When systems are chained, the responsibility chain breaks at the interfaces; each segment's boundary must be drawn in advance

What it is

The agent calls retrieval, retrieval calls an internal service, the service calls payments or mail. On a failure each stretch can say “I did what upstream gave me.” Chained systems break duty at joins: without a prior drawing of “who owns the object and verb of this hop,” replay stops on the empty ground between stretches. Boundaries have to be written before the chain is wired, not fought over after it breaks.

If the triple lives only inside one stretch, investigators break when they reach the join.

Why it happens

Each hop replaces or wraps the object. Upstream “customer A” may become a string of IDs downstream, then another vendor’s order number on the next hop. In-stretch tracing only sees its own cut. If the join has no shared object identity, no agreement on “who is the difference-maker on this hop,” complete logs from each stretch will not join into one cause. Organisationally this looks like throwing: the model says the tool, the tool says the mail API, mail says the content came from upstream.

Drawing a boundary draws permission and duty together: who may fire this hop, whose name is on its failure, who is obliged to hand over the triple at investigation. If each stretch sets its own life, the shortest will pinch the whole chain off.

Studying it

Build a chain of at least three stretches, plant an error in the middle stretch or at a join. Let investigators use only each stretch’s own logs. Dependent variables: whether they can point at the stretch that was the difference-maker, whether they stop at the join, whether objects match across stretches. Independent variables: whether a shared object ID exists, whether stretch duty was written in advance, whether log life is aligned.

Stopping at the join with “both sides look right” is the chain broken.

Where it stops holding

Module boundaries inside one system have join problems too, but usually one owner can order IDs to match. Cross-organisation vendors are harder; the drawing must go into the contract, not only an internal wiki. Whether a person knows the current rung is awareness inside one stretch; a broken chain is structure between stretches. Fair-transfer refuse conditions have to be met on each hop that faces a person; a signature at the end of the chain will not do.

Applying it

• Before chaining, draw a hop table: how object identity aligns on each hop, who is the difference-maker, who hands over the triple, life floor. Missing a hop, do not join to production.
• The triple on the outward hop must include the object’s original name as passed from upstream, not only the downstream ID.
• Check: change the object in the middle stretch, then send. Investigators should walk from the outward result back to the middle change, not stop at “mail says the API gave the content.” If they cannot walk back, the boundary is not yet drawn. Take the shared ID away and walk again — if it breaks at the join at once, the drawing depends on that hop table, not on each stretch’s logs speaking for themselves.

Related

• Same group: L4.15.1 Degree of automation allocates responsibility, but users usually do not know which tier they are on · L4.15.2 Traceability requires recording input, decision basis, and result together; missing one makes replay impossible · L4.15.3 Logs must be kept until accountability might arise, not only as long as debugging needs them · L4.15.4 Handing final confirmation to a person does not mean responsibility has been fairly transferred; the person must have the conditions to refuse
• Nearby: L4.06 Permission Boundaries of Agents · L4.13 Agent Failure Reporting and Escalation · L4.01 Levels of Automation
• Search terms: accountability boundary · system of systems · interface