Chapter 28. Failure Modes and Anti-Patterns

Fourteen ways implementations go wrong, what each looks like early, and the correction.

28.1 Governance-theater patterns

Ceremony without proportionality. Every system receives the same review regardless of tier. Early sign: gate meeting length does not vary by tier. Correction: audit the actual evidence demanded per tier; if it is identical, the tiering is decorative.

Tiering as form-filling. Scores are entered to complete a field, with one-word justifications. Early sign: score distribution heavily weighted to Tier 1, justifications absent or generic. Correction: reject scores without justifications; run a calibration session with real examples.

Approval by attendance. A body approves everything presented because rejecting is socially expensive. Early sign: zero rejections and zero conditional approvals over a quarter. Correction: track outcome distribution; a gate that never returns anything other than approve is not a control.

The compiled view maintained by hand. An AI System Card kept in a document, updated occasionally. Early sign: any field in it differs from its source record. Correction: compile it or delete it.

28.2 Scope-creep patterns

Absorbing engineering. Reviews begin examining prompts, evaluation datasets, and model configuration. Early sign: ARB agendas contain items no board member can assess. Correction: re-apply the boundary test in Chapter 1, §1.3.

Absorbing delivery. Architecture begins reviewing delivery plans and change management. Early sign: the framework’s transformation depth exceeds visibility. Correction: the T5 stage is an external input interface; it has no architecture role.

Reinventing deferred standards. A local AI risk taxonomy appears alongside D1–D5, or a bespoke security control catalog. Early sign: two vocabularies for the same concept. Correction: the framework defers deliberately; integrate rather than duplicate.

28.3 Classification failures

Mechanism-reversibility scoring. D3 scored on whether the system state can roll back, not whether the consequence can be undone. This is the single most common scoring error. Correction: re-anchor with worked examples; make it a standing countersignature check.

Effective autonomy ignored. D2 = 1 recorded for a system whose human reviewer approves everything. Correction: instrument override rate; set the re-score threshold in advance.

Vendor AI unscored. Embedded AI features treated as configuration, not as AI systems. Early sign: the estate contains no Tier 2+ procured systems, which is implausible. Correction: procurement intake routing (Chapter 21, §21.4).

Pilot exemption. Systems run in production under a pilot label with no gate passed. Correction: pilot is a deployment state with a mandatory expiry, not a governance exemption.

28.4 Operational failures

Telemetry before records. The Control Plane connected before ADRs are trustworthy. Early sign: high alert volume, low resolution rate, owners unidentifiable. Correction: pause telemetry expansion, fix approved-state records.

Exceptions as a parallel process. Exceptions used to bypass requirements routinely, not to handle genuine edge cases. Early sign: exception count rising quarter on quarter; the same exception type recurring across teams. Correction: recurring exceptions are design feedback; fix the requirement or add a pattern.

Bodies as bottlenecks. Lead times grow until teams route around governance. Early sign: pre-briefing culture, or systems appearing in production without a corresponding authorization record. Correction: Chapter 20, §20.6.

28.5 The meta-failure

The pattern underlying most of the above is treating IRGF as a compliance regime instead of a decision-support structure. A compliance regime asks whether the form was completed. A decision-support structure asks whether the right people had the right information at the point of decision.

The diagnostic question is simple. When your governance process runs, does anything ever change as a result? If systems always proceed as originally proposed, the process is producing documentation rather than governance, and no amount of additional rigor will fix that.