The plane recognizes six failure classes. Each has a detecting phase, an action at the moment of detection, and a defined recovery path. The taxonomy is closed: a failure the engine does not recognize still fails closed — the step halts, the event records, nothing proceeds by default.
The six classes
| Class | What it is | Detected at | Immediate action | Recovery path |
|---|---|---|---|---|
| Infrastructure | Sandbox provisioning, tool endpoint, engine runtime | Executor | Halt step | Retry within budget, then compensation |
| Model behavior | Invalid proposal, hallucinated parameters, malformed output | Schema gate, verifier | Reject — nothing commits | Critique back-edge, bounded; then escalation |
| Data | Input gap, honest scarcity, unresolvable reference | Hydration, verifier | Halt or attest empty | Data provision via HITL, or gap acceptance |
| Policy | Cedar DENY on a proposed call | Policy Gateway | Halt step | Park with decision attached; no override path |
| Verification | Output fails declared criteria | Verifier | Reject commit | Critique back-edge, bounded; then escalation |
| Budget | Any limit in the hierarchy exhausted | Budget accounting | Terminate the attempt | Escalation ladder, then park |
Detection matrix
What each phase catches on the only path to execution:
| Phase | Catches |
|---|---|
| Hydration | Missing context, unresolvable artifact references |
| Policy Gateway | Disallowed tool calls before they execute |
| Schema gate | Hallucinated tools, invented parameters — no call is made |
| Executor | Infrastructure failure, tool-side error |
| Verifier | Malformed or fabricated outputs before they commit |
| Budget accounting | Unbounded retry, escalation exhaustion, global timeout |
The fail-closed principle
Every gate in the pipeline defaults to halt. An unavailable Policy Gateway means no tool call proceeds; an unrecordable event means no commit; an unrecognized error is still an error. At no point does the engine proceed because a check could not run.
| Condition | Behavior |
|---|---|
| Gateway unreachable | No execution — fail closed |
| Ledger unreachable | No commit — fail closed |
| Error not in the taxonomy | Step halts, event records with the raw error |
| Ambiguous verdict | Treated as fail — critique loop proceeds |
The class most systems miss
Honest scarcity is a data condition, not a failure: a step's input legitimately contains nothing to select. The engine treats the self-attesting empty result as a valid output under the zero-case rule — and the failure model treats the opposite authoring error, criteria that cannot pass on empty, as a deterministic defect surfaced to the circuit breaker, not as a transient condition to retry. Conflating the two is what makes workflows loop forever on missing data; the taxonomy exists so the engine never does.