AG08:2026 — Cascading Failures

Slide 22 · How the Defenses Layer

Three zones of defense — each handling failures that escaped the previous zone.

Zone 1 — Failure Detection (catch it before it leaves the agent)

MIT01 — Output validation: The first line of defense. Checks every agent's output against its contract before the data enters any downstream channel. Catches silent errors, schema violations, and unknown fields at the point of origin.

MIT08 — Health monitoring: Provides the real-time visibility layer that triggers circuit breakers and alerts. A validation failure that isn't monitored is a failure that goes unnoticed for longer than it should.

A failure caught in Zone 1 stays in the agent that produced it and does not propagate.

Zone 2 — Failure Containment (stop it from spreading)

MIT02 — Circuit breakers: When a failure escapes Zone 1 (or is detected by monitoring), the circuit breaker opens — routing requests to fallback instead of continuing to send them to the failing agent. Prevents cascades from extending further.

MIT03 — Graceful degradation: The fallback behavior that the circuit breaker routes to. Without a defined fallback, an open circuit simply causes the downstream agent to also fail — converting isolation into another cascade.

MIT04 — Exponential backoff with jitter: Prevents retry storms from overwhelming recovering dependencies. Works with circuit breakers (which handle the "stop sending requests" part) and fallbacks (which handle "while we wait").

MIT05 — Bulkhead isolation: Prevents resource exhaustion from spreading between agents. One agent's overload stays in its own resource pool.

A failure contained in Zone 2 does not reach the terminal action agents and does not produce real-world harm.

Zone 3 — Blast Radius Limitation (limit harm when it reaches the end)

MIT06 — Rate limiting + human confirmation: If a cascaded error reaches the terminal action agents, rate limiting reduces the number of actions taken per unit time — giving detection a chance to intervene. Human confirmation for bulk actions ensures the most consequential operations don't execute automatically.

MIT07 — Idempotency: When retry storms or pipeline recovery cause duplicate executions, idempotency ensures that only the first execution produces a real-world effect.

MIT09 — Chaos testing: Verifies that Zones 1, 2, and 3 all actually function as designed under realistic conditions — before a real cascade tests them first.

Minimum viable set: MIT01 + MIT02 + MIT03 + MIT06 — detection, circuit breaking, fallback, and blast radius cap. These four address every failure pattern in this module.

← Back Mitigation matrix →