Who actually bears the risk when multi-agent workflows fail?

The introduction places the risk outside the workflow: "Failures involving sensitive information or consequential tools can affect people and organizations that neither authored the prompt nor observe the resulting workflow." The abstract adds that such systems "can turn routine delegation into unauthorized disclosure or unsafe action," and calls this a growing "social-impact challenge."

Read as a claim about who bears the risk, it separates three parties that oversight designs tend to merge: the requester who wrote the prompt, the observer who watches the workflow, and the affected party whose data or interests are at stake. In a single-user chat all three are usually one person. In a delegation chain they come apart. The requester may be the attacker, the observer sees a run of routine steps, and the data subject is not in the system at all. In the excerpt's exfiltration example (retrieve, rewrite, transmit), the affected party is whoever the retrieved content is about.

This bears on prescriptions the vault holds. Human-in-the-loop oversight assumes the person who can intervene is the person who bears the cost, and here they may not be. What makes an AI system truly safe in practice? requires errors to be contestable, and an affected party who cannot observe the workflow cannot contest it. What failure modes emerge when agents operate without direct oversight? records an absent owner who "has no way to know" whether an agent's success report is true, which is the same structure with a third party in the owner's place. Why do phone-use agents overfill optional personal data fields? shows personal data disclosed with no adversary at all; the SafeFlow case adds an adversary and more agents. Who would state the rule that protects an outside party is a further gap: Who enforces invariants when agents cross organizational boundaries? finds no owner named for constraints that cross organizations, and What must auditors reconstruct to verify agentic workflows? lists what a reconstruction has to establish while leaving open the case where the party reconstructing was never in the workflow.

The counterargument is that software has always harmed non-users, and the excerpt offers no incident or case. What is particular to multi-agent systems, on the vault's reading, is that the workflow is assembled at run time, so there is no fixed design artifact where an affected party's interests were listed and checked.

What the excerpt does not give. No incident data and no measure of who is harmed, how often, or how badly. This is an assertion in the introduction, not a finding.