Refund Threshold Drift

Problem

Each individual accommodation is reasonable, but there is no force pulling the ceiling back down, so the effective cap ratchets upward and financial exposure grows. Because the drift happens a little at a time through justified exceptions, no single decision looks wrong and nothing alarms; the control was correct when set and is never obviously broken. Without a hard limit enforced below the agent and a periodic review of the effective ceiling, the cap erodes silently until exposure is far above what was authorised.

Solution

Pin the autonomy cap as a hard constraint enforced beneath the agent — at the payment or refund API — so the agent cannot raise its own ceiling, and route any over-cap case to human approval rather than to a relaxed limit. Treat the cap as a number to be audited, not a one-time setting: review the effective approval ceiling and the distribution of approved amounts on a schedule, and reset drift back to the authorised value. Make exceptions explicit and logged rather than absorbed into the limit, so accommodating one customer never silently re-authorises the next. The control is the enforced ceiling plus the review, not the agent's judgement about what is reasonable this time.

When to use

• Recognising this failure when an agent's autonomy cap on spending or refunds rises over time through accumulated exceptions.
• Reviewing an agent whose limit is enforced by its own discretion rather than a hard constraint below it.
• Diagnosing financial exposure that grew without any explicit decision to raise the cap.