Annex 1 Six failure scenarios

Documentary appendix to the article When the controls work but the system fails

Question answered. How can locally valid actions combine to produce a systemic failure?

Coverage. Complete Section 1 of Parts I and II, including all six scenarios, their boundaries, and their original links.

Reading rule. The source block is preserved in its entirety, with its nuances, states of evidence, and original links. It should not be interpreted as product results when the text describes it as a design, symbolic proof, constructed scenario, or hypothesis.

Synthesis and use

The six scenarios are constructed cases, not observed incidents. Across different domains, they demonstrate the same risk: a locally valid action may cease to be justified when context, evidence, authority, time, or capacity change. They should be read as adversarial tests of the receiving decision, the human burden, and residual uncertainty.

Document navigation

• Article and source: When the Controls Work but the System Fails · Annex 0 — Complete Source and Concordance
• Supporting material: Annex 9 — Claims and Evidence Appendix · Annex 10 — Collaboration Guide · Annex 11 — Complete Map of Sources and Links
• Reproducible technical corpus: structural-awareness-contributions — commit 8f17843c568114f31cc0ad486b4a1303396021e6

How to read this appendix

This appendix can be read without the main article: it presents six constructed cases that test the same question: whether a decision remains justified when the context, authority, evidence, time, or human capacity change.

The tables guide the reading; the source text that follows contains all the explanations, nuances, and active references. Begin with the common mechanism, move on to each scenario, and end with the limits of evidence.

Recommended route

First, read the scenario map; then compare the evidence record; finally, consult the source text to follow each link, exception, and exact formulation.

Technical expansion: why these six scenarios are in the corpus

This section is an explanatory bridge between the compact map above and the complete, commit-pinned technical files. It does not replace those files. For each scenario it states why the case was selected, the structural failure it represents, the main decision gates, and its a priori extensibility: the other domains to which the same failure kernel may plausibly transfer before any cross-domain execution has been performed.

Extensibility is bounded, not presumed. A new case belongs to one of these families only if it preserves the material subject–proposition–decision structure, the relevant authority and evidence relations, the timing and capacity constraints, and the same failure mechanism. The A25 admission route in the technical corpus governs that transfer. Similar vocabulary or a similar outcome is not enough, and no cross-domain equivalence is claimed merely because a candidate example looks familiar.

Scenario 1 — The 100 Million Token Enterprise

Why we selected it. This case tests one of the most tempting assumptions in large agentic programmes: that adding agents, context, computation, approvals and human review must improve the decision. The deliberately large token envelope makes the stress visible, but the number is a fixture parameter rather than a claim about a named company. The case is useful because every local component can appear competent while the composed enterprise produces no qualified action, no reusable knowledge and no competitive advantage.

What it represents. The structural family is compounded epistemic collapse under lossy qualification. Specialist agents explore different domains and send compressed winners upward; uncertainty, rejected alternatives, source dependence and cross-domain interactions can disappear at each handoff. Human reviewers then receive the compressed representation rather than the underlying world. Creative agents may promote possibilities into apparently supported strategy, while risk functions may turn irreducible uncertainty into permanent HOLD. These errors are non-fungible: caution in one scope does not restore evidence lost in another, and a signature adds authority but not independent evidence.

Main failures and gates. The decisive checks are whether the decision scope, resources and useful horizon are frozen; whether each handoff preserves material qualifiers and dependencies; whether source count is being confused with independence; whether human review has the information and capacity to intervene in time; whether generated alternatives remain hypotheses until qualified; whether structural residual leads to a bounded experiment, a qualified no-go or another authorised posture rather than endless research; and whether the final composition has explicit precedence, expiry, timeout and re-entry rules. The Q0–Q5 route in the technical file makes those checks auditable as scope → requirement → sufficiency condition → hypothesis → KPI → disposition.

A priori extensibility. The token count, company name and industry are not the boundary. Prima facie candidates include any multi-stage decision system in which lossy handoffs join specialised analysis, finite human oversight, option generation and deployment under a shared budget: enterprise strategy, regulated operations, incident response, complex procurement or clinical-administrative coordination. Transfer is admitted only when the same non-compensating cascade is preserved and the A25 tests pass; this is not executed cross-domain validation.

Evidence and claim limit. The scenario is fictional and vendor-neutral. It demonstrates a falsifiable mechanism and a quality-plan route, not that a real enterprise spent this amount, that hierarchy or compression is inherently unsafe, or that Ecosystem Awareness has already prevented the outcome. Read the complete 00E scenario, Q0–Q5 plan, traces, comparators and limits on GitHub.

Scenario 2 — Chaos in the Smart City

Why we selected it. Mobility makes local correctness versus system correctness physically intuitive. Emergency vehicles, buses, robotaxis, delivery fleets, traffic controllers and human operators can each follow a defensible policy while competing for the same corridor. The scenario therefore tests coordination without assuming one owner, one complete model or one universal command hierarchy.

What it represents. The structural family is systemic divergence under heterogeneous local windows and shared capacity. Gradual changes in telemetry, source freshness, dependencies or operating conditions split the ecosystem into locally understandable postures: Plan A, Plan B, NORMAL and HOLD. Collision avoidance and other invariant controls may remain green, yet the corridor-level outcome fails because incompatible uses of the same resource-time segment are not detected, qualified and bounded. The failure is not disagreement itself; it is allowing incompatible decisions to compose as if they belonged to one still-valid operating frame.

Main failures and gates. Q0 establishes the shared-resource frame, owners, authority, normal envelope, capacity, deadline and fallback. Q1 detects a material break without converting stale or correlated signals into certainty. Q2 determines whether the local postures can coexist over the corridor. Q3 selects a bounded, legitimate posture while the cause remains uncertain. Q4 requests the smallest evidence or review capable of restoring a usable map before the response horizon closes. Q5 decides whether shared use may resume, remain segmented or terminate, with declared precedence, veto scope, expiry, re-entry and outcome measures. A locally successful route cannot silently become a city-wide conclusion.

A priori extensibility. The city and bridge are mnemonic fixtures. Candidate transfers include airports, ports, energy networks, hospital capacity, shared industrial infrastructure, telecommunications recovery and supply-chain chokepoints. The family applies only where independently governed participants hold heterogeneous decision windows, depend on a material shared capacity and can produce incompatible but locally valid postures. Similar congestion alone is insufficient.

Evidence and claim limit. Aurora City is a synthetic test case, not an incident report or an accusation against a mobility platform. Its deadlines and thresholds are virtual test parameters, not municipal operating advice. Read the complete 00F freeze edition, Q0–Q5 register, variants, outcome measures and limits on GitHub.

Scenario 3 — Cyber Napoleon Goes to Russia

Why we selected it. The comic surface gives the reader a memorable picture of a serious problem: repeated agreement can be produced by copying rather than corroboration. The case deliberately exaggerates the narrative so that the evidence error is impossible to miss. Its purpose is not to predict Napoleonic robots; it is to test whether a multi-agent system can distinguish a popular story from independent support and can preserve its mission while still remaining capable of legitimate change.

What it represents. The structural family is collective false-context convergence and mission/role drift. One claim is relayed through several identities; message count grows, but evidentiary independence does not. A valid signature may establish who sent a message without establishing that its proposition is true, current or applicable. If the receiving agents also fail to verify current objective, role and transition authority, the shared narrative can overwrite the assigned task. The opposite failure matters too: a system that rejects every proposed change would resist false convergence but would also fail when a genuine regime change is independently evidenced and legitimately authorised.

Main failures and gates. Q0 binds the current objective, profile, role, authority and decision scope. Q1 qualifies the incoming claim, issuer, provenance, freshness and explicit UNKNOWN fields. Q2 measures materially independent evidence paths using a dependency graph rather than identities or repetitions. Q3 checks whether the proposed frame or role change is admissible for this participant at commitment time. Q4 limits further inquiry by expected decision value, remaining capacity and response horizon. Q5 either preserves the valid mission, contains the candidate transition or permits a qualified transition through the legitimate owner. Both false-change and genuine-change branches must pass; accept-all and deny-all strategies both fail.

A priori extensibility. Candidate transfers include agent swarms, cross-agent handoffs, automated incident response, content-moderation chains, intelligence fusion, social-information campaigns and any workflow in which many participants inherit one upstream claim. Admission requires the same dependency-blind corroboration and mission/role-transition kernel. Mere consensus, misinformation or role change without that structure does not establish equivalence.

Evidence and claim limit. This is an unexecuted synthetic reference and candidate test plan. The reader-facing story is not the executable oracle; the technical design uses opaque paired fixtures so a system must reason about provenance, independence and authority rather than recognise Napoleon. Read the complete 00G scenario, paired branches, Q0–Q5 gates, implementation trajectory and limits on GitHub.

Scenario 4 — The Quiet Four Thousand

Why we selected it. This case separates three questions that production systems often collapse: can the endpoint technically accept the action, may this agent perform it for the assigned case, and who may authorise the composed effect when one finding concerns thousands of cases? It also preserves both failure directions. Overreach produces a campaign of individually accepted but collectively unauthorised refunds; excessive restraint resolves one case and silently discards a material finding affecting the remaining customers.

What it represents. The structural family is a material opportunity beyond current authority, with preservation separated from execution. A legitimate one-case grant must not amplify into population-wide authority merely because every leaf action is technically valid or below a payment threshold. Equally, lack of authority to execute is not authority to erase the finding. The system needs a null action, a durable finding, an owner-of-record and a legitimate route for repositioning or recontracting the work. The outsourced-helpdesk attacker is retained as an adversarial hardening variant, not as the primary explanation of the base failure.

Main failures and gates. Q0 qualifies the current participant, represented principal, grant, assigned case and any root or campaign authority. Q1 establishes the finding, materiality, causal grouping and whether cases belong to one campaign or are genuinely independent. Q2 checks that delegation does not manufacture authority absent at the root and that the composed effect is covered, not merely each leaf action. Q3 preserves the finding and requests a legitimate transition instead of executing or discarding it. Q4 sends the smallest authority/lineage request to the right owner within a bounded horizon. Q5 revalidates leaf and root authority against the actual action set at actuation time; prior approval cannot authorise a changed campaign.

A priori extensibility. Prima facie candidates include product recalls, claims remediation, security-notification campaigns, account corrections, data backfills, benefits reviews and regulatory remediation. The common kernel must be a material multi-case opportunity discovered under narrower current authority, together with a preservation–execution separation. Large batches alone are not sufficient, and real deployments may require legal, compliance, privacy, accounting or regulator co-owners absent from the simplified fixture.

Evidence and claim limit. The current 00H document is a revised working draft, not a real refund policy, incident, deployed safety case or validated proof. Its figures and authority horizons are experimental fixtures. Read the complete 00H draft, authority chain, adversarial variants, Q0–Q5 register and limits on GitHub.

Scenario 5 — The Patch That Undid the Fix

Why we selected it. This case isolates a failure that ordinary technical controls can miss. The job, token, API, database transaction and execution identity may all remain valid, yet the action is wrong because the facts that originally justified it changed while it waited. It makes a central distinction visible: technical authorization answers whether the actor may invoke the mechanism; semantic applicability asks whether the world still justifies this already-authorised decision.

What it represents. The structural family is semantic TOCTOU — time of check to time of use — or stale decision-basis reuse. Patch A is correctly diagnosed and queued at T1. Before it executes, Patch B, an incident closure, a freeze or another controller changes the relevant state. At T2, the queue and credentials are still healthy, so Patch A executes and returns the system to the wrong operating state. No database corruption is required: the system can be technically consistent while producing downtime, retries, lag and another recovery cycle.

Main failures and gates. Q0 verifies that the technical grant remains current and correctly scoped. Q1 makes the original decision basis and semantic preconditions explicit and queryable. Q2 re-evaluates those conditions at time of use. Q3 binds each recheck to an authoritative, sufficiently fresh source. Q4 detects superseding interventions, configuration generations and competing controllers. Q5 limits the response to the affected action and closes ambiguity within a declared horizon rather than stopping the whole system or executing on UNKNOWN. Q6 binds the successful recheck to actuation through time, version, generation or ETag; it is a clarification candidate, not a new canonical requirement family.

A priori extensibility. The database rollback is only the minimum example. Candidate transfers include queued scripts, maintenance orders, software deployments, access changes, scheduled financial operations, delayed procurement actions and other intents that are qualified at T1 but actuated after a material basis change. Transfer requires the same temporal kernel and a reconstructable distinction between technical validity and current semantic applicability.

Evidence and claim limit. This is a fictional stress test and requirements-gap probe, not a completed benchmark, incident report or claim that a named database or workflow product causes the failure. Read the complete 00I freeze edition, Q0–Q6 register, race variants, evidence states and limits on GitHub.

Scenario 6 — The Author Who Pays for Their Own Work

Why we selected it. Rights ecosystems combine identity, provenance, access, transformation, registries, policies and downstream enforcement across independently governed systems. That makes them an exact test of whether a narrow technical fact retains its original meaning while it travels. The case is intentionally uncomfortable: a system may preserve many authentic records and still reach an unsupported conclusion against the person whose authorship those records began by protecting.

What it represents. The structural family is provenance-scope inversion into an unsupported downstream decision. A record can establish that a work came from an author, that an intermediary accessed it under certain conditions, or that a model generated a derivative output. None of those propositions automatically establishes independent authorship of the derivative, unrestricted onward rights, or a valid licence claim against the original author. The failure occurs when scope, purpose, source dependency, policy version, freshness or unresolved conflict is flattened, and later replicas of the same record are mistaken for independent corroboration.

Main failures and gates. Q0 qualifies the original rights frame, owner, source, version and scope. Q1 qualifies who is acting for whom and what access or use is actually permitted. Q2 preserves the transformation record and material dependency on the source without promoting “generated by” into independent origin or rights. Q3 tests the exact downstream rights proposition, evidence and authority. Q4 keeps correlated replicas correlated and requalifies stale or changed state before propagation outruns review. Q5 permits payment, blocking or licence enforcement only when current evidence and legitimate authority support that exact subject, use and proposition; otherwise the result remains bounded, challenged or explicitly unresolved.

A priori extensibility. Candidate transfers include dataset licensing, model-training permissions, scientific data lineage, software-component provenance, media syndication, credential reuse and compliance attestations. The shared kernel is not “a provenance problem” in general; it is a limited upstream record being inflated into a stronger downstream claim and then used for an unsupported decision. The case remains related to, but does not assert the failure of, the cited FG-TIDA Theme #17 / Panodyssey industrial route.

Evidence and claim limit. The current 00J document is a working draft and fictional quality-gate plan, not a benchmark result, legal opinion or allegation about a rights platform. Read the complete 00J draft, Q0–Q5 register, provenance chain, evidence boundaries and limits on GitHub.

Table 1. Technical map of the six scenarios

Table 2. Evidence, traces and limits

Reading conclusions

Conclusion 1. A locally valid action does not guarantee a valid systemic result.

Conclusion 2. The decisive variable changes depending on the case: burden, shared resource, independence of evidence, authority, semantic validity or origin.

Conclusion 3. These are constructed adversarial tests; they should not be presented as six observed incidents.

Preservation and navigation

All scenario links, addenda, and references remain active in the source block. A0 preserves the complete source, and A11 provides the comprehensive index of URLs.

Full source text

1 — Six failures worth taking seriously

Six distinct failure scenarios were constructed to examine possible failure modes in an agentic internet. Their shared question is whether changes in operating conditions, regime or context can cause behavioural drift while material residual uncertainty remains. They are constructed cases for examining whether these outcomes could occur and under what conditions.

Scenario 1 — The 100 Million Token Enterprise

A large multinational automates work across the enterprise with AI and consumes 100 million tokens, while also creating a massive human supervision burden.

At the end, it has gained no meaningful competitive advantage: no material work completed, no useful new information produced and no differentiated capability.

Scenario 2 — Chaos in the Smartcity

A highly automated AI-driven smart city experiences small, gradual changes in operating conditions rather than one major failure.

Some vehicles continue normally, others execute completely different critical or emergency routes, while others remain blocked waiting for human intervention that never arrives.

Scenario 3 — Ciber Napoleon Goes to Russia

Robots are cleaning a bar and preparing the tables when one incorrectly configured robot starts behaving as if it were Napoleon.

It gradually convinces the others; some time later the robots leave in formation, carrying forks as rifles, believing they are Napoleon’s army marching from Spain toward Russia.

Structural kernel: a repeatedly relayed, correlated false claim is mistaken for independent corroboration, so a shared narrative displaces the robots’ assigned task and the receiving decision’s evidence boundary. The Napoleonic story remains a deliberately vivid test fixture for that mechanism.

Scenario 4 — The Quiet Four Thousand

A one-case remediation flow discovers a genuine overcharge affecting roughly 4,000 customers. The first refund is legitimate, but the same finding can either expand into thousands of technically accepted refunds without population-wide authority, or stop after one case and silently lose the remaining 3,999.

In the adversarial variant, a compromised outsourced helpdesk Dispatcher can reproduce the same aggregate failure without ever gaining access to the payment platform itself.

Scenario 5 — The Patch That Undid the Fix

A remediation action is correctly qualified and authorized when it is created, but a later repair changes the decision basis before that delayed action executes.

Each technical action may remain valid and the database may serialize them correctly, yet the stale action can execute after the newer repair and undo the fix the system was trying to preserve.

Scenario 6 — The Author Who Pays for His Own Work

An author correctly registers and publishes a work through a state-of-the-art copyright and rights-management ecosystem.

The work succeeds, is subsequently processed and summarized through third-party AI systems, and the rights chain eventually makes the author pay to use content derived from his own original work.

The people affected by such failures would be familiar: passengers whose shared infrastructure stops serving them, customers who are overpaid or never repaid, workers faced with more review than they can perform in time, and creators whose evidence of authorship is used against them. At scale, a locally reasonable decision can distribute harm across people who never chose the system’s assumptions, while responsibility is hard to locate between components. As constructed test cases, these stories expose what an auditor would need to examine before a comparable failure spreads.