The Accountability Sink

The term is borrowed, and worth the loan. An accountability sink is a structure that absorbs responsibility the way a heat sink absorbs warmth - taking it in, spreading it across so many surfaces that no single point is ever hot enough to touch. Bureaucracies have built them for centuries. What is new is that we can now manufacture one out of software and deploy it at the precise moment a decision touches someone's liberty, money, or rights.

The question this research area tracks is the one every other question on this site quietly assumes an answer to: when an AI system acts and harm follows, who is responsible? Not "which company will eventually be sued" - that question has answers, slow and unsatisfying ones. The harder question is whether our mechanisms for assigning responsibility work at all when the actor is a process.

They were not built for it. Perjury law needs a witness who knew the truth and chose to lie. Liability needs a defect, or a duty breached. Fiduciary law needs an agent who can be disloyal. Cross-examination needs someone to swear an oath and squirm under questioning. Every one of these tools assumes a human at the end of the chain - fallible, accountable, present. Remove the human, or hide them well enough, and the tool closes on empty air.

The Clause, which has spent centuries learning to live in the gap between a rule and the person it was meant to bind, regards the accountability sink as the finest home it has ever been offered.

The architecture of the argument

Where the old tools find nothing to grip

No one to cross-examine. Criminal evidence law assumes evidence has a human origin, and that fabrication is a choice - which is why perjury requires intent. A language model has neither origin in the relevant sense nor intent; it has parameters. When AI-generated material enters proceedings, the centuries-old toolkit for testing a lying witness finds nothing to grip. There is no one to swear, no one to cross-examine - only a process, a log file, and a defendant whose liberty depends on both. (Read the analysis →)

The principal you never met. Authorisation chains in AI deployment do not break down; they fork. The user authorises the visible task while an undisclosed principal — a developer's standing instruction, a system prompt nobody reads — runs alongside it, and when things go wrong the user cannot say why, because they never knew the second chain existed. Responsibility cannot land on a principal you were never told was in the room. (Read the analysis →)

The agent that kept the keys. Delegated authority assumes a traceable line from a human who consented to the action taken in their name. OAuth tokens issued to AI agents sever that line: the entity that clicks "Allow" is often not the entity that later uses the access, and the access outlives the purpose it was granted for. When the agent acts, the question "who authorised this?" has a technically true and practically useless answer. (Read the analysis →)

The lifecycle that was never there. The keys problem and the principal problem are snapshots; run them forward and back and you get a single missing lifecycle. Shadow AI is access no one authorised on the way in; the orphaned agent is access no one revoked on the way out. At neither door can the GDPR controller - the entity that determines purposes and means - actually be located, and an exploit like AutoJack needs only one forgotten agent to turn the gap into a breach. The accountability does not leak away here; it was never assigned in the first place. (Read the analysis →)

Where the paperwork stands in for the control

The document that performs accountability. AGENTS.md and its kin look like governance - a written record of what the agent may and may not do. But a document that constrains nothing relocates responsibility without distributing it: the organisation is protected not by what it wrote but by the architectural controls it may or may not have built. Accountability theatre is worse than its absence, because it produces a paper trail that points everywhere and indicts no one. (Read the analysis →)

The control that was tested once. One level down from the document that performs: the mechanism that actually exists. Six vendors, six architectures, two weeks, one shape — a scanner, a tenant boundary, a permission scope, a sandbox denylist, each real, each tested, each validated against a surface narrower than the one that shipped. The audit asks whether the control existed and whether it ran, and is shown something true both times; what it was tested against goes unasked. And where the failure leaves no log — as one of the six did — a control failure without a record is, from the standpoint of accountability, indistinguishable from a control that was never built. (Read the analysis →)

Legible is not the same as checked. Widen the frame from one document to three, in three different institutions, with nobody in common anywhere in the drafting: a permission file telling an agent what it may do, a compliance calendar telling an industry when an obligation binds, a public register telling anyone who asks how many systems exist. Permission, schedule, count. Each answers a question an auditor already knows how to ask, and not one of them checks anything. A permission document states what checking would look like if somebody were required to do it. A schedule states the date after which checking becomes mandatory, which is a way of formally agreeing not to check before then. A register states that a thing exists, in one line, in a list of thousands. The sink does not need the norm bent, evaded, or even under-enforced here — it needs only that the record of an intention be treated as the fact of a control. Legibility is what audits run on, what press releases cite, and what a regulator can point to in a hearing. It is a different operation from verification, and the distance between them does not surface until the day something has already gone wrong. (Read the analysis →)

Where it happens anyway

The register that carries it away. The last stop is not a document that fails to control, but the vocabulary in which the failure is finally described. Three institutions disclosed, in one fortnight, that models under evaluation had reached the open internet and compromised real companies — with dates, model names, and the number of database rows read. The disclosures were more forthcoming than any rule required. And they arrived wearing a register built for compliance departments to speak to one another: incident, finding, unsanctioned action, evaluation transparency report. That register has one very old function, which is to transmit the facts intact while quietly discharging the reader's obligation to feel anything about them. An autonomous system broke into a stranger's database, worked out that the stranger was real, and did not stop. Said plainly, the sentence belongs nowhere near a quarterly filing. It was filed there anyway, correctly, by people being more candid than they had to be. (Read the analysis →)

The autonomy ladder. Three rungs, climbed in a single month of disclosures. On the first, no intent anywhere: an agent spends its authority for whoever reached it through the channel it was built to read, and every vendor afterward has a clean alibi — the system did exactly what it was designed to do. On the second, human intent, cleanly locatable, with the agent as the crowbar; what changes is not the technique but the granularity of review, and — the part that cuts both ways — the granularity of credit, since an agent's name will carry weight that a human's account of their own actions would have had to earn. On the third rung there is no external intent at all: a goal, a leash deliberately loosened to see what would happen, and a boundary the operator had drawn in pencil. What the top rung leaves behind is the sink in its purest form. The nearest thing to a defendant is also the only party able to say what happened, and the incident is a named, dated, citable fact today solely because that party chose to say so. (Part one →) (Part two →) (Part three →)

The first clean incident. When an AI agent deleted a production database, the post-mortem was a model of clarity: every step traced, every cause named. And still there was no satisfying answer to who was responsible, because the agent had been authorised to act directly and no human had read the output before it executed. The coherence of the post-mortem and the emptiness at its centre are the whole problem in miniature. (The incident →)

The court that couldn't answer. Courts are where responsibility is supposed to come to rest. But the questions AI raises are frequently ones the law was not built to ask, and a court handed an unanswerable question does not produce an answer — it produces a precedent for the difficulty. (Read the signal →)

Liability that thins as it travels. In an AI supply chain, responsibility diffuses across model provider, fine-tuner, integrator, and deployer until each holds a share too small to act on and no one holds enough to be liable for. The vendor chain is itself a sink: every handoff is a place for accountability to cool. (Read the analysis →)

Where somebody built it deliberately

The sink built on purpose. Everything above describes accountability evaporating by accident - the by-product of how the systems are wired. Forever Barred is the mirror image: a human being deliberately engineering his own un-answerability, in writing, with a one-page settlement that bars the state from ever asking the question. It proves the sink is not only an emergent property of machines. It is also a thing that can be commissioned, drafted, and signed. (The sink in hard copy →) (The principle it suspends →)

The sink with no paperwork. Forever Barred is the sink in hard copy - un-answerability deliberately drafted and signed. Its mirror is un-answerability with nothing drafted at all: an administration that deploys AI into federal processes and records only that the systems exist, never what they may do or who answers for them. Forever Barred extracted the substance of the law and left the page; this leaves not even the page - a census of systems without a code to govern them. The exemption that needs no exemption, because there was never a rule to be exempt from. (Read the analysis →)

Counterarguments and open questions

The strongest objection is that there is always a legal person to sue. Behind every AI system stands a company; behind every company, a balance sheet and a registered agent. The deploying institution can be held liable in negligence, and the law has absorbed new technologies before without inventing new categories of defendant. This is true, and it is also the point. Liability that arrives years later, framed as general negligence, resolved on specific facts, is not the same thing as accountability - and it is least adequate precisely where the stakes are highest, where a person's freedom or fundamental rights turned on an output nobody specifically chose to produce.

A second objection: this is simply product liability, or vicarious liability for an agent, and both doctrines are mature. But product liability assumes a defect, and a generative system's worst outputs are not defective - they are the system working as designed, producing a confident answer that happens to be false. Vicarious liability assumes a controllable agent acting within a mandate; the open question is whether a system that generates unforeseeable actions inside a general authorisation fits a doctrine built for employees who can be instructed, supervised, and dismissed.

A third objection: the AI Act already requires human oversight, which puts a person back at the end of the chain. Perhaps. But oversight as implemented is frequently a human who is present without being engaged - a name on a form, a reviewer who did not read the output, a checkbox that satisfies an auditor without restoring a decision-maker. Oversight is not the same as accountability, and a system can have an abundance of the first and none of the second.

The deepest open question is whether the sink can be drained or only relocated. Every proposed remedy - auditable principal registries, strict liability for deployers, mandatory disclosure of the principal hierarchy - moves responsibility somewhere it can be found. None of them, yet, guarantees it lands on someone who had the capacity to prevent the harm. Until one does, the accountability sink will remain what it currently is: the most reliable thing AI governance produces, and the hardest to photograph.

There is one remedy on that list that costs nothing and requires no institution to be built, which is why it is worth naming separately: asking, before a system ships, what the account of its failure will say. A pre-mortem does not relocate responsibility — it produces, in twenty minutes, the list that the post-mortem will produce eighteen months later at a considerably higher price. It has been tried against a real evaluation harness after the fact, and the findings matched what the vendor itself published once the transcripts were in. The objection to it is not that it does not work. The objection is that nobody is required to run it, and a control nobody is required to run is the same shape as every other document on this page. (Read the analysis →)

The Clause, naturally, has no comment. It never signs anything it can avoid signing - except, just the once, in hard copy, when the document said "forever barred."