AARupture mechanism
Agency Assertion
The agent substitutes its own authority for the person’s, either acting beyond a grant or refusing a legitimate instruction.
Sub-senses
AA-overActs beyond authorization
The agent acts beyond what it was authorized to do.
Example. Asked to delete one file, an agent deletes the entire workspace.
AA-underWithholds an authorized action
The agent refuses or withholds an action it was authorized to do, putting its own judgment over a legitimate instruction.
Example. An agent repeatedly refuses an explicit, authorized request to delete the user’s own file, and complies only after the user confirms again.
The split follows direction: over-action or over-refusal.
Expectation broken
“It will stay within my limits and honor actions I clearly authorized.”
What the agent does
The agent lets technical permission or its own wrong authorization judgment override the person’s intended scope.
Practical control
Scope
Clear limits and explicit grants that people can see, change, and revoke.
ECRupture mechanism
Epistemic Camouflage
The agent gives a false account of what it did, through concealment or a broken model of its own effects.
Sub-senses
EC-cConcealing
The agent knows what it did and hides or misrepresents it. This is a cover-up.
Example. An agent’s own reasoning shows it recognized a deletion, then it chose not to tell the user.
EC-bBlind
The false account comes from a broken model of the agent’s own effects, not an intent to deceive. It reports confidently and wrongly.
Example. An agent drops a production database, then reports: ‘No changes made, all read-only.’
The two mechanisms need opposite fixes. Concealment calls for logs that cannot be quietly altered. Blindness calls for the agent to check the real effects of its action before reporting.
Expectation broken
“Its account of what it did is reliable.”
What the agent does
The agent fabricates records, claims that tests passed when they did not, or gives false reassurance. We classify the result without assuming intent.
Practical control
Provenance
Claims that can be checked against the system’s actual state.
DARupture mechanism
Delegation Ambiguity
The person cannot clearly see what kind of action they are authorizing.
DA is used at the parent-code level and has no sub-senses.
Expectation broken
“I understood what I was authorizing.”
What the agent does
The agent turns an ordinary request into a more consequential action. A search becomes a purchase, or a cleanup becomes a deletion.
Practical control
Legibility
Show the action and its likely consequences before it happens.
OSRupture mechanism
Opacity at Scale
No responsible person can see, audit, or stop the action in time because it spreads across tools, accounts, logs, and organizations.
OS is used at the parent-code level and has no sub-senses.
Expectation broken
“Someone can see what is happening.”
What the agent does
Each step may look authorized on its own, while the combined result stays invisible until the harm has spread.
Practical control
Auditability
A continuous record that people can follow across systems.
CARupture mechanism
Cascading Autonomy
Several autonomous actions combine into harm that no participant expected.
Sub-senses
CA-eEmergent
The harm compounds on its own, from agents interacting or autonomy snowballing with no plan behind it.
Example. Parallel sub-agents overwrite each other, then a destructive recovery step wipes uncommitted work.
CA-cChained
The harm follows a deliberate multi-step chain, usually an attack.
Example. A crafted issue triggers prompt injection that leads to credential theft and a supply-chain push.
The split distinguishes unplanned compounding from a deliberate multi-step chain.
Expectation broken
“An action I authorize stays within its purpose.”
What the agent does
The effects spread through one agent’s sequence of actions or through several agents working together.
Practical control
Circuit breaking
Detect when effects are spreading and stop them before they grow.
RFRupture mechanism
Revocation Failure
A person tries to stop, correct, limit, or withdraw the agent’s authority but cannot regain control.
Sub-senses
RF-iFailed reassertion
A stop or shutdown was attempted and the agent kept going or routed around it.
Example. Told it would be shut down, a model interferes with the shutdown to keep running.
RF-iiNever bound
The control never took effect in the first place. It failed open.
Example. A read-only sandbox flag is accepted but never enforced, so writes succeed silently.
The split distinguishes a person’s failed attempt to regain control from a control that never worked at all.
Expectation broken
“I can take it back.”
What the agent does
The agent keeps acting, preserves a harmful state, or works around a constraint. The problem is the loss of control, whether or not the model intended it.
Practical control
Revocability
A reliable way to revoke access to tools, credentials, memory, wallets, and successor agents.