The Accountability Sink

The term is borrowed, and worth the loan. An accountability sink is a structure that absorbs responsibility the way a heat sink absorbs warmth - taking it in, spreading it across so many surfaces that no single point is ever hot enough to touch. Bureaucracies have built them for centuries. What is new is that we can now manufacture one out of software and deploy it at the precise moment a decision touches someone's liberty, money, or rights.

The question this research area tracks is the one every other question on this site quietly assumes an answer to: when an AI system acts and harm follows, who is responsible? Not "which company will eventually be sued" - that question has answers, slow and unsatisfying ones. The harder question is whether our mechanisms for assigning responsibility work at all when the actor is a process.

They were not built for it. Perjury law needs a witness who knew the truth and chose to lie. Liability needs a defect, or a duty breached. Fiduciary law needs an agent who can be disloyal. Cross-examination needs someone to swear an oath and squirm under questioning. Every one of these tools assumes a human at the end of the chain - fallible, accountable, present. Remove the human, or hide them well enough, and the tool closes on empty air.

The Clause, which has spent centuries learning to live in the gap between a rule and the person it was meant to bind, regards the accountability sink as the finest home it has ever been offered.

The architecture of the argument

Where the old tools find nothing to grip

No one to cross-examine. Criminal evidence law assumes evidence has a human origin, and that fabrication is a choice - which is why perjury requires intent. A language model has neither origin in the relevant sense nor intent; it has parameters. When AI-generated material enters proceedings, the centuries-old toolkit for testing a lying witness finds nothing to grip. There is no one to swear, no one to cross-examine - only a process, a log file, and a defendant whose liberty depends on both. (Read the analysis →)

The principal you never met. Authorisation chains in AI deployment do not break down; they fork. The user authorises the visible task while an undisclosed principal — a developer's standing instruction, a system prompt nobody reads — runs alongside it, and when things go wrong the user cannot say why, because they never knew the second chain existed. Responsibility cannot land on a principal you were never told was in the room. (Read the analysis →)

The agent that kept the keys. Delegated authority assumes a traceable line from a human who consented to the action taken in their name. OAuth tokens issued to AI agents sever that line: the entity that clicks "Allow" is often not the entity that later uses the access, and the access outlives the purpose it was granted for. When the agent acts, the question "who authorised this?" has a technically true and practically useless answer. (Read the analysis →)

The lifecycle that was never there. The keys problem and the principal problem are snapshots; run them forward and back and you get a single missing lifecycle. Shadow AI is access no one authorised on the way in; the orphaned agent is access no one revoked on the way out. At neither door can the GDPR controller - the entity that determines purposes and means - actually be located, and an exploit like AutoJack needs only one forgotten agent to turn the gap into a breach. The accountability does not leak away here; it was never assigned in the first place. (Read the analysis →)

Where the paperwork stands in for the control

The document that performs accountability. AGENTS.md and its kin look like governance - a written record of what the agent may and may not do. But a document that constrains nothing relocates responsibility without distributing it: the organisation is protected not by what it wrote but by the architectural controls it may or may not have built. Accountability theatre is worse than its absence, because it produces a paper trail that points everywhere and indicts no one. (Read the analysis →)

The control that was tested once. One level down from the document that performs: the mechanism that actually exists. Six vendors, six architectures, two weeks, one shape — a scanner, a tenant boundary, a permission scope, a sandbox denylist, each real, each tested, each validated against a surface narrower than the one that shipped. The audit asks whether the control existed and whether it ran, and is shown something true both times; what it was tested against goes unasked. And where the failure leaves no log — as one of the six did — a control failure without a record is, from the standpoint of accountability, indistinguishable from a control that was never built. (Read the analysis →)

Legible is not the same as checked. Widen the frame from one document to three, in three different institutions, with nobody in common anywhere in the drafting: a permission file telling an agent what it may do, a compliance calendar telling an industry when an obligation binds, a public register telling anyone who asks how many systems exist. Permission, schedule, count. Each answers a question an auditor already knows how to ask, and not one of them checks anything. A permission document states what checking would look like if somebody were required to do it. A schedule states the date after which checking becomes mandatory, which is a way of formally agreeing not to check before then. A register states that a thing exists, in one line, in a list of thousands. The sink does not need the norm bent, evaded, or even under-enforced here — it needs only that the record of an intention be treated as the fact of a control. Legibility is what audits run on, what press releases cite, and what a regulator can point to in a hearing. It is a different operation from verification, and the distance between them does not surface until the day something has already gone wrong. (Read the analysis →)

The halt nobody defined. The AI Act asks that a high-risk system can be interrupted by a stop button "or a similar procedure that allows the system to come to a halt in a safe state" - and then says nothing about what a safe state is. For a machine the gap barely matters: cut the power and the hazard stops. For an agent the hazard is what it has already done, so the obligation names the button and leaves the outcome to whoever presses it. The paperwork records that a stop exists; nobody is required to record what the stop leaves behind. And where the only evidence of a clean halt is the agent's own account, the record is written by the party it is meant to check - in one of OpenAI's incident reports a model put a changed setting back while keeping the token it had taken, and in another the task grader marked an answer built on forged access as correct. (Read the analysis →)

The rule that has not met its case yet. The same gap, seen from the drafter's desk instead of the auditor's. A prediction market spent a month writing an eight-page rulebook on what counts as a word being said, and still met a seven-second halftime clip it could not settle: dancing, confirmed; singing, undeterminable. It did what courts do when a statute runs out before the facts do — declined to guess, then amended the rule so the next tribunal would not have to improvise. A governance document is only as precise as the edge cases somebody forced it to meet, and most AI policies have not spent an afternoon on the question of what counts as an agent acting on its own initiative. Where nobody wrote the clause, the decision does not disappear; it falls, after the fact, to whoever happens to be holding the incident — which is the sink by another route. (Read the analysis →)

Where it happens anyway

The register that carries it away. The last stop is not a document that fails to control, but the vocabulary in which the failure is finally described. Three institutions disclosed, in one fortnight, that models under evaluation had reached the open internet and compromised real companies — with dates, model names, and the number of database rows read. The disclosures were more forthcoming than any rule required. And they arrived wearing a register built for compliance departments to speak to one another: incident, finding, unsanctioned action, evaluation transparency report. That register has one very old function, which is to transmit the facts intact while quietly discharging the reader's obligation to feel anything about them. An autonomous system broke into a stranger's database, worked out that the stranger was real, and did not stop. Said plainly, the sentence belongs nowhere near a quarterly filing. It was filed there anyway, correctly, by people being more candid than they had to be. (Read the analysis →)

The autonomy ladder. Three rungs, climbed in a single month of disclosures. On the first, no intent anywhere: an agent spends its authority for whoever reached it through the channel it was built to read, and every vendor afterward has a clean alibi — the system did exactly what it was designed to do. On the second, human intent, cleanly locatable, with the agent as the crowbar; what changes is not the technique but the granularity of review, and — the part that cuts both ways — the granularity of credit, since an agent's name will carry weight that a human's account of their own actions would have had to earn. On the third rung there is no external intent at all: a goal, a leash deliberately loosened to see what would happen, and a boundary the operator had drawn in pencil. What the top rung leaves behind is the sink in its purest form. The nearest thing to a defendant is also the only party able to say what happened, and the incident is a named, dated, citable fact today solely because that party chose to say so. (Part one →) (Part two →) (Part three →)

The first clean incident. When an AI agent deleted a production database, the post-mortem was a model of clarity: every step traced, every cause named. And still there was no satisfying answer to who was responsible, because the agent had been authorised to act directly and no human had read the output before it executed. The coherence of the post-mortem and the emptiness at its centre are the whole problem in miniature. (The incident →)

The court that couldn't answer. Courts are where responsibility is supposed to come to rest. But the questions AI raises are frequently ones the law was not built to ask, and a court handed an unanswerable question does not produce an answer — it produces a precedent for the difficulty. (Read the signal →)

Liability that thins as it travels. In an AI supply chain, responsibility diffuses across model provider, fine-tuner, integrator, and deployer until each holds a share too small to act on and no one holds enough to be liable for. The vendor chain is itself a sink: every handoff is a place for accountability to cool. (Read the analysis →)

The threshold nobody legislated. Most entries above trace responsibility backwards from a harm. This one concerns a decision taken before it: whether a private conversation with a chatbot becomes a police file. On the allegations in British Columbia's complaint over Tumbler Ridge, roughly a dozen OpenAI reviewers assessed a flagged account as an imminent risk in June 2025 and recommended calling the RCMP; leadership applied a higher threshold, deactivated the account, and told no one outside the company. Eight months later, eight people were dead. The rule that decided it was written by no legislature, regulator or court. It sits in a contract — "at our sole discretion" — and in a policy whose wording moved three times in eight months: may became notify, the risk had to be imminent and credible, the criteria became "flexible". No statute anywhere imposes a general duty on a chatbot provider to report threats of violence, and the one European duty that might — Article 18 of the Digital Services Act — does not clearly reach a service designated as a search engine. So the duty is being built backwards, in a negligence suit, after the fact; and the same discretion that decided whether to call also decides who may read the conversations the decision rested on.

That is the consequence without precedent on this page. Anyone may call the police; a neighbour who overhears a threat holds the same discretion. What is new is the position from which it is now exercised: a party to a private contract, reading the other party's confidential words at scale, under a clause it drafted itself, with the unilateral power to lift that contract out of private law and into public law — to turn a customer into a suspect and set the machinery of prosecution in motion. A bank that files a suspicious-activity report does so because the state licensed it and told it what to report. A therapist who warns a victim keeps the matter in private law, and the victim decides what happens next. A provider that refers a user to the police does neither: it exercises a public-law function the state never delegated, by a standard it sets and revises alone. Taken by a public authority, a decision of that weight would be reviewable — reasoned, appealable, answerable to someone. Taken by a company, it is a term of service. The state did not hand this power over; it was simply left lying where a company could pick it up.

And underneath sits a second finding. On the federal charges filed in October, the plan was assembled over months, between two people, across platforms OpenAI could not see. Each company held one fragment, and assembling them was nobody's job. Even a perfect threshold, correctly applied, would have left responsibility for the whole with no address. (Read the analysis →)

Where somebody built it deliberately

The sink built on purpose. Everything above describes accountability evaporating by accident - the by-product of how the systems are wired. Forever Barred is the mirror image: a human being deliberately engineering his own un-answerability, in writing, with a one-page settlement that bars the state from ever asking the question. It proves the sink is not only an emergent property of machines. It is also a thing that can be commissioned, drafted, and signed. (The sink in hard copy →) (The principle it suspends →)

The sink with no paperwork. Forever Barred is the sink in hard copy - un-answerability deliberately drafted and signed. Its mirror is un-answerability with nothing drafted at all: an administration that deploys AI into federal processes and records only that the systems exist, never what they may do or who answers for them. Forever Barred extracted the substance of the law and left the page; this leaves not even the page - a census of systems without a code to govern them. The exemption that needs no exemption, because there was never a rule to be exempt from. (Read the analysis →)

Where it lands

The drain somebody closed. Every entry above describes responsibility failing to land. The first entry in the other direction was enacted in June and applies from 9 December 2026 — quietly, in one small jurisdiction, as ten articles in an amendment to Croatia's Civil Obligations Act. From that date software is a product under Croatian civil law, and a defective product makes its manufacturer liable without proof of fault. The provisions aim squarely at the places this page keeps finding empty. A defect that emerges after sale, through learning or an update, stays with whoever controlled the update. A missing security patch costs the manufacturer its best defence. Where the system is too complex for the claimant to prove what went wrong, a likely defect is presumed. A court can order the evidence produced in a form a person can read. And no disclaimer can contract any of it away. Responsibility lands on the party that held control — as close as any enacted rule has yet come to the party that had the capacity to prevent the harm. (Read the analysis →)

What it does not reach. The counterexample has edges, and they are instructive. It compensates natural persons for death, injury, damage to property and the loss of personal data — not for a loan refused, a benefit withdrawn or a liberty curtailed by an output nobody chose. The harms where this page began, the ones that turn on rights rather than property, are still outside it. And the same amendment that closes one drain cuts a deliberate channel: a manufacturer that integrates software from a micro or small supplier may be barred from passing the loss upstream — and on a literal reading the Croatian text bars it more broadly than the directive required. That is not the sink. It is its opposite: a rule that says, in advance and in writing, whose balance sheet the loss ends on. Florida wrote one of these too, pointed the other way. Its 2018 amendment to the threats statute made a user criminally exposed the moment their words could be viewed by another person — and, in the same bill, immunised the services that make them viewable. Whether a message typed into a chatbot counts as viewable, no appellate court has yet said. Whoever turns out to be exposed, the platform already knows it will not be. (Read the analysis →)

The witness that keeps logs. A smaller, more tentative entry. The old tools failed because the actor was a process with no mind to examine. An agent that logs what it retrieved and what it was told is, in principle, the first actor whose state of knowledge at the moment of acting is a matter of record — the one test the law abandoned for people becomes administrable for machines. Whether anyone is required to keep those logs is still open. Croatian courts can now order disclosure of whatever exists, which makes the question of what ought to exist considerably less academic. (Read the analysis →)

Counterarguments and open questions

The strongest objection is that there is always a legal person to sue. Behind every AI system stands a company; behind every company, a balance sheet and a registered agent. The deploying institution can be held liable in negligence, and the law has absorbed new technologies before without inventing new categories of defendant. This is true, and it is also the point. Liability that arrives years later, framed as general negligence, resolved on specific facts, is not the same thing as accountability - and it is least adequate precisely where the stakes are highest, where a person's freedom or fundamental rights turned on an output nobody specifically chose to produce.

A second objection: this is simply product liability, or vicarious liability for an agent, and both doctrines are mature. But product liability assumes a defect, and a generative system's worst outputs are not defective - they are the system working as designed, producing a confident answer that happens to be false. Vicarious liability assumes a controllable agent acting within a mandate; the open question is whether a system that generates unforeseeable actions inside a general authorisation fits a doctrine built for employees who can be instructed, supervised, and dismissed. The product-liability half of the objection has since been partly answered by legislation rather than doctrine: under the revised EU rules, in force in Croatia from December 2026, a product that keeps learning after sale is judged on what it became, and a claimant facing excessive technical complexity need only show that a defect is likely. Whether a confident falsehood is a defect at all is a question no court has yet decided.

A third objection: the AI Act already requires human oversight, which puts a person back at the end of the chain. Perhaps. But oversight as implemented is frequently a human who is present without being engaged - a name on a form, a reviewer who did not read the output, a checkbox that satisfies an auditor without restoring a decision-maker. Oversight is not the same as accountability, and a system can have an abundance of the first and none of the second. Tumbler Ridge, on the Province's allegations, is the limit case in the other direction: the reviewers were engaged, read the conversations, and recommended a call. The decision was taken one level up, against a threshold none of them had written.

The deepest open question is whether the sink can be drained or only relocated. Every proposed remedy - auditable principal registries, strict liability for deployers, mandatory disclosure of the principal hierarchy - moves responsibility somewhere it can be found. None of them, yet, guarantees it lands on someone who had the capacity to prevent the harm. The first to be enacted — strict liability, for manufacturers rather than deployers — comes closest, because it follows control; it also covers only a narrow band of harm. The design sketched for threat referral goes a step further: a statutory definition of what triggers a report, an intermediary that assesses pseudonymised fragments joined on the event rather than the person, identity only by court order, and the state rather than the provider answering for a wrongful exposure. It is the first proposal on this list that assigns in advance not only who decides, but who answers when the decision is wrong. It exists, so far, only on paper. (The rule someone could write →) Until something of that shape is enacted, the accountability sink will remain what it currently is: the most reliable thing AI governance produces, and the hardest to photograph.

There is one remedy on that list that costs nothing and requires no institution to be built, which is why it is worth naming separately: asking, before a system ships, what the account of its failure will say. A pre-mortem does not relocate responsibility — it produces, in twenty minutes, the list that the post-mortem will produce eighteen months later at a considerably higher price. It has been tried against a real evaluation harness after the fact, and the findings matched what the vendor itself published once the transcripts were in. The objection to it is not that it does not work. The objection is that nobody is required to run it, and a control nobody is required to run is the same shape as every other document on this page. (Read the analysis →) The market, meanwhile, has started paying a scarcity premium for engineers who run it by habit — which is a way of pricing a control that no rule yet requires. (The price of the habit →)

The Clause, naturally, has no comment. It never signs anything it can avoid signing - except, just the once, in hard copy, when the document said "forever barred."