The Deadlock

When a governance Deadlock freezes portions of the New York municipal grid, all eyes turn to the usual suspect: a non-compliant vendor. Yet every supplier looks pristine on paper—ISO badges, questionnaire scores, annual attestations all in order—even as automation begins to choke off services people quietly assume will always be there. As outages deepen, Rose pushes a fundamental shift in perspective. Instead of treating vendors as a separate category, she pilots All-Entity Risk Management (AERM), viewing every internal system, external partner, and AI agent as nodes in a single living risk graph. By scoring behavior in real time rather than relying on static vendor scorecards, the team isolates a “patient zero” node whose instability is propagating toward a neonatal ICU half a world away. Aaron is forced into a rare manual override, proving that resilience sometimes means breaking the rules the system was designed to follow. The chapter marks the move from fortress-style third-party risk to ecosystem-level sensing, where resilience is measured in how fast the graph can detect and contain drift.