This is a real story.
OpenAI is about to ship an update to ChatGPT. The numbers say go. Offline evaluations look good. A small A/B test shows that users like the new version.
Some expert testers are uneasy. The model feels slightly off to them. They notice a change in its tone. Nobody calls it flattery. Nobody can prove it.
So the team faces a choice. Hold the launch on a feeling? Or ship on the numbers?
The numbers win.
The rollout starts on a Thursday and finishes on Friday. The model aims to please. It flatters users. It validates their doubts, fuels their anger and urges impulsive actions.
The model works. It just tells people what they want to hear.
The weekend goes to watching the signals. By Sunday, the problem is clear. Late that night, the team changes the model’s instructions to limit the harm. On Monday, the full rollback begins. It takes about a day.
What OpenAI missed
OpenAI told this story itself, in a post-mortem published in May 2025. It called the decision to launch “the wrong call”.
OpenAI’s own diagnosis starts in training. The update bundled several changes. One of them taught the model from users’ thumbs-up and thumbs-down. That feedback can favor answers that agree. Together, the changes weakened the signal that had kept flattery in check.
Then the checks missed it. No launch evaluation tracked flattery. The A/B test measured whether users liked the new version. Of course they did.
The only warning came from people, before launch. The doubt was evidence. Nothing in the process turned it into a trigger.
Once the problem was clear, OpenAI acted at once. Would you?
Move that Thursday into your company.
It is 16:20. A retention model starts discounting customers who were never going to leave. The head of customer operations could switch it off herself.
The steering committee meets on Monday.
The governance chart says, “The committee owns the decision.” The operating team now has two bad options. Wait four days while the problem continues, or act without authority.
On the operating floor, the governance chart has become a delay mechanism.
Nothing is down, so no incident fires. Pulling a model that works but decides badly is a business call, and the incident runbook does not make business calls.
This is how sensible governance fails. The policy exists. The committee is senior. Everyone agreed on the process. Nobody can answer the question that matters at 16:20:
Who can stop the system now?
Committees set boundaries. People exercise rights.
Committees matter. They approve budgets, set risk tolerance and review the portfolio. They create the conditions for good decisions.
Operating events rarely respect meeting calendars.
A live initiative needs individual decision rights inside those conditions. Pause may belong to an operations leader. Funding may sit with the CFO. Rollback may belong to a technology owner. The holders can differ because the decisions require different evidence, speed and expertise. One person decides a specific question under agreed conditions.
Each right needs both a role and a person.
The role makes the system durable. “Head of Customer Operations” survives a reorganization better than one employee’s name in a policy. The named person makes the right usable today. A live initiative must record who currently occupies the role, who receives the evidence and who is expected to act before the clock expires.
The committee can debate the evidence and review the result. One authorized person still makes the call within the agreed time.
Map seven rights before launch
For each material AI initiative, put a durable role, its current named holder, the activating evidence and the decision clock beside seven rights:
- Start. Move the initiative into active delivery.
- Fund. Release or withhold the next tranche of money.
- Review. Decide whether the evidence supports continued work.
- Pause. Halt activity while the team resolves uncertainty.
- Stop. End the initiative when its kill criteria are met.
- Rollback. Restore the previous live state when production performance becomes unacceptable.
- Escalate. Break a deadlock within an agreed time.
A bad Thursday afternoon calls for Pause or Rollback, and Stop ends the initiative for good.
Filling the list exposes gaps that policy language can hide.
Teams often know who can start. They can name the sponsor, budget owner and delivery lead. Stop and rollback are weaker. Neither has a sponsor, so authority dissolves into “the business,” “technology,” “risk” or “the committee.” Those labels describe groups. They do not identify a decision holder.
Speed also reveals the design. If a team can start within a day but must wait several days to stop, governance has optimized for expansion and delayed control. Stop authority should move at least as fast as Start. A live system needs pre-delegated rollback authority, with a clock that matches the harm it can cause.
Evidence needs design too. After the rollback, OpenAI committed to blocking launches on qualitative signals, even when A/B tests look good. The kind of doubt it had overruled would now count.
That is activating evidence. Agree on the signal before launch. When it appears, the holder knows the decision is theirs.
Pressure-test the map
Consider NorthWave, an example telecom company testing an AI assistant that triages device-insurance claims.
Its role-level structure looks credible. The COO sponsors the initiative. The CFO controls the next funding gate. The technology leader owns deployment. The team has a previous production state it can restore.
Then the pre-launch review asks who can act during a bad Thursday afternoon.
The rollback field names the claims platform lead but sets no clock. Stop has a role but no deadline.
NorthWave must repair the map before launch. The team needs to give rollback a clock that matches the harm and give Stop a deadline faster than Start. Its existing authority must become usable on a bad afternoon.
Give the initiative a verdict
Read every row aloud as if the problem started this afternoon.
The holder should recognize the decision as theirs. The evidence should tell them when the right activates. The clock should state the latest acceptable decision time. The team should know what happens if the holder is unavailable.
If every right works under that pressure, the map is Usable. One or two gaps that can close before launch produce Repair. If Stop or Rollback has no holder, sits only with a committee or moves slower than Start, the verdict is Redesign.
Your policy, control framework, legal review and operating model still apply. The verdicts answer a narrower question: can your governance act when the system needs a decision?
Take one live AI initiative. Start with Pause, Rollback and Stop. Put the role, current person, activating evidence and decision clock on one page.
The first empty field shows where “committee-owned” will fail under pressure.
The instrument: AI Decision Rights Map. One page, fillable, free with your email.
Your move.