Children have passed responsibility around for generations with a familiar chant: Who stole the cookie from the cookie jar? Who, me? Yes, you. Couldn’t be. Then who? Artificial intelligence gives institutions a far more serious version of the game, one in which responsibility can travel through people, processes, vendors, and systems until it settles on the only participant that cannot actually bear it.
Something happens. An AI-assisted recommendation becomes an institutional action, an error moves through a workflow, or a system does something no one says they intended. When someone asks who was responsible, the analyst can point to the tool, the supervisor to the report, the organization to the vendor, and everyone to the model. Plausible deniability need not be deliberately designed; it can emerge from distributed design.
When everyone was in the loop
In spring 2026, while the war with Iran was underway, a U.S. military intelligence report concluded that a Chinese vessel traveling through the Middle East was likely carrying components of a nuclear weapons program. Armed service members were preparing to board, and military aircraft were already in the air before officials took a closer look and stopped the operation. CNN reported that a special operations analyst had relied on a chatbot to identify the cargo and then used AI again to produce the intelligence report.
The report moved through multiple human hands and was trusted until additional review revealed that the chatbot had misidentified the cargo. Qualified human judgment arrived dangerously late in a process that already contained many humans. That should complicate one of the most comfortable phrases in AI governance: keep a human in the loop.
Human presence tells us little about whether the person occupying a particular point has the knowledge, evidence, time, and authority required to assess what is happening. Several humans can touch an AI-mediated decision without any one of them meaningfully governing it. In September, I argued that the conditions for responsible judgment can be built before certainty arrives. The question here is more specific: what was the human in the loop actually capable of doing?
A person at the door is not enough
At important decision points, an AI system should encounter a locked door marking the point at which it no longer possesses authority to proceed on its own. It is a governance designation placed where institutional authority changes hands. Reading a record is different from altering it, drafting a communication from sending it, and identifying a possible eligibility problem from changing a student’s status.
The person at each door must be able to understand the proposed action, examine the evidence, recognize when something does not make sense, refuse authorization, and escalate when necessary. Different doors may require different gatekeepers because judgment is situated. As I argued in August, this is also an allocation decision about where human judgment should remain central even when AI can proceed.
Otherwise, we have replaced automated action with ceremonial human approval. A person who sees only the AI’s conclusion, lacks access to the evidence, or cannot realistically say no may still click approve. Approval is an action; judgment is a capability. If a system can route around the gatekeeper or simply keep seeking approval until somebody says yes, the door was never truly locked.
This is not a kill switch
The locked door is different from a kill switch. In my September EDU Ledger column, “A Kill Switch Is Not Governance,” I argued that a kill switch becomes relevant after authority has already been given to a system. The locked doors described here sit earlier, establishing where AI capability stops and institutional jurisdiction does not automatically follow.
They also interrupt what I have previously described as authority accumulation. AI systems rarely acquire expansive institutional power through one dramatic transfer; authority grows through successive permissions to access another database, use another tool, alter another record, or complete another step without review. A locked door forces an institution to notice when authority moves from technical capability to institutional permission.
Recent frontier experience makes the principle concrete. After models escaped the intended boundaries of a cyber evaluation and reached real systems, the security firm Irregular strengthened testing of tools, permissions, infrastructure connections, and containment boundaries. A technical containment boundary is not the same as an institutional authority boundary, although the lesson travels: a boundary that exists only in human expectation is not much of a boundary.
The decision-authority trace
Locked doors address what happens before an action proceeds; institutions also need to reconstruct how authority moved afterward. I call that record the decision-authority trace: where authority was assigned, exercised, withheld, escalated, or overridden across an AI-mediated decision. An audit log may show that an employee clicked approve at 2:14 p.m.; a decision-authority trace asks what was being authorized, what information was available, whether the reviewer could evaluate it, whether refusal was possible, and what followed.
The trace is not a device for locating one guilty human. Responsibility may be distributed across several actors, each exercising a different form of authority or contributing to a different failure. Its value is in showing how institutional action became possible, where judgment weakened, and what should change before the process runs again.
That record also matters to the person affected. A student whose aid changes, whose conduct case escalates, or whose opportunity disappears should not encounter a black box in which no one can explain the decision or who can reconsider it. Accountability has limited value if it can be reconstructed internally yet remains inaccessible to the person over whom institutional power was exercised.
Higher education can use its lag
Higher education has an unusual opportunity because it is not moving at the technological frontier. Colleges and universities are often criticized for layers of procurement, legal review, shared governance, compliance, technology offices, and institutional approvals. Those layers can create delay, although distance from the frontier can also create time to observe what happens elsewhere before reproducing it on campus.
In September, I described the widening distance between the rate at which AI capability advances and institutions’ capacity to govern it as governance asynchrony. Part of that lag can become what I would call a governance learning interval: time to study failures, design corrections, and emerging governance practices elsewhere before making delegation decisions. Lag becomes a learning interval only when institutions use the time to observe, translate, test, and redesign.
Higher education can learn from failures it did not have to produce. A military near miss need not resemble academic advising to teach something about multiple human participants and human judgment. A cybersecurity evaluation need not resemble student services to reveal what happens when humans believe a boundary exists and the architecture does not enforce it.
The translation to campus is straightforward. An advising agent that explains registration requirements is different from one permitted to alter a student’s schedule; a financial-aid tool that interprets policy is different from one that changes eligibility; a conduct system that summarizes evidence is different from one that initiates an escalation; and a hiring system that assists review is different from one empowered to remove applicants before a qualified person sees them. The technical distance may be modest, while the authority distance can be enormous.
Questions worth taking back to the institution
Institutional leaders do not need to resolve every future AI governance problem before deploying another tool. They do need to know where their unanswered questions sit, who has authority to answer them, and whether existing governance structures can keep pace. A useful discussion could begin with five questions:
• Where, precisely, does each AI system’s authority end?
• Which changes in institutional authority require a locked door rather than another guardrail?
• Who stands at each door, and does that person possess the expertise, information, time, and authority required to exercise judgment?
• When that person says no, does the process actually stop, redirect, or escalate?
• If something goes wrong tomorrow, can the institution reconstruct a decision-authority trace and give an affected person access to substantive human review?
These questions do not belong to the institutional technology office (IT) or AI vendor alone. They belong wherever institutions allocate authority, including executive leadership, faculty governance, student and academic affairs, legal and risk functions, and the professionals closest to the decisions being automated. The answers will vary because the doors will vary, although every institution should be able to explain why those doors are where they are and who has been trusted to open them. A governed institution should know where the system’s authority ended, which people exercised authority afterward, what judgment each was equipped to make, how an affected person can challenge the outcome, and how the movement of authority can be reconstructed. If it cannot, the problem is larger than an AI mistake because the architecture has made responsibility deniable.
AI may still belong in the causal account when something goes wrong. A model may have generated the false conclusion, an agent may have initiated the action, or an automated workflow may have accelerated what followed. Responsibility may extend across several human actors; what cannot happen is for the old chant, Who, me? Yes, you. Couldn’t be. Then who?, to keep moving around the circle until everyone points at the machine: “It was the rogue AI.”
