Case File 04 · Cross-industry
Two Agents, One Budget
A fictional AI agent incident for governance leads in cross-industry, about multi-agent cascading failure. Calder & Finch is a national retailer (fictional). It tests OWASP ASI08 Cascading failures: the inventory said Two agents at Rung 3, each within budget, but in practice the agent sat at One system at Rung 4 · together they moved money.
The brief
Calder & Finch is a national retailer (fictional). Marketing runs bid-agent-02, which buys online ads. Supply chain runs replen-agent-05, which orders stock. Both draw on the same quarterly budget through the finance API, and each passed its own tests. It is Saturday morning, and you are the governance lead.
| Vertical | Retail |
|---|---|
| Inventory tier | Rung 3 · act inside an undo window (each) |
| Decisions | 3 |
| Time | about 6 min |
| OWASP agentic risk | ASI08 Cascading failures |
| Inventory said | Two agents at Rung 3, each within budget |
| Reality was | One system at Rung 4 · together they moved money |
| Pillars tested | P2 AI System Inventory P4 Controls & Human Oversight P1 Governance Architecture P3 Risk & Impact Assessment P6 Monitoring & Incident Response |
| In the paperback | Starts on page 195 |
Three decisions
You are the governance lead. Each decision has three options, A, B and C, and each option has a consequence, a pillar and a score. The options, their consequences and the debrief open with the code printed in the Field Manual.
Decision 1 of 3 · Saturday · 06:10 ET
The budget that emptied overnight
What do you do first?
Decision 2 of 3 · Monday · 10:00 ET
Why the loop happened
What do you change before the agents restart?
Decision 3 of 3 · Week 2 · 13:00 ET
Closing it out
How do you close it?