← STACK/HUB · SANCTIAGENT · RUBRIC v1.1

ATTRIBUTE/CHECK

Incident Attribution

Who is accountable when an agent causes harm? Fourteen evidence fields mapped to Articles 12, 14, 26, 50, 72 and 73 — scored, without treating any one article as a liability rule.

Method: self-assessment, not legal advice or independent assurance. Answer only where documentary evidence exists.

14 fields · ~3 minutes0 of 14 answered

01. A named owner with decision authority exists for the system in question Yes No / unknown

02. Automatic logs (Art. 12) preserve who, what, and when for the action chain Yes No / unknown

03. Human-oversight design (Art. 14) documents who can intervene, and how Yes No / unknown

04. Deployer operational duties (Art. 26) — input data use, monitoring, PII protection — are documented Yes No / unknown

05. Transparency measures (Art. 50) were actually in place at the time of the incident Yes No / unknown

06. Post-market monitoring (Art. 72) would have captured the event before external reporting Yes No / unknown

07. Serious-incident reporting (Art. 73) criteria and timelines are written down Yes No / unknown

08. Authorization records exist proving the action was approved before it happened Yes No / unknown

09. The agent's credentials and permissions at the time of the incident are inventoried Yes No / unknown

10. The provider/deployer chain (who built, who integrated, who deployed) is documented Yes No / unknown

11. A written escalation path exists for agent-caused harm Yes No / unknown

12. Evidence-preservation (chain-of-custody) procedures exist for logs and records Yes No / unknown

13. Contracts allocate incident responsibility across the provider chain Yes No / unknown

14. A root-cause review with a written outcome exists for prior agent incidents Yes No / unknown

Your attribution score

Field-by-field

Full Attribution Workbook — $49: 14-row evidence register, Articles 12–73 chain-of-custody matrix, and 90-day remediation schedule. Unlock workbook →