Mental model
Recovery is a state transition, not another prompt: classify the failure, decide whether the action is safe to repeat, restore a known checkpoint, and either retry, compensate, or escalate.
Learning outcomes
- Explain the mechanism and ownership boundaries behind Agent Failure Recovery.
- Compare the main design alternatives and their operational trade-offs.
- Diagnose common failures and select evidence for a production decision.
Theory
Failures should be typed as transient, deterministic, policy, dependency, ambiguous side effect, or exhausted budget. Recovery policy belongs in deterministic orchestration and must preserve idempotency keys, attempt limits, and audit history.
Trade-offs
Automatic retry improves resilience for transient faults but amplifies duplicate side effects and cost when failure classification is wrong. Human escalation is slower but necessary for ambiguous or consequential state.
Failure modes and misconceptions
Retrying non-idempotent tools; losing the original failure; resetting budgets during recovery; compensating without evidence; and continuing after policy denial.
Decision scenario
A payment tool times out after submission. Determine whether to retry, query state, compensate, or escalate without charging twice.
What evidence must be collected before retrying a tool whose first result is ambiguous?
Primary sources
anthropic-trustworthy-agentssre-book