That depends on whether the failure was contained. In a governed operation, most failures stop at a bound: the action is refused or held, and nothing reaches a customer. When something gets through, the agent's depth drops at once, its work goes to people, the record shows what it did, and every affected outcome is corrected.
What kinds of failure are there?
Not every failure is an incident. It helps to sort them by how far they got:
| Failure | What stopped it | What follows |
|---|---|---|
| The agent tried something outside its bounds | The platform refused it | A filed verdict; review whether the brief invites such attempts |
| A draft was wrong | The reviewer who sends it | Edit logged; pattern checked in weekly review |
| A held action was wrong | The approver | Rejection logged with a reason |
| An action within bounds was wrong | Nothing in time | Incident: depth drop, correction, investigation |
| The agent or its model was unavailable | Not applicable | Fallback to people; outage review |
The first three are the controls working. They should be counted and studied, but they are not emergencies. The fourth is the one this article is mostly about, because it means the agent's bounds allowed an action that turned out to be wrong.
What happens in the first hour?
- On-call owner: lowers the agent's depth so it can only read. Evidence: a filed verdict naming the person and the reason.
- Operations lead: routes its live work to people. Evidence: the time of the switch and the queue handed over.
- Analyst: pulls the agent's actions from the record since the suspected start. Evidence: a list of affected cases.
- Process owner: decides whether this is a reportable incident under internal policy and any rules that apply. Evidence: the classification and who made it.
Ownership matters here. If the agent is owned by a technology team, the first hour is spent finding someone who understands the process. That is one reason operations, not IT, should own agents in production.
What happens over the following days?
The investigation asks three questions. What did the agent do? The filed record answers that, action by action. Why did the bounds allow it? The verdicts name which bound decided each action, which shows whether a limit was too wide or a source was wrong. What has to be put right? Each affected customer or entry gets a decision from a person.
Then the agent goes back through certification with new cases that reproduce the failure. It does not regain depth on the strength of the fix alone. The same discipline applies as for an agent that fails certification: evidence first, depth second.
For financial entities in the EU, an agent failure can also be an ICT-related incident under DORA, with classification and reporting duties if it meets the thresholds. Our guide to DORA incident reporting when an AI agent fails covers that. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does that look like in a real case?
Say a building society's agent processes requests to change the account that receives savings interest, at depth 3 for members whose identity was verified in the same session. A change to the online banking system means the "verified" flag is set for a wider group than intended, and over two days the agent makes 40 changes for members who had only partly completed verification.
A fraud analyst spots one suspicious change. The on-call owner drops the agent to depth 1 within minutes. The record lists all 40 changes and, for each, the source that said the member was verified. The team contacts every member, reverses the changes that members did not request, and reports internally. The agent is recertified with cases using the corrected flag, and the source is re-checked for provenance before depth is restored.
What should be in place before any failure?
- A tested way to drop depth in seconds and route work to people.
- A record that names the bound behind every verdict.
- An on-call rota and a clear incident classification.
- A view of whether the agent is ready for production that includes the failure plan, and close monitoring in the agent's first week in production.
The full sequence is in our guide to deploying an AI agent.
Where Pryme fits
Pryme files every verdict with the bound that decided it, so the first question in an investigation, why the action was allowed, already has an answer in the record. An Attest run that clears no depth drops the agent to depth 1 the same day, and depth returns only when a new run clears every gate on your cases.
Questions people ask
Is a refused action a failure?
The agent's attempt was a failure of judgement, but the refusal is the control working. Track how often it happens; a rising number means the brief or sources are pushing the agent towards the edge.
Who decides when the agent can return to full depth?
The process owner, on the evidence of a new certification run. Nobody should restore depth because the fix seems obvious.
Should customers be told an AI agent made the mistake?
Tell affected customers clearly what went wrong and what you have done about it. Whether to describe the agent depends on your disclosure obligations and policy, but the correction matters more than the attribution.