How do you handle an incident caused by your provider rather than your code?

The number everyone reacted to sits at the right edge. The thing that actually caused it sits nine days to the left, in a changelog nobody on the product side was reading that week.

How to answer this, stage by stage

Nobody is grading whether you can say "we opened a ticket with the vendor." They are grading whether you can prove a provider caused something before you say so out loud, for an incident where your own code shipped changes in the same window. Seven moves get you there.

Let's learn

What happens when the thing you would swear was working stops being it, and nothing on your end changed?

Say we build a tool that reads the facts of a motion and drafts the paragraph that names the cases, quotes the holding, and gets the citation format right, so a lawyer isn't hunting through a case database by hand at midnight.

Before a tool like this existed, an associate spent about five hours pulling cases and checking every pin cite by hand for one motion. The tool cuts that to about forty five minutes: read the draft, check it, file it.

Every night, a held out set of eight hundred real citations gets checked against the actual case text, the pin cite and the holding, not just whether the case name is spelled right. Normally about thirteen of those eight hundred come back wrong. That's about one point three in a hundred, and it's the number the team has always lived with, mostly caught by the lawyer's own read before anything gets filed.

Here is the turn. Those extra bad citations at one point eight percent, two point one percent, were never the real problem. The real problem is the afternoon one of them is a real holding that decides a real motion, and the pin cite looks exactly like every one that was right yesterday.

At its worst, that costs far more than a bad night on a dashboard. If a misstated holding gets filed, that isn't an embarrassing typo. That's a lawyer standing in front of a judge on a case that doesn't say what the brief says it says, with the firm's name on the signature block and a very different kind of conversation waiting afterward.

The choice I would take back. Production traffic pointed at Cartwell's always-newest "assistant-latest" alias instead of a dated snapshot we controlled, so every change Cartwell shipped reached Precedo's users automatically, with no gate and no warning.

I also looked at just adding a stronger warning telling associates to double check every holding by hand, and rejected it. A banner doesn't change what a rushed associate actually rereads forty minutes before a filing deadline. A gate on what version of the model reaches production does.

What I would leave alone. The tool's plain summary of the facts, the party names, the procedural history, is not where the risk lives, and pinning the model back a version wouldn't make that any safer. If that phrasing drifts a little, nobody's legal argument depends on it. The risk lives specifically in the one sentence that states what a case actually held.

The lesson. A dependency you don't version yourself isn't a dependency. It's a bet you're re-placing every single day without ever noticing you placed it again.

Now here is the same thing as a story

The short version is above. Read on if you want to feel how ordinary the nine quiet days looked from Corwith's own dashboard.

Sorcha Delacombe runs incident response for Precedo. Two years in, she can tell inside a minute whether a spike on her dashboard is a real problem or a Tuesday. She built that instinct the slow way, watching the nightly eval number every single morning with coffee before anyone else was at their desk.

The number that morning nine days before the near miss was nothing. One point four percent, inside the usual noise. She didn't know, and had no way to know yet, that Cartwell had logged a changelog entry the day before, three paragraphs down a release notes page titled "Quality and latency improvements to the assistant endpoint. No action needed." Nobody at Corwith read release notes pages that closely. Why would they. Nothing had broken.

Over the next week, the nightly number drifted. One point four. One point six. One point eight. Still inside the band Sorcha's own dashboard called "watch it, don't panic." A number moving like that looks exactly like ordinary noise, right up until it isn't.

On the Monday, Corwith shipped its own retrieval index expansion, three new regional case law reporters added to Precedo's search, a change the team was genuinely proud of. Recall on rare, out-of-state citations went up. It looked, by every measure the launch review checked, like a clean improvement.

By Tuesday the eval sat at two point one percent. Still watch-it territory. Nobody paged anyone.

Wednesday afternoon, Amrita Voskuil, a litigation associate at Renslow and Cade, was finishing an opposition brief forty minutes before the e-filing deadline. Precedo had drafted the Statement of Authorities that morning, citing Halbrook v. Corven Timber for the proposition that a force majeure clause covers a labor shortage. The case name was real. The pin cite pointed at a real page. The case, read in full, says the opposite.

Amrita didn't catch it. Her supervising partner did, on the final read, the way a partner who's read a thousand force majeure cases catches something a junior associate reading fast would not. He called Corwith's support line still holding the printed draft, furious, forty minutes from a deadline he now had to make with a hand-cited paragraph instead.

That night's eval landed at five point six percent. Forty five of eight hundred, more than four times the normal rate.

Sorcha's first instinct was to look at Monday's deploy, because that's the thing her own team had just touched. She had the retrieval team replay every retrieval-only call, the ones where Precedo only needed to quote indexed case text back verbatim with no paraphrasing, against the old index and the new one, with the model held out of the test entirely. Flat. Clean. Zero difference. That ruled out the thing everyone had assumed first.

So she recut the whole incident window by one line: calls that only needed to retrieve and quote, against calls where the model had to read a holding and apply it to a new fact pattern. Retrieval-only miss rate: flat at zero point four percent the entire sixteen days. Model-synthesis miss rate: one point three percent baseline, climbing to nine point eight percent at the peak. Every wrong citation in the whole incident sat inside the second group.

Ruling out the first suspect took a day. Separating the second suspect from the third took one more test, run twice, at two different hours.

Now there were two suspects left, both on Cartwell's side. The version bump they'd logged in their changelog. And something Sorcha had only ever half-believed was real: a provider quietly routing a slice of "latest" traffic to a smaller, faster relief model during their own peak load windows, without changing the model name in the response at all.

The test that separated them was almost embarrassingly simple. She took forty fact patterns from the pre-incident golden set, already hand-verified correct nine days earlier. She replayed all forty, same code, same prompt, same retrieval, against Cartwell's live "assistant-latest" alias and against a dated snapshot from before day minus nine that Cartwell still exposed on request. The snapshot got all forty right. The live endpoint got thirty four right and six wrong, and every one of the six was a model-synthesis call. Nothing else differed between the two calls but which target answered.

That was the proof. Not a theory. A replay, run twice, that a provider has to accept because they can run it themselves and get the same result.

Old decision, told as a memory of a meeting. When Precedo first integrated Cartwell's API, someone on the platform team pointed out that pointing at "assistant-latest" meant every improvement Cartwell ever shipped would reach Precedo automatically, with zero engineering work on Corwith's side. The room liked that a lot. Nobody in that room was wrong about what it bought them, for two years running.

The replay, run the same window forward with the fix in place: production pinned to the last known good dated snapshot within six hours of the confirmed test, the riskiest synthesis calls routed to a verbatim-quote mode that costs a little fluency but can't misstate a holding it isn't allowed to paraphrase. The eval miss rate is back to one point two percent by the next morning's run.

The thing Sorcha would tell her past self, the one sitting in that integration meeting two years earlier: a provider that ships free upgrades for two years straight isn't proof the upgrades will always be free. It's proof you never once had to find out what happens when one isn't.

TRACE, the five checks that tell you whether it's your code or theirs

This is a diagnosis question wearing an incident-response costume. Something changed, two plausible causes shipped in the same window, and the job is separating them with evidence instead of a hunch, so TRACE fits: rule out, then narrow.

Same forty fact patterns. Same code. Same prompts. The only thing that changed between the two columns is which model answered.

And if you want to be sure it really works, try it somewhere else

Brightwell Goods runs Sagewell, a support-reply drafting assistant built on the same Cartwell "latest" alias, at a company that sells outdoor gear online and has nothing to do with law.

T. Deven Nadeau, who runs support operations, first noticed a run of tickets where Sagewell told customers a ninety day return window applied to a product line with a thirty day exception. The pattern started building two weeks before anyone flagged it, again quietly, again under a Cartwell alias nobody had pinned.
R. Recut by whether the draft needed to combine two policy documents, the standard window and the seasonal exception, against drafts that only needed one document. Single-document miss rate: flat. Combine-document miss rate: climbing, same shape as Precedo's synthesis calls.
A. Brightwell had also shipped its own policy document refresh that same week. Ruled out the same way: replayed the old document set through the same drafts, clean.
C. Worth saying plainly rather than stretching it into something new: the confirmed cause here is the same mechanism as Precedo's, Cartwell's own load-based fallback on the same alias, this time triggered by Cyber Monday afternoon traffic instead of a court filing deadline.
E. Same test. Thirty combine-document questions, pre-verified, replayed against the live alias and a dated snapshot. Snapshot: thirty for thirty. Live: twenty five for thirty, at four in the afternoon on Cyber Monday. Confirmed.

A flow diagram, not a timeline this time, because the point at Brightwell isn't when it started. It's exactly which step in the pipeline the fallback lives inside.

Swap the trigger and it still runs.
Speed: an interviewer caps the answer at ninety seconds. Skip straight to the replay test and the pin, and name the confirmed cause in one line.
Cost: this quarter's API budget gets cut and a nightly shadow eval against a second endpoint isn't affordable every night. Don't cut it to zero. Drop it to twice a week and say so plainly, that's a stated tradeoff, not a silent one, and it still catches a drift before it becomes a near miss.
The model got better, for real, everywhere: suppose Cartwell's change really was a clean, honest improvement with no load-based fallback at all. Pinning is still the right call, because you can't tell a genuine improvement from a genuine regression without running the same replay. You'd promote the new snapshot the moment the golden set confirms it, instead of trusting the changelog's own word for it.

Where people run it wrong.
They call it a provider incident because the timing lines up, without ever replaying the same input against both.
They treat a status page that says "all systems operational" as the final word, when it only means nothing crossed the provider's own bar for public admission, not that nothing changed for you specifically.
They fix it with a warning banner telling people to double check everything, and call the incident closed without ever gating the next model version that reaches production.

How to use it live. Say the reframe before any story: "the point of proving a provider incident is that you're accusing something you don't control, so the bar for saying it out loud is a reproducible replay, not a hunch that lines up with the timing." That buys you the room to actually run the test, instead of reciting "we opened a ticket and we're monitoring closely."

Flashcards (click a card to flip it)

Check yourself Score: 0 / 0