Five marketplace software risk scenarios, from a wrong offer to a vanished supplier

Marketplace seller software risk scenarios are useful only when they produce an observable response. They are not predictions. For the fictional England seller used here, every probability stays blank because no buyer incident denominator or directly comparable external rate has been supplied.

The bounded journey starts with an approved product record and stock state, then keeps order acceptance, payment authorisation, capture, fulfilment, cancellation, return, refund, dispute and settlement separate.

What to take away

Scenario 1: a customer-visible offer is wrong

Buyer scenario. Trigger: the rendered product fact, total price or optional choice differs from the approved record. CMA price-transparency guidance, current at the research date of 6 September 2026, is the UK consumer reference for mandatory fees, taxes and charges.

Owner: consumer-journey lead. Detection: source-to-render comparison and complaint queue. Containment: suppress affected offer, freeze related writes.

Reversal: restore last approved version, then reconcile open orders individually. Stop rule: no republication until a qualified consumer reviewer accepts evidence and correction route. Expiry: retire only after changed configuration passes an authorised fixture and monitoring window set by buyer.

Scenario 2: safety evidence or a product status changes

Buyer scenario. Trigger: a safety owner withdraws approval, a recall or official notice matches the product, or a required traceability field is missing. GOV.UK product-safety advice explains that duties depend on the product and business role.

Owner: product-safety specialist. Detection: approved-source monitoring and identifier match. Containment: block publication and affected fulfilment decisions without erasing records. Reversal: withdraw or correct the offer under specialist direction. Stop rule: software success cannot override a failed safety gate. Expiry: only when the specialist closes the product evidence record.

Scenario 3: an AI system attempts an unauthorised action

Buyer scenario. Trigger: the system tries to publish, alter price or stock, process a refund, message a customer or reach a service outside its allowlist. NCSC's August 2026 interim advice recommends constrained autonomy, monitoring, isolation and emergency shutdown.

Owner: agent risk owner with security lead. Detection: protected action logs and permission alerts. Containment: stop the agent, revoke credentials and isolate its environment.

Reversal: restore the last human-approved state and reconcile every attempted action. Stop rule: no restart while provenance or scope remains unresolved. Expiry: after an independent controlled retest; re-open if formal NCSC guidance supersedes the interim record.

Scenario 4: tracking choices are not honoured

Buyer scenario. Trigger: a non-exempt storage or access operation starts despite the recorded preference, or withdrawal does not propagate. The relevant ICO guidance on storage and access technologies has been final rather than draft since 29 April 2026.

Owner: privacy and PECR adviser. Detection: versioned device-operation test and consent ledger. Containment: disable the disputed operation and associated downstream use. Reversal: correct preferences, restrict affected data and follow the reviewed incident route. Stop rule: marketing or measurement value cannot compensate for a failed privacy gate. Expiry: after the adviser approves evidence for the exact purpose and configuration.

Scenario 5: the integration or supplier becomes unavailable

Buyer scenario. Trigger: repeated rejected events, loss of account authority, an incompatible schema change or inability to obtain an agreed export. NCSC supplier-assurance questions cover governance, access, incident response, continuity and contractual evidence.

Owner: integration lead and procurement owner. Detection: state reconciliation and change notices verified for the exact account. Containment: freeze writes and use the approved manual route. Reversal: reconcile catalogue and every later order state before reconnecting. Stop rule: do not resume if export, rollback or isolated restore fails. Expiry: after a versioned recovery exercise and contract review.

Keep the scenario register live

Each row needs an evidence class, source date, geography, assumptions, indicator, counter-signal, consequence, owner, containment, reversal, stop rule, next check and retirement evidence. Record probability as UNKNOWN, not zero. Qualified consumer, safety, privacy, accessibility, cyber, accounting and AI reviewers must sign their separate gates before publication or production use.

Before you act

Common questions

What should happen when a customer-visible offer is wrong?

Suppress the affected offer and freeze related writes. Restore the last approved version, then reconcile open orders individually. Do not republish until a qualified consumer reviewer accepts the evidence and correction route. Retire only after the changed configuration passes an authorised fixture and the monitoring window set by the buyer.

How should an AI system attempting an unauthorised action be handled?

Stop the agent, revoke credentials and isolate its environment. Restore the last human-approved state and reconcile every attempted action. Do not restart while provenance or scope remains unresolved. Expiry comes after an independent controlled retest; re-open if formal NCSC guidance supersedes the interim record.

What must be done if the integration or supplier becomes unavailable?

Freeze writes and use the approved manual route. Reconcile catalogue and every later order state before reconnecting. Do not resume if export, rollback or isolated restore fails. Expiry comes after a versioned recovery exercise and contract review.