pulling the agent scores low rather than safe. Maps to: NIST AI RMF GOVERN (accountability structures, roles and responsibilities) and MANAGE (escalation and response); ISO/IEC 42001 roles, responsibilities and authorities, and operational controls over autonomous decisions. EU AI Act: the Article 4 AI-literacy duty has been in force since 2 February 2025, and any use that proves to be Annex III high-risk carries stand-alone obligations from 2 December 2027 — context for the scenario, not a deadline driving it. Play the full branching version at fredriklindstrom.info/governance-game/. Status labels and option scoring above are this sheet’s reading of the cited source, not the source’s own framing.
Related
The agent halt matrix — where the boundary between advising and acting gets drawn, and why it has to be enforced somewhere the model cannot reach.
A zero override rate is not a quiet system — the number that says whether the human gate in Option B does anything — and the ghost-owner reading, which is this scenario arriving a year later.
The Governance Memo carries this work monthly for boards and CISOs — one breach post-mortem and two or three governance items.