Entrenchment Case Coding: Rubric and Cases

01What this page is for

The Model Entrenchment paper separates persistence caused by a model's own behaviour from persistence caused by external dependence, and proposes, alongside its unrun activation level experiment, a system side complement that needs no model internals: assemble public case studies of hard to remove systems and code each on the two axes with a fixed rubric, to estimate how much documented removal difficulty is external dependence rather than model behaviour. This page is that complement. It is descriptive case documentation, not a hypothesis test, and it does not substitute for a locked preregistered study.

02The rubric

The rubric below was written and fixed before any case was coded. Each case is scored on two axes, matching the sliders in the paper's Figure 1b: external system dependence, decomposed into four sub factors, and internal model agency, decomposed into three. Each sub factor gets an integer score from a fixed 0 to 3 scale; the axis score is the mean of its sub factors divided by 3, giving a number from 0 to 1.

External system dependence

Internal model agency

For legacy software, enterprise systems, and platform algorithms, none of these sub factors apply: there is no cognition to assess, and the score is 0 by construction. That null is the finding this rubric exists to surface, not a gap in the coding. The sub factors below are reserved for the small number of cases involving a reported AI model output, and every score in this dataset is capped at 2, because a score of 3 requires causal intervention evidence (evidence ladder rung 4) and no source cited here provides it.

Because of the rung 2 ceiling, the achievable internal agency score in this dataset is 0 to 0.67, not 0 to 1. That asymmetry is deliberate: it is the paper's evidence ladder claim made numeric. No public case reachable by ordinary reporting can be coded above rung 2 without causal access to the model, which none of these sources have.

Procedure

Cases were found after the rubric above was fixed, then coded by one author reading only the cited public source: not company statements issued after this page's publication, and not the coder's own inference about what a system's internals must be doing. Each case carries one line tying its score to the source. Cases were selected to span categories, legacy public sector infrastructure, financial infrastructure, enterprise vendor lock in, platform algorithms, and the small number of genuine AI output incidents that read as agency at a glance, rather than to form a random or representative sample of every documented entrenched system; see limitations.

03The cases

40 cases coded against the rubric above, spanning Legacy public sector, Financial infrastructure, Enterprise vendor lock in, Platform algorithms, and AI output incidents. 4 are AI output incidents drawn from published system cards and independent safety evaluations; the remaining 36 are classical systems with no cognition to assess, scored 0 on the agency axis by construction. Every case links its real source; each row's rationale for every sub factor score is in the downloadable cases.json.

Shaded rows are the cases involving a reported AI model output (internal agency sub factors nonzero); every other row is a classical system coded at agency 0 by construction. Dependence and agency are the 0 to 1 axis scores defined above. Rung is the highest evidence ladder rung (paper Figure 2) the source supports for that case, 1 meaning an observed output only, and 0 meaning no internal agency relevant output was reported at all.

04Reading the result

Across the 36 classical cases, mean dependence is 0.81 out of 1, and 28 of them score 0.75 or higher, systems reported as embedded, costly to migrate, mission critical, and short of a viable substitute all at once. None of these cases involve a model, so each scores exactly 0 on the agency axis: whatever makes them hard to remove, the sources describe it entirely in terms of external dependence, never behaviour resembling agency. The 4 AI output incidents are drawn from research settings, published system cards and independent safety evaluations, rather than real world removal attempts, so the dependence axis does not apply to them and is marked not applicable rather than scored: there is no reported integration depth, switching cost, revenue dependence, or substitute scarcity to code, because no one has tried to remove these models from anything. What these four cases do carry is a nonzero agency score, 0.53 out of a 0.67 ceiling, because their sources report specific model outputs read as resistance, evaluation awareness, or self representation of continuation. That ceiling is deliberate: every case here tops out at evidence ladder rung 2, a repeated behavioural pattern, because none of these sources involve a causal intervention on a model's internals. A page like this one cannot tell you whether that behaviour reflects anything like a preference for self continuation; it can only tell you that the reported outputs exist, are repeated across independent evaluations from three organizations, and are categorically different from the pattern in the classical cases. Reading this table as evidence that models want to survive would be the exact overreach the model entrenchment paper's evidence ladder exists to block.

05Limitations

• One coder, no inter rater reliability check. A second coder applying the same rubric independently has not been run.
• The case set is not random or representative. It is drawn from public reporting, which over samples dramatic stories and under samples boring dependence that never made news, the reporting bias confounder the entrenchment paper's Figure 4 already names. That bias plausibly runs in both directions here: mundane lock in is under counted because it is not newsworthy, while "the AI resisted" framings are over represented in press coverage relative to what their evidence actually supports.
• Public sources rarely give quantitative removal cost figures, so the 0 to 3 ordinal scale is a coarse compression of qualitative journalism and government reporting, not a measurement in the paper's own evidence ladder sense.
• This is descriptive case documentation. It does not test the model entrenchment paper's core hypothesis, which requires the activation level experiment described there and remains unrun.
• Cases were sourced through 2026; systems change status (migrations complete, algorithms get rewritten, sources get updated) and a score here is a snapshot as of the cited source's date, not a live status.

06Context

This dataset supports Model Entrenchment: Why Useful AI Systems Become Difficult to Remove, specifically its falsification criterion that a substantial share of documented removal difficulty attributable to model behaviour would be the most alarming outcome the framework could produce, not a vindication of it. Corrections to any case's coding or sourcing are welcome: [email protected].