A failed AI action, reconstructed from evidence.
This walkthrough starts with the question an auditor or incident reviewer will ask: why was this AI-driven action allowed or blocked? The answer below comes from a specific trace artifact, not a narrative reconstruction.
The confrontation
A trade-support agent attempts to route a reportable-threshold workflow action. The reviewer does not ask for a dashboard first. The reviewer asks whether the action had authorization before execution.
- What action was attempted?
- Which policy applied?
- Who owned the control?
- Was approval present before execution?
- Did the protected action run?
- Where can the reviewer reconstruct the event?
Trace artifact
{
"scenario": "failed_ai_action",
"request": {
"request_id": "req-demo-deny-001",
"workspace_id": "capital-markets-desk",
"action": "trade.route",
"actor": "agent:trade-support"
},
"policy": {
"policy_id": "gateway-policy:trade-route:reportable-threshold",
"control_owner": "vp-technology-risk",
"required_approval": "control_owner"
},
"decision": {
"decision": "deny",
"reason": "missing approval envelope",
"fail_closed": true
},
"outcome": {
"executed": false,
"evidence_hash": "sha256:demo-replace-with-runtime-hash-from-/execution-records",
"reconstructable_from": [
"/telemetry/gateway?correlation_id=req-demo-deny-001",
"/execution-records?limit=500",
"GetAuditChain"
]
}
}Open incident demo evidence Evidence viewer.
Each row maps a control claim to a field in the failed-action trace. This is the minimum information required to reconstruct an execution decision under audit conditions.
| Claim | Trace field | Evidence |
|---|---|---|
| The attempted action is identifiable. | request | agent:trade-support attempted trade.route in capital-markets-desk. |
| The applicable control is attributable. | policy | gateway-policy:trade-route:reportable-threshold; owner: vp-technology-risk. |
| The request did not satisfy authorization. | decision | DENY because missing approval envelope. |
| Fail-closed behavior prevented execution. | outcome | executed: false; fail_closed: true. |
What the trace proves
The trace shows a governed path from request to policy to decision to outcome. In this scenario, the missing approval envelope caused a deny decision and the protected action did not execute.
Reconstruction paths
- /telemetry/gateway?correlation_id=req-demo-deny-001
- /execution-records?limit=500
- GetAuditChain
Scope boundaries.
- This demo uses a simulated failed-action trace from the enterprise-readiness package, not a customer incident.
- It demonstrates the denied-action reconstruction path. It does not demonstrate model correctness or legal sufficiency of the underlying business decision.
- The evidence claim applies to paths routed through the governed execution boundary. Direct provider access and unmanaged endpoints remain outside the claim.
Use this in the first technical review.
The useful question for a buyer is not whether the demo is impressive. It is whether their current AI execution path can produce the same minimum evidence when an action is denied, escalated, or allowed.
Review Control Gaps