The negative space problem: accountability when an AI agent fails to act

Most accountability frameworks for AI agents are built around decisions made and actions taken. An agent executes an operation; it creates a record; it crosses a threshold and escalates. The accountability question is what happened and who authorized it.

But AI agents deployed in monitoring, care, and security roles are expected to do something else: to watch continuously and act when conditions call for it. The expected action might be an alert, an escalation, a record, or a preventive intervention. The accountability problem that arises when that action does not happen — when the agent was watching and did not flag — is structurally different from the problem of a wrong action, and most current frameworks do not address it.

This is the negative space problem.

The structure of omission

When an agent takes a wrong action, the accountability record begins at a specific moment: the decision. That decision is timestamped, attributable, and available for review. The question is whether it was authorized, correctly formed, and based on appropriate inputs.

When an agent fails to act when it should have, there is no moment to review. There is no timestamped non-decision. There is only the absence of a record that should exist — and the absence of a record is not itself a record. The harm that follows may be traceable to the agent's inaction in retrospect, but the absence creates no footprint of its own.

This asymmetry matters enormously for care contexts. An AI care agent is expected to detect deterioration and escalate. When it does escalate, the escalation is logged. When it does not — when a patient's condition worsens without the agent raising an alert it was positioned to raise — the absence of an alert is not an entry in the audit trail. The harm arrives; the audit trail contains nothing that explains why the alert was absent.

The PQ crossing: silent gaps in security monitoring

At the post-quantum crossing, the negative space problem appears in the context of cryptographic hygiene. An AI agent responsible for monitoring the cryptographic posture of a system — certificate expiry, cipher suite compliance, key rotation schedules — creates its accountability record through the alerts it raises. When a transition to quantum-resistant algorithms is incomplete, an agent that was monitoring for legacy cipher usage and did not flag a non-compliant endpoint created no record of that gap.

The security event that follows might be attributed to the cryptographic transition, or to the monitoring system, or to an operator who never reviewed reports that were never generated. The agent's non-action is a cause of the harm, but the accountability structure was not built to capture omission as a first-class event. The absence is invisible to the audit trail by design.

The problem is compounded at the hardware crossing. An agent monitoring the integrity of hardware-anchored cryptographic state — checking that secure enclaves are operating within specification, that attestation chains remain valid — depends on conditions that may silently degrade. A monitoring agent that checked last week and found nothing wrong is not the same as a monitoring agent that checked today. The gap between checks is not recorded as a gap. It is recorded as nothing at all.

The care crossing: the escalation that never came

In physical-world care, the negative space problem is both most acute and least addressed. Care agents are deployed precisely to provide continuous monitoring that human care staff cannot maintain at the same intensity. Their value proposition is the escalation — the alert that catches a deterioration before it becomes irreversible.

When that escalation does not occur, the question is not only what the agent did. It is what the agent was positioned to do, what its thresholds were configured to detect, whether those thresholds were appropriate, and whether the care team was entitled to rely on the agent's silence as a signal that conditions were stable.

That last point is critical. In care settings, agent silence is often operationally interpreted as a signal. Staff who rely on an AI monitoring system learn to treat the absence of alerts as evidence that no alert is warranted. When the agent fails to fire — because the threshold was misconfigured, because a sensor had drifted, because a rare combination of conditions fell into an unmonitored gap — the silence that precedes the harm is indistinguishable from the silence that means everything is fine.

The people most exposed to this failure mode are care recipients who cannot self-report that something is wrong. An elderly resident experiencing genuine deterioration may not be in a position to identify that the care agent has not flagged it. The agent's silence carries a weight of clinical authority it was never designed to bear.

What accountability architecture requires

Addressing the negative space problem requires treating non-events as audit objects. Several properties follow.

First, expected actions that did not occur should be logged as absences, not as blanks. An agent monitoring for a condition should create a record when it evaluates that condition and finds nothing actionable — not just when it finds something. The absence of an alert should be a logged finding, not the default silence. The audit trail should contain affirmative statements of the form "evaluated condition X at time T; no action warranted" as consistently as it contains records of actions taken.

Second, the conditions under which an agent is expected to act must be explicitly specified and independently auditable. The configuration that defines an agent's alert thresholds is an accountability artifact — it determines what the agent should have flagged and what it was permitted to miss. That configuration should be versioned, timestamped, and reviewable alongside the decisions it governed. Changing a threshold without leaving an audit trail is the equivalent of retrospectively rewriting the rules by which the agent operated.

Third, reliance on agent silence must be governed. Where humans operationally treat agent inaction as a positive signal — where the absence of an alert is taken to mean conditions are stable — that inference depends entirely on the correctness of the agent's monitoring configuration. The governance of that reliance: who authorized it, what audits it requires, and how quickly misconfiguration can be detected, should be explicit and subject to review.

The negative space problem will not be solved by better action logging alone. It requires that the absence of expected actions becomes as visible and traceable as the actions themselves. Until it does, the accountability architecture for AI agents remains structurally blind to the most consequential thing many of them can do: nothing.