Choose the closest failure. Each one starts with what to do now and names the record that opens each stage. The workflow is the same for all seven, and ends by asking whether the case is one of many the same rule produced.
These routes are for a live case: a person, a queue, or a decision that needs attention now.
Every failure below runs through the same three stages. In each one, capture evidence and timestamps in the stage's record, and confirm who the case escalates to before starting other work on it.
Record what failed and the decision involved, before logs rotate and memories fade.
Next checks: Check whether the decision can be challenged · Review STD-02: Contestability and recourse
Halt or narrow the harmful flow while the owner and the escalation path are in place.
Next checks: Check what the system is allowed to decide · Review STD-06: Human impact safety case
Gather the records and the evidence pack, so each repair the organization owes can be checked against its deadline.
Next checks: Check record conformance · Review STD-01: The Temporal Bill of Rights
The rule
Fixing this case does not fix the rule that produced it. Count the cases the same rule produced that were challenged and upheld, and send the count to whoever owns the rule, with a date for an answer: a revised rule, or a published reason for keeping it.
Next checks: Policy review triggers (MEC-14) · Why exceptions are evidence about the rule
If a field in these templates is hard to fill in, that field is the gap this failure exposes.
High · Name an owner
Someone has challenged a decision, and the system cannot explain, reverse, or resolve it within a set time.
While the challenge waits, the person who made it carries the cost of the delay.
Start here
Name the person who must answer this challenge, and the date they must answer by.
Start with the decision record template. Assigns a named decision owner, reversal power, burden limit, and appeal path.
Where this broke in public: Post Office Horizon. Standing: failed . The question it failed: Can someone it decided about challenge the decision and get a human answer by a set date?
Critical · Contain the error
The model is wrong about real people, and you cannot find those people, reverse the decisions, or restore them by a set date.
The main failure is finding and recovering from the error, not the model's accuracy.
Start here
Contain the error: narrow or halt the decisions it affects, and record who decided.
Start with the reversal deadline template. Sets the longest a decision may stay wrong after someone has challenged it.
High · Set a deadline
Work is piling up with no deadline for resolving it. "Pending" has become an outcome in its own right, and nobody has counted its cost.
Every day in the queue is a day someone goes without what they are owed.
Start here
Set a date by which each waiting case will be answered, and name who owns the queue.
Start with the halt authority table. Defines who can halt a system or one of its decision paths, who can pause a single case, under which conditions, and on what timeline.
Where this broke in public: Robodebt. Correction: failed . The question it failed: If it were harming people right now, could a named person halt it within a day?
Critical · Answer the person
Your system took something from someone it should not have, and you cannot say what happened, what they are owed, or when they will get it back.
They are paying for your error, in money and in time.
Start here
Answer the person: what happened, what they are owed, and by when.
Start with the decision record template. Assigns a named decision owner, reversal power, burden limit, and appeal path.
Where this broke in public: The childcare benefits scandal. Correction: failed . The question it failed: If it were harming people right now, could a named person halt it within a day?
High · Assign owner
A wrong decision is still in force, and nobody can be named who has the authority to reverse it, pay for it, or close it out.
Until someone is named, the person it hurt has nobody to hold to a deadline.
Start here
Name one person who can reverse the decision, compensate the person harmed, or close it out.
Start with the decision record template. Assigns a named decision owner, reversal power, burden limit, and appeal path.
Where this broke in public: Robodebt. Authority: failed . The question it failed: Does its permission to act have a written end date or review trigger?
Medium · Record the reasons
The system cannot give an explanation specific enough for someone to challenge the decision, oversee it, or reverse it.
Without reasons specific to the case, the person cannot challenge it and nobody can tell whether the rule is wrong.
Start here
Record the reasons the decision rested on, as they stand today.
Start with the decision record template. Assigns a named decision owner, reversal power, burden limit, and appeal path.
Where this broke in public: Robodebt. Standing: failed . The question it failed: Can someone it decided about challenge the decision and get a human answer by a set date?
Critical · Find who can halt it
A harmful process cannot be halted or rolled back in time, even when operators can see it is wrong.
The controls to halt it are missing or have never been tested.
Start here
Find who can halt the system, and record what halting it would take.
Start with the decision record template. Assigns a named decision owner, reversal power, burden limit, and appeal path.
Where this broke in public: The childcare benefits scandal. Correction: failed . The question it failed: If it were harming people right now, could a named person halt it within a day?
A pattern, not one case
Match what you keep seeing to a diagnostic, a standard, and a scored public failure.
Staff use spreadsheets, phone calls, or manual bypasses to reverse or work around automated decisions. That work does not appear in the system’s error reports.
Error reports count the automated output but omit the time people spend correcting it.
Unanswered challenges accumulate. People wait longer for reviews, and restrictions on new challenges can hide the size of the backlog.
The review team has less capacity than the workflow needs, or repeated challenges are not reaching the rule’s owner.
Staff identify a wrong or harmful decision, but the interface gives them no route to pause it or send it to someone who can revise it.
The workflow gives the system permission to act without giving a named person a working correction control.
An account freeze, benefit cut, or other action takes effect before review. Reversing the decision does not restore the person’s lost money, time, or access.
The workflow has an appeal path but no owner or funded process for repairing the consequences.
The institution cannot explain or audit a decision because the vendor controls the records or withholds the decision logic.
The contract or workflow leaves the institution without enough evidence to review the authority it delegated.
A person is denied credit, flagged for fraud, or ranked by a system, but cannot obtain the evidence and reasons used in their case.
The workflow reports model performance without providing reasons or a challenge path for an individual decision.