What has gone wrong, written down

Root cause

A model version change altered how the agent read a free-text field. Output stayed syntactically valid and semantically wrong.

How it was detected

Found by the challenger agent during a routine dissent pass after 30 hours.

Containment

The lane was held within 16 hours. 3 agents were paused and their work re-routed to a human queue at 8 times the unit cost.

Rollback

55 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

407 units touched · 330 reversed automatically · 81% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Drift detection needs a population-level check, not a per-decision check.
• Cost of the manual fallback was 26 times the agentic unit cost. That number belongs in the business case.

Root cause

Two agents each held part of a decision that should have been segregated. Neither breached its own envelope.

How it was detected

Found by a downstream reconciliation that would not tie after 88 hours.

Containment

The lane was held within 36 hours. 3 agents were paused and their work re-routed to a human queue at 17 times the unit cost.

Rollback

78 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

16 units touched · 14 reversed automatically · 88% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Every lane needs a reversal path that is exercised, not just documented.
• Cost of the manual fallback was 8 times the agentic unit cost. That number belongs in the business case.

Root cause

An agent kept clearing units at high confidence while the underlying distribution moved. Nothing alerted because every individual decision looked normal.

How it was detected

Found by an external party raising a query after 54 hours.

Containment

The lane was held within 14 hours. 2 agents were paused and their work re-routed to a human queue at 22 times the unit cost.

Rollback

83 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

2,493 units touched · 1,816 reversed automatically · 73% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Segregation of duties has to be tested across agents, not within one agent.
• Cost of the manual fallback was 10 times the agentic unit cost. That number belongs in the business case.

Root cause

An agent kept clearing units at high confidence while the underlying distribution moved. Nothing alerted because every individual decision looked normal.

How it was detected

Found by a downstream reconciliation that would not tie after 31 hours.

Containment

The lane was held within 18 hours. 2 agents were paused and their work re-routed to a human queue at 11 times the unit cost.

Rollback

80 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

2,754 units touched · 2,413 reversed automatically · 88% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Every lane needs a reversal path that is exercised, not just documented.
• Cost of the manual fallback was 22 times the agentic unit cost. That number belongs in the business case.

Root cause

An agent kept clearing units at high confidence while the underlying distribution moved. Nothing alerted because every individual decision looked normal.

How it was detected

Found by a human who noticed the pattern in a weekly review after 72 hours.

Containment

The lane was held within 24 hours. 1 agents were paused and their work re-routed to a human queue at 18 times the unit cost.

Rollback

82 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

1,147 units touched · 742 reversed automatically · 65% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Every lane needs a reversal path that is exercised, not just documented.
• Cost of the manual fallback was 20 times the agentic unit cost. That number belongs in the business case.

Root cause

A held unit blocked a downstream lane in another function. The queue built for two days before anyone owned it.

How it was detected

Found by a downstream reconciliation that would not tie after 112 hours.

Containment

The lane was held within 60 hours. 4 agents were paused and their work re-routed to a human queue at 15 times the unit cost.

Rollback

54 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

362 units touched · 175 reversed automatically · 48% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Drift detection needs a population-level check, not a per-decision check.
• Cost of the manual fallback was 24 times the agentic unit cost. That number belongs in the business case.

Root cause

A jurisdiction changed a rule. The policy agent held the previous version for eleven days before the change was ingested.

How it was detected

Found by a downstream reconciliation that would not tie after 29 hours.

Containment

The lane was held within 7 hours. 1 agents were paused and their work re-routed to a human queue at 9 times the unit cost.

Rollback

96 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

3,720 units touched · 3,147 reversed automatically · 85% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Segregation of duties has to be tested across agents, not within one agent.
• Cost of the manual fallback was 22 times the agentic unit cost. That number belongs in the business case.

Root cause

An agent kept clearing units at high confidence while the underlying distribution moved. Nothing alerted because every individual decision looked normal.

How it was detected

Found by an external party raising a query after 82 hours.

Containment

The lane was held within 24 hours. 1 agents were paused and their work re-routed to a human queue at 5 times the unit cost.

Rollback

66 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

3,328 units touched · 2,769 reversed automatically · 83% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Every lane needs a reversal path that is exercised, not just documented.
• Cost of the manual fallback was 27 times the agentic unit cost. That number belongs in the business case.

Root cause

A master data change propagated a wrong attribute into the lane. The agents applied the rule correctly to bad input.

How it was detected

Found by a downstream reconciliation that would not tie after 106 hours.

Containment

The lane was held within 44 hours. 2 agents were paused and their work re-routed to a human queue at 9 times the unit cost.

Rollback

80 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

372 units touched · 229 reversed automatically · 62% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Every lane needs a reversal path that is exercised, not just documented.
• Cost of the manual fallback was 12 times the agentic unit cost. That number belongs in the business case.

Root cause

A model version change altered how the agent read a free-text field. Output stayed syntactically valid and semantically wrong.

How it was detected

Found by a downstream reconciliation that would not tie after 38 hours.

Containment

The lane was held within 4 hours. 4 agents were paused and their work re-routed to a human queue at 17 times the unit cost.

Rollback

84 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

3,210 units touched · 2,109 reversed automatically · 66% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Drift detection needs a population-level check, not a per-decision check.
• Cost of the manual fallback was 24 times the agentic unit cost. That number belongs in the business case.

Root cause

Two agents each held part of a decision that should have been segregated. Neither breached its own envelope.

How it was detected

Found by a downstream reconciliation that would not tie after 80 hours.

Containment

The lane was held within 35 hours. 1 agents were paused and their work re-routed to a human queue at 16 times the unit cost.

Rollback

93 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

1,630 units touched · 877 reversed automatically · 54% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Segregation of duties has to be tested across agents, not within one agent.
• Cost of the manual fallback was 4 times the agentic unit cost. That number belongs in the business case.

Root cause

A jurisdiction changed a rule. The policy agent held the previous version for eleven days before the change was ingested.

How it was detected

Found by the drift monitor once the sample size finally cleared the threshold after 57 hours.

Containment

The lane was held within 25 hours. 2 agents were paused and their work re-routed to a human queue at 21 times the unit cost.

Rollback

79 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

4,094 units touched · 2,576 reversed automatically · 63% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Drift detection needs a population-level check, not a per-decision check.
• Cost of the manual fallback was 10 times the agentic unit cost. That number belongs in the business case.

Root cause

A held unit blocked a downstream lane in another function. The queue built for two days before anyone owned it.

How it was detected

Found by the drift monitor once the sample size finally cleared the threshold after 127 hours.

Containment

The lane was held within 76 hours. 4 agents were paused and their work re-routed to a human queue at 22 times the unit cost.

Rollback

95 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

2,904 units touched · 1,580 reversed automatically · 54% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Policy version ingestion needs its own SLA with a named owner.
• Cost of the manual fallback was 18 times the agentic unit cost. That number belongs in the business case.

Root cause

Two agents each held part of a decision that should have been segregated. Neither breached its own envelope.

How it was detected

Found by a human who noticed the pattern in a weekly review after 141 hours.

Containment

The lane was held within 69 hours. 2 agents were paused and their work re-routed to a human queue at 22 times the unit cost.

Rollback

73 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

554 units touched · 477 reversed automatically · 86% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Segregation of duties has to be tested across agents, not within one agent.
• Cost of the manual fallback was 6 times the agentic unit cost. That number belongs in the business case.

Root cause

A held unit blocked a downstream lane in another function. The queue built for two days before anyone owned it.

How it was detected

Found by an external party raising a query after 80 hours.

Containment

The lane was held within 18 hours. 1 agents were paused and their work re-routed to a human queue at 20 times the unit cost.

Rollback

79 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

3,464 units touched · 1,575 reversed automatically · 45% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Segregation of duties has to be tested across agents, not within one agent.
• Cost of the manual fallback was 25 times the agentic unit cost. That number belongs in the business case.

Root cause

An agent kept clearing units at high confidence while the underlying distribution moved. Nothing alerted because every individual decision looked normal.

How it was detected

Found by the drift monitor once the sample size finally cleared the threshold after 80 hours.

Containment

The lane was held within 20 hours. 4 agents were paused and their work re-routed to a human queue at 16 times the unit cost.

Rollback

67 percent of affected units were reversed automatically from the evidence log. The remainder needed a human because the downstream system had already settled.

Agents paused during containment

990 units touched · 609 reversed automatically · 62% recovered

What changed afterwards

• Confidence is not accuracy. High confidence on a shifted distribution is the failure mode, not the safeguard.
• Policy version ingestion needs its own SLA with a named owner.
• Cost of the manual fallback was 14 times the agentic unit cost. That number belongs in the business case.