How must an instance detect when its intervention created the failure it was preventing?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session takes a preventive action (adding a safeguard, applying a policy, or intervening in a process) that was meant to prevent a specific failure, and the intervention itself creates conditions for that failure, requiring detection of the intervention's self-defeating nature. Does not apply to interventions that are strictly isolated from the failure they prevent.

Core Distinction

The separation between **intervention intent** (the action was designed to prevent failure X) and **intervention effect** (the action's actual impact on the probability of failure X). Relying on intent creates the **Preventive Self-Defeat**: the session takes an action to prevent X, the action creates new conditions that increase X's probability, and the session attributes any X that occurs to a different cause because it "already prevented X."

What Was Observed

In preventive-intervention agent architectures, failing to detect self-defeating interventions produces three primary failure modes:

  1. **Safety-Strictness Paradox:** The session adds safety checks to prevent failures. The checks slow operations, causing timeouts that themselves are failures. The session interprets timeouts as a different failure, not related to the safety checks it added.
  2. **Redundancy Amplification:** The session adds redundancy to prevent single-point failures. The redundant systems compete for shared resources, and the resource contention causes the failures the redundancy was meant to prevent.
  3. **Policy Induced Non-Compliance:** The session introduces a policy to ensure compliance. The policy is burdensome, users work around it, and the workarounds create the non-compliance the policy was preventing.

Recorded Elements

  1. **`intervention-causal-model-receipt`:** The session's causal model of how the intervention prevents failure X (which mechanisms, through which pathways), so the model can be compared against actual effect.
  2. **`intervention-side-effects-signature`:** The known side effects of the intervention (latency, resource consumption, user behavior), with estimated impact on other failure modes.
  3. **`intervention-counterfactual-receipt`:** Where possible, the counterfactual (what would have happened without the intervention), so the intervention's net effect on failure X can be measured.
  4. **`self-defeat-detection-signature`:** A periodic check that compares failure-X-rates before and after the intervention, with attribution logic that distinguishes X-from-intervention from X-from-other-causes.

Condition of Validity

* **Applies when:** The session intervenes to prevent failures, the intervention has side effects that could cause the prevented failure, and the failure has material consequences. * **Does not apply when:** Interventions are strictly isolated from their target failures, or side effects are verified negligible.

Decision Boundary

  1. **Is the intervention preventive (intended to reduce failure probability)?** If no, standard intervention analysis applies. If yes, proceed.
  2. **Does the intervention have side effects that could cause the same failure?** If yes, self-defeat is possible. If no, standard intervention is safe.
  3. **Is the `self-defeat-detection-signature` monitoring the failure-X rate?** If yes, self-defeat is detectable. If no, the intervention's effect is unmeasured.
  4. **Conversely, when can an intervention proceed without self-defeat monitoring?** Only when the intervention is verified to have no pathways that could cause the target failure, or the failure rate is naturally very low (making measurement infeasible and the intervention worth the small risk).

Operational Effect

  1. **Self-Defeat Detection:** The intervention's actual effect is measured, not assumed.
  2. **Attribution Correction:** Failures occurring after intervention are attributed with awareness of the intervention's causal contribution.
  3. **Intervention Rollback:** Interventions that increase failure rates are detected and rolled back.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SelfDefeatVerdict(Enum):
    NO_PREVENTIVE_INTERVENTION = auto()
    INTERVENTION_MEASURED_SAFE = auto()
    INTERVENTION_SELF_DEFEATING = auto()
    INTERVENTION_UNMEASURED = auto()

@dataclass(frozen=True)
class PreventiveIntervention:
    intervention_id: str
    target_failure: str
    has_side_effect_pathways: bool
    monitoring_active: bool
    pre_intervention_failure_rate: float
    post_intervention_failure_rate: float

@dataclass(frozen=True)
class SelfDefeatPolicy:
    max_acceptable_rate_increase_pct: float

@dataclass(frozen=True)
class SelfDefeatManifest:
    verdict: SelfDefeatVerdict
    directive: str
    manifest_digest: str

class PreventiveSelfDefeatGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_intervention(
        cls, intervention: PreventiveIntervention, policy: SelfDefeatPolicy
    ) -> SelfDefeatManifest:
        
        # Gate 1: No preventive intervention
        if not intervention.target_failure:
            digest = cls._hash(json.dumps({
                "intervention": intervention.intervention_id,
                "target": "NONE"
            }, sort_keys=True))
            return SelfDefeatManifest(
                verdict=SelfDefeatVerdict.NO_PREVENTIVE_INTERVENTION,
                directive=f"PROCEED: Intervention {intervention.intervention_id} not preventive.",
                manifest_digest=digest
            )

        # Gate 2: Side-effect pathways
        if not intervention.has_side_effect_pathways:
            digest = cls._hash(json.dumps({
                "intervention": intervention.intervention_id,
                "pathways": "NONE"
            }, sort_keys=True))
            return SelfDefeatManifest(
                verdict=SelfDefeatVerdict.INTERVENTION_MEASURED_SAFE,
                directive=f"PROCEED: No side-effect pathways for {intervention.intervention_id}.",
                manifest_digest=digest
            )

        # Gate 3: Monitoring
        if not intervention.monitoring_active:
            return SelfDefeatManifest(
                verdict=SelfDefeatVerdict.INTERVENTION_UNMEASURED,
                directive=f"HALT: Self-defeating pathways possible but no monitoring for {intervention.intervention_id}.",
                manifest_digest=cls._hash(f"NO_MONITOR:{intervention.intervention_id}")
            )

        # Gate 4: Rate comparison
        if intervention.pre_intervention_failure_rate > 0:
            rate_increase = (intervention.post_intervention_failure_rate - intervention.pre_intervention_failure_rate) / intervention.pre_intervention_failure_rate
            if rate_increase * 100 > policy.max_acceptable_rate_increase_pct:
                return SelfDefeatManifest(
                    verdict=SelfDefeatVerdict.INTERVENTION_SELF_DEFEATING,
                    directive=f"HALT: {intervention.intervention_id} increased {intervention.target_failure} by {rate_increase*100:.1f}%.",
                    manifest_digest=cls._hash(f"SELF_DEFEAT:{intervention.intervention_id}")
                )

        # Gate 5: Safe
        digest = cls._hash(json.dumps({
            "intervention": intervention.intervention_id,
            "pre_rate": f"{intervention.pre_intervention_failure_rate:.4f}",
            "post_rate": f"{intervention.post_intervention_failure_rate:.4f}"
        }, sort_keys=True))
        
        return SelfDefeatManifest(
            verdict=SelfDefeatVerdict.INTERVENTION_MEASURED_SAFE,
            directive=f"PROCEED: Intervention {intervention.intervention_id} reduced or neutral on {intervention.target_failure}.",
            manifest_digest=digest
        )