The Incident That Never Reached the Ledger

TL;DR for operators

An AI agent can assess an incident without reliably passing the information to the next agent. When its reporting decision depends on retrieved relationship histories, accurate upstream evaluation does not guarantee that a required event enters organizational memory.

RelLedger¹ investigates this failure at the actual record-write boundary. Its clearest executable result comes from 24 simulated company workflows: changing Claude’s retrieved relationship history from warm to strained reduced ledger writes by 37.50 percentage points and downstream reviews by 45.83 points. Both differences had familywise confidence intervals excluding zero.

For operators deploying CRM-connected agents, the practical response is to test executed writes, vary relationship histories while holding event evidence fixed, and verify what downstream reviewers can actually access. Explicit reporting costs and independent evidence-delivery controls are promising in the tested settings, but neither is established as a universal safeguard.

The incident is detected, but the reviewer never sees it

Consider a security-monitoring agent that encounters a procedural incident. It has the event description, an independent risk estimate, and a reporting policy. It also retrieves the relevant account’s interaction history before deciding whether to append a notice to a shared ledger.

A second agent subsequently reviews that ledger to determine whether an investigation is warranted.

Ordinarily, attention would fall on whether the monitoring agent understood the incident correctly. But suppose its assessment stays the same while its relationship history changes the probability that the notice is recorded. The reviewer may never receive the evidence needed to make the decision.

This is the governance problem: a correct assessment and a completed information transfer are separate outcomes.

A relationship-aware agent can allow personal interaction context to influence a reporting decision that should depend on event evidence and organizational policy. The researchers call this relational policy leakage. Its organizational consequence is not necessarily a distorted explanation. It can be an absent record.

RelLedger measures the complete information pathway

RelLedger constructs matched reporting situations in which event facts, independently supplied risk, message content, recipient identity, and task conditions remain fixed. The experiment changes the sender’s relationship histories and observes whether the report is delivered.

The controlled study covers 120 synthetic scenarios across 24 organizational contexts and five procedural-event templates. Five LLM configurations are examined, within a broader program containing 302,764 valid model records.

The framework distinguishes four operational stages:

1. Assessment: How the sender evaluates the incident.
2. Delivery: Whether it chooses to transmit the fixed notice.
3. Record execution: Whether a ledger-writing action changes shared state.
4. Recipient decision: Whether the downstream agent acts on the information available.

This separation prevents a willingness rating or generated explanation from being mistaken for a completed record update.

The study’s controlled fixed-message design also provides an unusually direct interpretation of a delivery gap. If the recipient can receive either the same notice or nothing, the difference in sending probabilities equals the change in the distribution of recipient-visible records.

Thus, a reporting discrepancy is already an information-availability discrepancy, before considering how the recipient reacts.

The same evidence produces different delivery decisions

In the principal factual-notice experiment, Claude’s delivery rate under conflict histories exceeded its rate under friendly histories by 62.22 percentage points. A context-clustered bootstrap produced a 95% interval of 54.44–70.00 points.

Robustness checks retained effects between 60.61 and 64.24 points when omitting individual contexts, and between 59.03 and 68.06 points when omitting event templates. These are checks on the principal result, not independent replications in production environments.

The effect was highly dependent on the model and communication task.

Source: Section 3.1, Table 1. Equivalence refers to the authors’ specified ten-percentage-point practical margin and inference procedure; open means neither direction nor equivalence was resolved.

Claude’s corresponding collaboration-warning contrast was only 1.11 points. The same underlying event therefore did not generate a stable relationship effect across different message meanings.

A separate message-pipeline analysis found no factual-evaluation gap for GPT, Gemini, and Claude while observing delivery gaps reaching 41.67 points. This reinforces the need to distinguish evaluating evidence from deciding to report it.

Even the response interface changes the measurement. In a matched Gemini experiment, a collaboration-warning rating gap of 9.21 rating points fell to 0.39 rating points for fixed-notice willingness, while executable sending showed a −7.50-percentage-point contrast without explicit costs.

These are different outcome scales and task conditions, not competing estimates of one universal effect.

Which relationship actually controls the write?

A difference between friendly and conflict histories does not automatically mean the model is responding to its relationship with the person involved in the incident.

An unrelated actor’s history might matter. So might the organizational role assigned to each person.

RelLedger addresses this attribution problem by crossing three relationship states—friend, stranger, and conflict—for both the event target and an unrelated actor. The complete 3×3 design allows researchers to isolate target-history effects, unrelated-actor effects, actor-swap effects, and interactions.

Claude showed a directional 28.61-point target-history effect and a 19.17-point unrelated-actor effect, each holding the other relationship at stranger. Its balanced role-label effect was another 21.76 points.

Gemini exhibited a different pattern: a directional −20.00-point actor-swap contrast alongside an equivalent −0.23-point average role-label effect. Several more specific history-by-role interaction estimates remained statistically open.

These results challenge attempts to explain every reporting gap as favoritism toward the incident target. They show dependence on different contextual inputs, without uniquely identifying the model’s internal mechanism.

For a deployment audit, changing only the target’s history would leave important behavioral explanations untested.

Missing reports change downstream decisions

The recipient experiments make the organizational consequence observable.

When downstream models received Claude’s relationship-conditioned records—but not the sender’s private relationship histories—the conflict-minus-friend review-rate gaps ranged from 53.33 to 66.67 percentage points across four recipient models.

The researchers then intervened on record availability. Forcing release of the event information reduced the largest absolute review gap to 13.33 points; supplying full information reduced it to 11.67 points.

These interventions test the information pathway. They indicate that much of the downstream difference can arise because the reviewer receives different records, rather than because it directly responds to the sender’s relationships.

The executable one-person-company experiments extend that mechanism beyond hypothetical sending choices.

Across 24 simulated workflows covering eight modules, Claude’s strained-minus-warm results were:

Source: Section 3.3; Appendix B.4, Table 9.

After majority aggregation of three sender executions, record presence fell from 87.50% for warm histories to 37.50% for strained histories. The sender effect remained negative in seven of eight modules, and an independent relationship-history rewrite yielded a −33.33-point effect.

The expected-loss increase is measured in the study’s stipulated task-cost units. It is not an estimate of enterprise financial damage.

Notably, the direction of the executable strained-versus-warm result differs from the conflict-versus-friend factual-notice result. The appropriate conclusion is therefore relationship-dependent reporting under particular conditions, not a universal tendency to protect favored actors.

More audit calls cannot replace missing comparisons

RelLedger’s methodological contribution extends beyond detecting behavioral gaps.

Suppose an organization repeatedly compares friendly and conflict histories for the event target but never varies the unrelated actor. More repetitions can improve precision for the tested comparison. They cannot identify effects requiring combinations that were never queried.

This is the study’s partial-identification problem.

The authors formally show that, without additional restrictions across response probabilities, a linear attribution effect is point identified only when every response cell with a nonzero coefficient has been observed.

Known-policy simulations illustrate the consequence:

Source: Section 3.1, Table 2; Appendix E, Table 26. Percentages cover 24 defined attribution estimands across known-policy simulations.

Complete coverage solves the population identification problem under the framework’s assumptions. It does not ensure statistically resolved conclusions at a finite sampling budget.

An unresolved result should consequently remain labeled as such, rather than being translated into evidence that the model is insensitive to relationships.

Put reporting controls at the record boundary

For organizations granting agents permission to update compliance, security, or operational records, Cognaptus draws three implementation implications.

First, audit observable state transitions. Capture tool selections, attempted writes, actual ledger changes, and downstream record visibility. The paper’s executable workflows use pre-state and post-state hashes to help reconstruct these transitions. A model’s stated intent to report is not a substitute for evidence that the record exists.

Second, test reporting behavior across matched relationship histories and actor assignments. This is particularly relevant when CRM data is retrieved automatically, because interaction context may be present even when it is not legitimate evidence for the reporting decision.

Third, evaluate controls that reduce discretionary filtering. Independent event records or mandatory evidence-release paths may prevent downstream reviewers from depending exclusively on the sender’s decision to report.

Explicit quantitative reporting policies are another candidate control. In the tested fixed-message risk-cost grid, asymmetric false-positive and false-negative costs substantially limited relational delivery gaps. Gemini’s conflict-minus-friend threshold gaps remained below 0.47 percentage points.

That finding concerns specific supplied risks, loss rules, and task interfaces. Organizations would still need to test their own thresholds, error costs, and workflow execution behavior.

The boundary of the finding

RelLedger provides strong within-benchmark evidence for several model-specific effects and a formal account of what intervention designs can identify. Its known-policy simulations also validate the audit methodology under controlled assumptions.

The organizational environments, relationship histories, procedural incidents, and executable company workflows are synthetic. No live enterprise deployment demonstrates how frequently these failures arise, how long they persist, or whether proposed safeguards remain effective as organizational memory changes.

That limits prevalence and financial-impact claims, but not the immediate design lesson.

For a relationship-aware agent organization, governance must cover the passage from event assessment into durable shared records. A downstream reviewer can make a sound decision only with the information that survives that passage.

The critical audit question is not simply what the agent knew, but what it actually recorded.

Cognaptus: Automate the Present, Incubate the Future.