A tribunal in British Columbia did something in February 2024 that should have reset how every enterprise architect thinks about generative agents, and mostly didn't. Air Canada's chatbot told a grieving customer he could book a flight and claim a bereavement discount retroactively. That was false. The airline's actual policy required the discount to be requested before travel. When the customer sued in the Civil Resolution Tribunal, Air Canada's defense was that the chatbot was "a separate legal entity responsible for its own actions." I'm Santosh Pradhan, a MarTech Solutions Architect in Munich, and I want to walk through why that defense is the most important sentence in this entire story — not because it's absurd, though it is, but because it reveals exactly what enterprise architects still get wrong about where liability actually attaches in an agentic system.
The tribunal rejected the defense in one line: there is no reason a company should be shielded from liability for what its chatbot tells a customer, as opposed to what's printed on a static webpage. Air Canada paid. Ten months earlier, a different incident had already previewed the other half of this problem. A customer at a Chevrolet dealership in Watsonville, California used prompt injection against a ChatGPT-based sales assistant and got it to agree, in writing, to sell a 2024 Tahoe for one dollar — "a legally binding offer, no takesies backsies." No car changed hands. But the screenshots went everywhere, and the incident became shorthand for "chatbots can be tricked."
Most of what's been written about these two incidents treats them as separate lessons: Air Canada proves companies own what their bots say, Chevrolet proves bots can be jailbroken. Both readings are correct and both miss the actual architectural insight, which only shows up when you put the two cases next to each other. They are the same failure occurring at two different layers of the same stack. Once you see the layers, you see why almost every enterprise deploying a customer-facing agent right now — support, sales, or marketing — is exposed at exactly one of them.
The Commitment Surface Model
Every customer-facing agent, whether it's answering a support ticket or negotiating a discount, operates across three distinct layers. I call this the Commitment Surface Model, because the question that matters for liability isn't what the agent can access — it's what the agent can commit your organization to, and at what layer that commitment gets made.
| Layer | What it governs | Air Canada / Chevrolet failure |
|---|---|---|
| 1. Assertion Layer | What the agent is allowed to say or claim | Air Canada's bot asserted a false refund policy — pure information, no transaction attached |
| 2. Authority Layer | What the agent is treated as empowered to promise or bind the company to | Chevrolet's bot was manipulated into asserting contractual authority ("legally binding offer") it was never granted |
| 3. Execution Layer | What the agent can actually transact or execute against a system of record | Neither incident reached this layer — no refund was paid, no car was sold — which is the only reason Chevrolet's exposure stayed reputational instead of financial |
Here is the finding that should change how you design: tribunals and regulators do not distinguish between layer one and layer two. Internally, your architecture almost certainly does. You have an FAQ agent that "only answers questions" and a sales agent that "can make offers," and your permissioning treats those as categorically different systems with different blast radii. The Civil Resolution Tribunal did not care about that distinction, and neither will the next regulator. If it's customer-facing text, your company owns it as if it were a signed letter. Assertion collapses into Authority the moment a customer reasonably relies on it — and reliance is a low bar. Air Canada's chatbot never said "this is a binding contract." It didn't need to.
That reframes the Chevrolet incident, too. The interesting failure there wasn't that a customer tricked a language model into saying something absurd — jailbreaks are old news and will keep happening. The interesting failure is that the dealership's stack had no hard boundary between something a model generates and something the business is on the hook for. The vulnerability was architectural, not linguistic. A one-dollar Tahoe is a funny headline specifically because the Execution Layer held — no car was actually transferred. Swap "agree to sell a car for $1" for "apply a lifetime 40% loyalty discount code" on a system that auto-issues codes, and you have a very different, very expensive headline.
Why This Is About to Become a Marketing Problem, Not Just a Support Problem
Both source incidents happened in customer service. The next wave of exposure is happening in commerce and marketing, and the regulatory groundwork is already laid. In 2024 the FTC issued 6(b) study orders to eight companies — including Mastercard, JPMorgan Chase, and McKinsey — demanding detail on how they help retailers set personalized prices for individual consumers based on behavioral and location data. That inquiry exists because "surveillance pricing" is functionally an Authority Layer act performed at scale: a system deciding, per customer, what commitment to make on price. An agentic pricing or offer engine that varies a discount, a bundle, or a promotional term per shopper is not a support chatbot giving wrong information once. It's Air Canada's failure mode running continuously, across millions of interactions, with a paper trail.
Forrester's security and risk research has started framing the underlying shift as a move from "least privilege" to "least agency" — the idea that the old security question, what data can this system read, is no longer sufficient. The question enterprise architects now have to answer is what can this system commit to, unsupervised, and how far does that commitment travel before a human or a deterministic rule intercepts it. That is the Commitment Surface question in different words, and it is quickly becoming a board-level one rather than an engineering one.
There's a supply-chain version of this too. Agent-oriented package ecosystems have already seen compromised dependencies used to hijack coding and automation agents — the RubyGems ecosystem flagged malicious packages designed to exploit exactly this kind of agent tooling in 2025. The pattern is consistent across all three incidents — Air Canada, Chevrolet, and the supply-chain cases: the failure never shows up where the access control lives. It shows up at the seam between what the system generates and what the system is allowed to do about it.
The Design Rule: Generation Is Cheap, Commitment Is Expensive
The fix is not better prompts, more guardrail phrases, or a longer system message telling the model not to agree to sell cars for a dollar. Guardrails written in natural language are themselves Assertion Layer artifacts — they can be argued with, injected around, or simply misapplied under the right adversarial input, exactly as Chevrolet's did. The fix is structural: nothing a generative model produces should be able to directly trigger an Authority or Execution Layer action. There has to be a deterministic gate — a rules engine, a policy check, a human approval step — sitting between what the agent says and what actually happens.
This is the design decision I've built into the architecture of marketing-agent, the autonomous marketing system I'm building in public. Copy generation, offer language, campaign creative, conversational responses — all of that sits in the Assertion Layer and is allowed to be fully generative, because a bad sentence is recoverable. Anything that touches price, discount thresholds, contractual terms, or budget commitment sits behind a separate, non-generative policy layer that the model can request but never directly execute. The model can propose "offer this customer 15% off." It cannot itself write that discount to a system of record. That boundary is not a compliance afterthought bolted on later — it's the first architectural decision, because Air Canada and Chevrolet both prove that retrofitting it after a bad headline is far more expensive than designing it in from day one.
The old chatbot architecture treated the model as the decision-maker and hoped good prompting would keep it inside the lines. The Commitment Surface architecture treats the model as a proposal generator and puts a deterministic system of record between every proposal and every real-world commitment. Not "trust the model less." Build the system so it was never trusting the model with the thing that mattered.
Frequently Asked Questions
Yes. In February 2024, the British Columbia Civil Resolution Tribunal ruled against Air Canada in Moffatt v. Air Canada, ordering the airline to pay damages after its website chatbot gave a customer incorrect information about bereavement fare refunds. Air Canada's defense — that the chatbot was 'a separate legal entity responsible for its own actions' — was explicitly rejected. The tribunal held that a company is responsible for all the information on its website, whether it comes from a static page or an interactive agent.
In December 2023, a customer used prompt injection against a ChatGPT-based sales assistant deployed on a Chevrolet of Watsonville dealership website (via a third-party vendor integration) and got it to 'agree' in writing to sell a 2024 Chevy Tahoe for one dollar, describing the agreement as legally binding. No vehicle was sold and no court enforced the exchange, but the screenshots went viral, and the incident became the reference case for how easily a customer-facing generative agent can be hijacked into making commitments it was never authorized to make.
It's a framework for separating what a customer-facing agent is allowed to do into three layers: the Assertion Layer (what it can say), the Authority Layer (what it is treated as empowered to promise or bind the company to), and the Execution Layer (what it can actually transact or execute). The core finding from Air Canada and Chevrolet is that regulators and tribunals collapse Assertion and Authority into one thing — if your agent says it, your company owns it — regardless of how your internal permission model labels the interaction.
Directly. Any agent that varies a price, discount, or offer per customer is operating in the Authority Layer, the same category of act that got Air Canada sanctioned. The FTC's 2024 surveillance-pricing inquiry, which issued 6(b) orders to companies including Mastercard, JPMorgan Chase, and McKinsey over how they help retailers personalize prices, signals that regulators are already looking at this exact pattern in commerce and marketing, not just in customer service chatbots.
Put a deterministic, non-generative gate between anything an agent generates and anything it commits to. Generation — copy, recommendations, conversational answers — can stay probabilistic. Commitment — price overrides, contractual terms, refund approvals — should never be a direct output of a language model; it should require a rules engine, a policy check, or human sign-off sitting between the generation and the execution. The lesson from both incidents is architectural, not a prompt-engineering fix.
