When the agent breaks, which layer dropped the ball?
“The AI broke” is not an attribution — it is the absence of one. This is the operator’s dictionary for AI agent incidents: ten failure kinds, each owned by exactly one architecture layer, crosswalked to the two major academic taxonomies, with a postmortem template built around the walk.
Ten failures. Nine layers. One owner each.
The rule that makes it work: every failure gets exactly one primary owner. A postmortem that ends with two owners has not finished attributing.
| The failure | Owned by | “It looked like…” |
|---|---|---|
| Bad tool data | PDSProgressive Discovery Spine | Wrong supplier ID, stale internal cache, missing record, malformed tool call |
| Bad world data | ESFExternal Signal Fabric | Expired signal, mis-tagged advisory, broken feed adapter |
| Bad reasoning | ACSAdversarial Coordination Spine (planner) | Plan unsupported by the available signals |
| Bad evaluation | ACSAdversarial Coordination Spine (evaluator) | Rubber-stamped contract violation — “verified” work that wasn't |
| Bad scoring | CRIComposite Risk Index | One mystery number, no confidence band, no method declared |
| Bad governance | AGSAgent Governance Spine | An action executed that policy should have denied — or a deny nobody can explain |
| Bad continuity | DCSDurable Context Spine | Lost state, repeated work, a false “task complete” that survived into the next session |
| Bad grounding | GDSGrounded Data Spine | Two agents give two answers to one metric; an agent saw data its user may not see |
| Bad or missing registry | ARSAgent Registry Spine | A shadow agent nobody registered; a tool nobody knew was reachable |
| Bad or unbounded execution | SRSSovereign Runtime Spine | Runaway loop, unattributed action, an agent outliving its task |
Nine questions, asked in order.
The first “yes” that survives scrutiny is your primary owner. Keep walking only to log the remediation-sharing secondaries.
- 1Did an action execute that policy should have denied — or did a deny fire that nobody can explain?AGS
- 2Was the decision made on an expired, mis-tagged, or un-provenance'd external signal?ESF
- 3Was the tool call malformed, the tool data wrong or stale, or the tool surface itself the problem — wrong tool, no tool, ambiguous output contract?PDS
- 4Did the answer contradict canonical definitions, or did the agent see data its user is not entitled to see?GDS
- 5Was the agent, tool, or model involved unregistered, unknown, or reconciled nowhere?ARS
- 6Did planning, inter-agent coordination, or evaluation fail — plan unsupported by signals, contract violated, checker rubber-stamped it?ACS
- 7Did state that should have survived a session or context boundary fail to survive — or did a false “done” persist?DCS
- 8Did the runtime misbehave — runaway loop, unattributed execution, an agent outliving its bounds?SRS
- 9Was a score wrong, unexplained, or delivered without confidence bands or a declared method?CRI
MAST’s 14 failure modes → the owning layer
MAST (Cemri et al.) classified 1,600+ annotated traces into 14 failure modes. It tells you what went wrong in the trace — the crosswalk adds who owns the fix. Frequencies are MAST’s reported share of its corpus.
| MAST mode | Freq. | Primary | Secondary |
|---|---|---|---|
| FM-1.1Disobey task specification | 11.8% | ACS | AGS |
| FM-1.2Disobey role specification | 1.5% | ACS | — |
| FM-1.3Step repetition | 15.7% | ACS | DCS |
| FM-1.4Loss of conversation history | 2.8% | DCS | — |
| FM-1.5Unaware of termination conditions | 12.4% | ACS | DCS |
| FM-2.1Conversation reset | 2.2% | DCS | — |
| FM-2.2Fail to ask for clarification | 6.8% | ACS | — |
| FM-2.3Task derailment | 7.4% | ACS | — |
| FM-2.4Information withholding | 0.85% | ACS | — |
| FM-2.5Ignored other agent's input | 1.9% | ACS | — |
| FM-2.6Reasoning–action mismatch | 13.2% | ACS | AGS |
| FM-3.1Premature termination | 6.2% | ACS | DCS |
| FM-3.2No or incomplete verification | 8.2% | ACS | — |
| FM-3.3Incorrect verification | 9.1% | ACS | — |
What the crosswalk shows:MAST’s corpus lands almost entirely on two of the nine layers — coordination (ACS) and continuity (DCS). That is not a weakness of MAST; coordination is exactly what multi-agent research systems exercise. It is a measurement of how much of a production estate the research benchmarks never touch.
AgentRx’s 9 categories → the owning layer
Microsoft Research’s AgentRx derived nine mutually exclusive failure categories from 115 manually annotated failed trajectories (τ-bench, Flash, Magentic-One). Definitions below are theirs, verbatim.
| AgentRx category | Their definition | Primary | Secondary |
|---|---|---|---|
| Plan Adherence Failure | “Ignored required steps / did extra unplanned actions” | ACS | AGS |
| Invention of New Information | “Altered facts not grounded in trace/tool output” | GDS | ESF |
| Invalid Invocation | “Tool call malformed / missing args / schema-invalid” | PDS | — |
| Misinterpretation of Tool Output | “Read tool output incorrectly; acted on wrong assumptions” | PDS | ACS |
| Intent–Plan Misalignment | “Misread user goal/constraints and planned wrongly” | ACS | — |
| Under-specified User Intent | “Could not proceed because required info wasn't available” | ACS | — |
| Intent Not Supported | “No available tool can do what's being asked” | PDS | ARS |
| Guardrails Triggered | “Execution blocked by safety/access restrictions” | AGS | — |
| System Failure | “Connectivity / tool endpoint failures” | SRS | ESF |
Three layers get zero academic coverage. They’re the expensive ones.
Stack both crosswalks and count: the corpora concentrate on ACS, DCS, and PDS. CRI, ARS, and ESF receive no coverage at all— research benchmarks don’t ship mystery risk scores to executives, have no shadow agents to lose track of, and make no decisions on expired port-congestion signals. Production estates do all three. Those are the failure surfaces where “the AI broke” does the most financial damage, because nobody is instrumented to name them.
Quick answers
What is AI agent failure attribution?
The discipline of assigning every AI-agent failure to the architecture layer that owns it — tool discovery, coordination, external signals, scoring, governance, continuity, grounding, registry, or runtime — instead of ending the postmortem at “the AI broke.” One failure, one owning layer, one structural fix.
How do I write a postmortem for an AI agent incident?
Describe the observable symptom, classify it against the ten-way dictionary, then run the nine-question attribution walk in order until exactly one layer owns the failure. Record whether the layer was absent, bypassed, or misconfigured, name the violated SLA, and finish with a prevention test that fails loudly if the incident recurs.
How does this relate to MAST and AgentRx?
MAST (14 failure modes from 1,600+ annotated traces) and Microsoft Research's AgentRx (9 failure categories over a 115-trajectory benchmark) classify what went wrong in a trace. This dictionary adds who owns the fix: both taxonomies are crosswalked onto the nine Spine layers, so a research classification becomes an operational owner.
Next incident, run the walk.
The template assumes nothing about your stack, and the dictionary is CC BY 4.0 — cite it, fork it, track attribution by quarter, and let the ledger tell you which layer of the Spine your estate actually needs next.