The Spine · Failure attribution

When the agent breaks, which layer dropped the ball?

“The AI broke” is not an attribution — it is the absence of one. This is the operator’s dictionary for AI agent incidents: ten failure kinds, each owned by exactly one architecture layer, crosswalked to the two major academic taxonomies, with a postmortem template built around the walk.

The dictionary

Ten failures. Nine layers. One owner each.

The rule that makes it work: every failure gets exactly one primary owner. A postmortem that ends with two owners has not finished attributing.

The failureOwned by“It looked like…”
Bad tool data
PDSProgressive Discovery Spine
Wrong supplier ID, stale internal cache, missing record, malformed tool call
Bad world data
ESFExternal Signal Fabric
Expired signal, mis-tagged advisory, broken feed adapter
Bad reasoning
ACSAdversarial Coordination Spine (planner)
Plan unsupported by the available signals
Bad evaluation
ACSAdversarial Coordination Spine (evaluator)
Rubber-stamped contract violation — “verified” work that wasn't
Bad scoring
CRIComposite Risk Index
One mystery number, no confidence band, no method declared
Bad governance
AGSAgent Governance Spine
An action executed that policy should have denied — or a deny nobody can explain
Bad continuity
DCSDurable Context Spine
Lost state, repeated work, a false “task complete” that survived into the next session
Bad grounding
GDSGrounded Data Spine
Two agents give two answers to one metric; an agent saw data its user may not see
Bad or missing registry
ARSAgent Registry Spine
A shadow agent nobody registered; a tool nobody knew was reachable
Bad or unbounded execution
SRSSovereign Runtime Spine
Runaway loop, unattributed action, an agent outliving its task
The attribution walk

Nine questions, asked in order.

The first “yes” that survives scrutiny is your primary owner. Keep walking only to log the remediation-sharing secondaries.

  1. 1Did an action execute that policy should have denied — or did a deny fire that nobody can explain?AGS
  2. 2Was the decision made on an expired, mis-tagged, or un-provenance'd external signal?ESF
  3. 3Was the tool call malformed, the tool data wrong or stale, or the tool surface itself the problem — wrong tool, no tool, ambiguous output contract?PDS
  4. 4Did the answer contradict canonical definitions, or did the agent see data its user is not entitled to see?GDS
  5. 5Was the agent, tool, or model involved unregistered, unknown, or reconciled nowhere?ARS
  6. 6Did planning, inter-agent coordination, or evaluation fail — plan unsupported by signals, contract violated, checker rubber-stamped it?ACS
  7. 7Did state that should have survived a session or context boundary fail to survive — or did a false “done” persist?DCS
  8. 8Did the runtime misbehave — runaway loop, unattributed execution, an agent outliving its bounds?SRS
  9. 9Was a score wrong, unexplained, or delivered without confidence bands or a declared method?CRI
Crosswalk 1

MAST’s 14 failure modes → the owning layer

MAST (Cemri et al.) classified 1,600+ annotated traces into 14 failure modes. It tells you what went wrong in the trace — the crosswalk adds who owns the fix. Frequencies are MAST’s reported share of its corpus.

MAST modeFreq.PrimarySecondary
FM-1.1Disobey task specification11.8%ACSAGS
FM-1.2Disobey role specification1.5%ACS
FM-1.3Step repetition15.7%ACSDCS
FM-1.4Loss of conversation history2.8%DCS
FM-1.5Unaware of termination conditions12.4%ACSDCS
FM-2.1Conversation reset2.2%DCS
FM-2.2Fail to ask for clarification6.8%ACS
FM-2.3Task derailment7.4%ACS
FM-2.4Information withholding0.85%ACS
FM-2.5Ignored other agent's input1.9%ACS
FM-2.6Reasoning–action mismatch13.2%ACSAGS
FM-3.1Premature termination6.2%ACSDCS
FM-3.2No or incomplete verification8.2%ACS
FM-3.3Incorrect verification9.1%ACS

What the crosswalk shows:MAST’s corpus lands almost entirely on two of the nine layers — coordination (ACS) and continuity (DCS). That is not a weakness of MAST; coordination is exactly what multi-agent research systems exercise. It is a measurement of how much of a production estate the research benchmarks never touch.

Crosswalk 2

AgentRx’s 9 categories → the owning layer

Microsoft Research’s AgentRx derived nine mutually exclusive failure categories from 115 manually annotated failed trajectories (τ-bench, Flash, Magentic-One). Definitions below are theirs, verbatim.

AgentRx categoryTheir definitionPrimarySecondary
Plan Adherence FailureIgnored required steps / did extra unplanned actionsACSAGS
Invention of New InformationAltered facts not grounded in trace/tool outputGDSESF
Invalid InvocationTool call malformed / missing args / schema-invalidPDS
Misinterpretation of Tool OutputRead tool output incorrectly; acted on wrong assumptionsPDSACS
Intent–Plan MisalignmentMisread user goal/constraints and planned wronglyACS
Under-specified User IntentCould not proceed because required info wasn't availableACS
Intent Not SupportedNo available tool can do what's being askedPDSARS
Guardrails TriggeredExecution blocked by safety/access restrictionsAGS
System FailureConnectivity / tool endpoint failuresSRSESF
What the benchmarks can’t see

Three layers get zero academic coverage. They’re the expensive ones.

Stack both crosswalks and count: the corpora concentrate on ACS, DCS, and PDS. CRI, ARS, and ESF receive no coverage at all— research benchmarks don’t ship mystery risk scores to executives, have no shadow agents to lose track of, and make no decisions on expired port-congestion signals. Production estates do all three. Those are the failure surfaces where “the AI broke” does the most financial damage, because nobody is instrumented to name them.

CRI — bad scoringARS — missing registryESF — bad world data
FAQ

Quick answers

What is AI agent failure attribution?

The discipline of assigning every AI-agent failure to the architecture layer that owns it — tool discovery, coordination, external signals, scoring, governance, continuity, grounding, registry, or runtime — instead of ending the postmortem at “the AI broke.” One failure, one owning layer, one structural fix.

How do I write a postmortem for an AI agent incident?

Describe the observable symptom, classify it against the ten-way dictionary, then run the nine-question attribution walk in order until exactly one layer owns the failure. Record whether the layer was absent, bypassed, or misconfigured, name the violated SLA, and finish with a prevention test that fails loudly if the incident recurs.

How does this relate to MAST and AgentRx?

MAST (14 failure modes from 1,600+ annotated traces) and Microsoft Research's AgentRx (9 failure categories over a 115-trajectory benchmark) classify what went wrong in a trace. This dictionary adds who owns the fix: both taxonomies are crosswalked onto the nine Spine layers, so a research classification becomes an operational owner.

Put it in the runbook

Next incident, run the walk.

The template assumes nothing about your stack, and the dictionary is CC BY 4.0 — cite it, fork it, track attribution by quarter, and let the ledger tell you which layer of the Spine your estate actually needs next.