Rethinking liability for autonomous vehicle risk management