Graceful Degradation Paths

Define what happens when confidence is low, tools fail, or policy blocks the response - before it happens in production. A workflow without explicit failure edges fails in whatever way the model improvises that day.

The Degradation Ladder

1. Retry safe nodes - transient failures (timeouts, throttling) on read-only steps retry with backoff; side-effect nodes only retry with idempotency keys.
2. Switch to a backup model - if the primary tier is throttled or degraded, route to a designated equivalent (defined in your model equivalence map, not chosen ad hoc).
3. Degrade the feature - return cached or partial results with an explicit "reduced mode" marker rather than nothing.
4. Escalate to human - generate a handoff summary with evidence links, state so far, and the specific reason for escalation.

Escalation Triggers Worth Encoding

What a Good Handoff Contains

{
  "reason": "confidence 0.62 < 0.80 threshold",
  "work_completed": ["classified: legal?", "retrieved 4 policy chunks"],
  "evidence": ["kb:policy-sec-17#chunk3", "trace:8f3a"],
  "suggested_next": "confirm category, then re-enter flow at node 3"
}

The human continues the work instead of restarting it - that is the difference between escalation and abandonment.