Void or Voidable
Not every default an agent picked without asking needs the same fix. Contract law already drew the line between the ones you reverse and the ones your own silence has already deprioritized.
A team runs an audit of everything its agents decided unattended over the last two quarters and finds forty of them: a retry backoff, a naming convention for a new table, an error code, a tenant-scoping check quietly dropped from one query because it looked slow without it. Forty ghost decisions, each one a default an agent picked because it was the most probable answer, not because anyone with the standing to decide chose it. The team already knows how this happened. What they're stuck on is the next question: forty tickets, one sprint, and not enough hours to treat all forty the same way.
The instinct splits two ways, and both are expensive. Reverse everything, and you rip out defaults that turned out fine, burning a sprint on churn nobody asked for and teaching the team that review findings are noise. Leave everything, because it's been running fine for months, and you leave a quietly loosened security boundary in place for the same reason you left a harmless naming convention in place, which is no reason at all. Neither instinct is actually looking at the forty decisions. It's looking at how tired the team is.
A distinction that isn't about code
Contract law has spent centuries on a version of this exact problem: two agreements can look identical on paper and be in completely different legal positions. The Restatement (Second) of Contracts (American Law Institute, 1981) is one of the most widely cited modern statements of the distinction. A void agreement has no legal effect from the moment it existed. Nothing that happens afterward cures it, not years of both sides acting as if it were binding, because there was never a valid act to begin with, only the appearance of one. A voidable agreement is the opposite shape: it's fully valid and binding unless the party with the standing to object exercises that power. And if that party instead keeps accepting the thing's benefits, keeps operating as though it stands, the law calls that ratification, an affirmative act that converts what could have been avoided into something no longer challengeable at all.
Same surface, opposite structure. One never had force and time cannot give it force. The other already has force, and time, specifically the informed party's choice not to object, is exactly what can make that force permanent.
Applying it to the forty tickets
Every ghost decision shares the same defect on the surface: no one authorized it. That's what makes it a ghost decision, and it's true of all forty, so it can't be what sorts them. The question that actually sorts them is narrower: setting aside that nobody happened to authorize this one, could someone with real standing have legitimately authorized it, if they'd been asked?
A ghost decision is void when the answer is no, not because the right approver was absent, but because the call was never anyone's to make informally at all. The tenant-scoping check the agent dropped is the clean example: this isn't a case of the right person being unavailable to sign off, it's a case where weakening a data boundary this way needs a security review on its own terms, no matter who's asking. No amount of the code running incident-free changes that, because legitimacy here was never a function of elapsed time or of eventually finding the right approver after the fact. These get reversed on discovery, full stop, regardless of age or how much now sits on top of them.
A ghost decision is voidable when the answer is yes: an ordinary call that a person with standing plausibly would have signed off on if asked, and simply wasn't. The retry backoff, the naming convention, most of the ordinary shape-of-the-code calls: reasonable engineers disagree about the right answer, and if the people with standing to weigh in have seen the pattern, in review, in production, repeatedly, for months, and said nothing, that silence is doing the same work ratification does in the doctrine, at least for the question of whether it's worth a sprint to reverse it. It is not the same as the default having become an authorized decision. A decision still requires the actual act, someone with standing choosing it. Ratification by silence answers a narrower question: whether reversing it is worth the churn, not whether it now has the standing of something the team actually decided. If the team wants that too, the fix is cheap, one person with standing affirms it in a line, but it still has to happen; the silence itself doesn't supply it.
The honest limit of the analogy
This is a borrowed framework, not legal advice, and it has real limits stretched this far. Void and voidable, strictly, describe agreements between parties; what's actually happening here is closer to a different corner of the same law: an agent, the term is literally shared, acting without authority on behalf of a principal, and whether that act can be ratified afterward. The Restatement (Third) of Agency covers exactly this, and its rule on which unauthorized acts are even capable of ratification lands on the identical line drawn above: a principal can only ratify an act it could have authorized in the first place. Void-or-voidable is the more legible shorthand for a general audience; agency's ratification doctrine is the more precise citation, and it independently backs the same cut.
Ratification, in either doctrine, usually requires the ratifying party to have known the material facts and had the capacity to object. An engineer scrolling past one more diff in a busy review queue is a much weaker form of informed silence than either doctrine assumes. Treat "voidable, and ratified" as a useful triage frame, not a permission slip to stop looking at what's actually running in production.
What the distinction actually buys a team with forty tickets and one sprint is a real sort, not a mood. The security-relevant defaults get flagged as void and reversed no matter how long they've quietly worked. The ordinary shape-of-the-code defaults get deprioritized, not settled: the team's own months of informed silence are real evidence against spending this sprint's hours reversing one, not proof the checking is finished.
The cheapest fix for the void half never produces those tickets at all. Voidable defaults are supposed to keep defaulting in peace, except at the forks a team has already decided. A void ghost decision is a fork where legitimacy was never available informally: a security boundary, a data guarantee. That kind of fork needs a gate at the point of change, not a default. The edit can't ship without a decision-store entry that has passed admission control, the same property defined for the store, extended to the one class of change where defaulting was never the right call.
Does your team's answer to "how did this default get here" hold up before you ever have to ask which pile it belongs in?
Frequently asked questions
What's the difference between a void and a voidable agreement? A void agreement never had legal effect, and nothing that happens afterward changes that. A voidable agreement is fully valid and binding unless the party with the power to object exercises it; if that party instead keeps accepting its benefits, the law treats that as ratification, which forecloses objecting later.
How do you tell whether a ghost decision is void or voidable? Ask whether anyone with real standing could have legitimately made that call. If the answer is no, a security boundary, a data guarantee, something nobody with authority would have signed off on, it's void and gets reversed regardless of age. If the answer is yes, an ordinary implementation choice a reasonable engineer could have picked, and the team has seen it repeatedly without objecting, it's voidable, and the team's own silence has already answered whether it's worth reversing, though not whether it counts as something the team formally decided.
Why not just review every AI-generated default eventually? Because "eventually" both under-treats the void ones, which stay dangerous for exactly as long as they stay unreviewed, and over-treats the voidable ones, which get flagged as urgent alongside genuine risks and compete for the same limited review time. Sorting by void versus voidable tells a team which of the forty need attention this sprint and which its own conduct has already deprioritized.
Isn't ratification-by-silence a stretch when nobody actually reviewed the code carefully? Yes, and that's the real limit of the analogy, not a reason to discard it. Legal ratification assumes the ratifying party knew the material facts. A rushed review is weaker evidence of informed acceptance than the doctrine assumes, so "voidable, likely ratified" should lower the priority of revisiting a default, not close the question permanently.
← Back to Blog