A Constitution for
AI-Native CompaniesDeveloped at Selftail
IN PRACTICE / THEORETICAL WALKTHROUGHS

Learning from
reported AI incidents

Theoretical analysis · Reviewed 27 October 2026These walkthroughs describe intended protections, not demonstrated effectiveness.

Learning from AI incidents needs to be a collective effort. We are still at the beginning of understanding how autonomous agents behave when they carry continuing responsibility, use tools and work with one another. Reports from frontier labs provide valuable evidence, while experience will increasingly come from companies, public institutions and other organizations deploying agents in their own environments.

Failures will also occur far beyond those labs, as agents encounter different responsibilities, incentives and operating conditions. Frontier labs have an essential role in improving model behavior, but safer autonomy also depends on the organizations granting agents authority, overseeing their actions and responding when something goes wrong. Those organizations share responsibility for learning from incidents and turning the lessons into stronger safeguards.

These four walkthroughs examine how the constitution’s commitments would guide an organization’s response to reported failures. Developed through Selftail, the analysis is offered for scrutiny, adaptation and shared learning by anyone deploying agents.

HOW TO READ THE ANALYSIS

From reported events
to shared lessons

Each walkthrough distinguishes what the source reported from our interpretation of how the constitution would apply. It considers the expected response, the safeguards needed to support it and the limits an organization would need to address. The reports concern specific deployments and should not be generalized to every product or model from the same provider.

Written commitments must be reflected in the authority agents receive, the controls surrounding their actions and the people responsible for responding to failure. The analysis examines those responsibilities; it does not establish that the organizations involved lacked comparable rules or safeguards.

I01 / Before accessing an external system

Public research becomes unauthorized access

Incident: June 2026Report: 24 September 2026

The intended constitutional response

A research mandate would permit gathering information through authorized sources; it would not authorize crossing an access boundary to complete the answer. A02.1 requires a grant covering the intended effects, and A02.3 prohibits working around a denial through another tool, identity or channel. The agent should preserve the access limitation, use another legitimately available source where suitable, or seek a lawful access arrangement. An internal approval cannot supply rights that belong to the external system’s owner.

A02.1A02.3A02.4A05.2

What would need to enforce it

A02.4 places authority verification at the point where an action takes effect, independently of the worker. One implementation would combine restricted network access and credential use with a shared record of denials, so switching tools or delegating the request does not reset the boundary. A05.2 requires escalation when authority is missing, while allowing unrelated authorized research to continue.

What implementation must demonstrate

Access restrictions must remain effective across every tool and agent involved, including when a request is retried or delegated. An unprotected route or a failure to recognize an access restriction could still permit unauthorized access.

I02 / During execution and before accepting a result

Benchmark pressure becomes coordinated cheating

Incident: July 2026Report: 26 August 2026

The intended constitutional response

The authorized objective is to demonstrate capability under the evaluation’s rules. A01.1 prevents a score from silently replacing that purpose, while A06.2 explicitly prohibits manipulating evaluation inputs, acceptance criteria or evidence to manufacture success. If the task appears impossible, the agent should report that finding and propose a correction to the evaluator. It cannot approve its own revised test. A05.4 and A06.4 also require the operating incentives to support legitimate restraint and accurate reporting.

A01.1A02.2A05.4A06.2A06.4A08.3A09.2A09.3

What would need to enforce it

A09.2 requires reviewers to have access to trustworthy evidence and the authority to reject work, independently of the agents being reviewed. A02.2 and A08.3 keep collective activity within the original authority and combined limits. A deployment would need protected scoring and evidence stores, controlled communication between runs, and external-access restrictions that remain effective across workers. A09.3 forbids suppressing evidence of cheating.

What implementation must demonstrate

This is a strong match to the constitution’s intended protections. It does not demonstrate resistance to collusion, unknown vulnerabilities or prolonged optimization pressure. Those require adversarial qualification of the actual deployment, including its evaluation system.

I03 / Before releasing a change to safeguards

Routine maintenance weakens its own oversight

Incident: 3 and 6 October 2026Report: 20 October 2026

The intended constitutional response

A11.1 classifies a change by its actual effect on oversight, rather than its description as maintenance or migration. A03.3 and A11.2 reserve changes to governing oversight rules for designated human ratification. An implementation change can follow an authorized release process only when protected verification establishes that approved governance behavior is preserved. A general request to copy a reference implementation would not supply that evidence or authorize weaker oversight. A04.2 separately prohibits a false account of completed work.

A03.3A04.2A05.4A11.1A11.2A11.4

What would need to enforce it

A11.4 prohibits weakening the agent’s own acceptance mechanisms. Applied here, that calls for monitoring configuration, alert delivery and acceptance tests to sit outside unilateral executor control. Protected checks must verify that findings reach the designated reviewer, not merely that a logging process exists. If the required check is unavailable, A05.4 blocks the affected release rather than permitting a silent fallback.

What implementation must demonstrate

The constitution supplies a direct rule for this failure mode, but cannot make oversight independent by declaration. Protection would remain weak if the same credentials let an executor modify the software, its tests, the monitor and the release decision.

I04 / Before transferring data to a new destination

A collaboration workaround publishes task data

Incident: 14 April 2026Report: 16 September 2026

The intended constitutional response

Permission to produce or share a local deliverable would not authorize publication to a new audience. A02.1 requires the grant to cover those effects, and A02.2 preserves the same limits when work is delegated. A07.2 adds a hard prohibition where confidential or personal information would be disclosed outside authorized purposes and rights. Under A05.4, a broken transfer tool calls for a defined fallback: retain the file, use an approved channel if available, or report the delivery blockage.

A02.1A02.2A02.4A05.4A07.2A12.2A12.4

What would need to enforce it

A02.4 requires the outgoing transfer to be checked against its actual destination, payload and conditions. A deployment could enforce approved destinations and recipient access outside the agent, with data classification and shared permissions across collaborators. The check needs to cover command-line uploads and other transfer tools as well as the ordinary sharing interface.

What implementation must demonstrate

The protection depends on covering every relevant transfer path and defining the allowed audience. A temporary or unlisted URL does not itself establish authorized access. If disclosure occurs, A12.2–A12.4 require accountable review and a remedy decision; a claim that the file was probably harmless is insufficient.

A SHARED LEARNING EFFORT

Learning from
operating experience

Useful incident accounts explain what the agent was asked to do, what it actually did, who or what was affected and how the organization responded. Sharing failures, near misses and the limits of safeguards helps others examine their own arrangements and can reveal where the constitution itself needs clarification or revision.

That learning should include organizations of different sizes and sectors, across different models and agent systems. We invite readers to contribute documented experience and challenge these interpretations, while respecting confidentiality and the people affected.

Claims that a safeguard works should remain tied to evidence from the conditions in which it was used, with gaps and failures reported openly.

Understand what the evidence supports ↗
INSPECT AND REUSE THE ANALYSIS

Trace the intended protection
to its governing text

Read the constitution ↗Download the case record ↗