New paper exposes risk gaps in AI-native engineering teams

A new paper from arXiv (2607.01421) by Laxmipriya Ganesh Iyer tackles a growing problem: how to manage risk when engineering teams deploy agentic AI systems that act autonomously. Traditional software risk frameworks assume deterministic behavior, discrete change events, and clear ownership — but agentic systems violate all three. Outputs are probabilistic, actions are multi-step and autonomous, and the risk surface mutates silently between deployments. The paper proposes a risk architecture framework tailored to AI-native teams, introducing a seven-dimension profile to classify teams as pure software engineering, hybrid, or AI-native. It also defines a six-cluster failure-mode taxonomy, including a previously unarticulated cluster called 'dependency-boundary determinism mismatch' — where probabilistic AI outputs are consumed by systems expecting deterministic behavior.

Using a synthetic framework-adequacy methodology, the paper scores how well each team profile's risk architecture can detect, contain, and escalate failures. The findings are stark: coverage degrades as teams move from pure software engineering to AI-native operation — monotonically in the median and abruptly in the number of uncovered high-consequence failures. The most severe, least-covered failures don't arise inside AI-native teams themselves, but at the organizational boundary where their probabilistic outputs hit deterministic dependencies. This means engineering managers need new escalation structures and decision rights that account for cross-team risk handoffs. The paper provides a concrete playbook for identifying these gaps before they become incidents.