One thing I'd separate out here: not every "AI hallucinated" incident is actually a blame-deficit problem. A chunk of them are just plain CI failures wearing an AI label — code that would have failed the existing test suite if anyone had run it before merging, agent-written or not. That's not a new accountability problem, it's the old "we skipped a step" problem with a new excuse attached. The genuinely new case is narrower: code that passes every existing check, looks completely reasonable on read, and is still wrong in a way that only shows up under load or in an edge case nobody wrote a test for. That's the one where "who approved this diff" actually matters, because there was nothing mechanical left to catch it. Worth splitting those two before deciding how much process to add — the fix for the first one is just enforcing what already exists.