https://andreasnissen.dev/tags/safety-controls/Recent content in Safety Controls on Andreas NissenHugoen-us© Andreas Nissenhttps://andreasnissen.dev/projects/safe-model-failover-learning-lab/Mon, 01 Jan 0001 00:00:00 +0000https://andreasnissen.dev/projects/safe-model-failover-learning-lab/<h2 id="the-problem">The problem</h2> <p>Model outages are not one failure mode. A 429 can signal quota or rate-limit pressure, while a 503 can signal temporary service or regional capacity. Immediate retries can amplify an outage, and an improvised fallback can silently change safety behavior, output shape, data residency, or tool access.</p> <p>For tool-using agents, retrying is more consequential still. A tool may already have changed state before the model call failed. Replaying that work without an idempotency key or execution ledger can duplicate an email, transaction, or other side effect.</p>