Design systems to fail safely by default.
Assume incorrect outputs will occur and plan containment accordingly.
Contents 9. AI-Mediated Interaction 6. Graceful Failure
What happens when intelligence breaks.
First, ask yourself
“Does your system behave responsibly when intelligence fails?”
Mission statement
Ensure users recover from system limitations by degrading safely without abrupt breakdown.
Key heuristics Graceful Failure
- Systems must assume incorrect outputs will occur and default to safe containment.
- Failures must remain within controlled boundaries.
- Uncertain actions must be declined, not executed unreliably.
- Uncertainty, refusal, or degraded performance must be clearly communicated.
- Autonomous action must decrease as uncertainty increases.
- High-impact capabilities must be restricted when reliability drops.
- Conservative modes or human oversight must activate under failure conditions.
- User data and task continuity must remain intact during failure events.
- Systems must support correction, override, or safe continuation after failure.
Executive brief
AI systems must behave responsibly even when intelligence fails.
Core questions Graceful Failure
“When intelligence fails, does the system remain safe, controlled, and accountable?”
“Can users rely on it even when intelligence is degraded?”
Focus areas
Safety-first
“What happens when the model is uncertain or incorrect?”
“Does failure reduce harm, or could it make things worse?”
Control-first
“Does the system defer to human control when needed?”
“Are risky actions blocked when confidence drops?”
Transparency-first
“Is failure visible and acknowledged?”
“Does the system admit its limits instead of improvising?”
AI-aware
“Are model errors clearly communicated to users?”
“Does intelligent behavior stay predictable and bounded even under failure?”
UX directives Graceful Failure
Contain failure within controlled boundaries.
Prevent cascading or system-wide consequences.
Implement conservative refusal policies.
Decline uncertain actions rather than generate unreliable outputs.
Communicate failure transparently.
Clearly indicate uncertainty, refusal, or degraded performance.
Increase restraint as uncertainty rises.
Reduce autonomous action under low confidence.
Restrict high-impact capabilities when reliability drops.
Align action permissions with certainty levels.
Provide explicit, safe fallback paths.
Activate conservative modes or human oversight when failure conditions arise.
Protect user progress during failure events.
Ensure data and task continuity remain intact.
Enable structured recovery after failure.
Support correction, override, or safe continuation.
Executive summary
- Graceful Failure is controlled degradation, not uncontrolled breakdown.
- It assumes error and uncertainty as normal conditions and plans containment in advance.
- The system must restrict, refuse, or reduce action as reliability declines.
- Failure states must be transparent, bounded, and aligned with consequence severity.
- User progress and data must remain protected during degraded operation.
- Graceful Failure succeeds when incorrect or uncertain outcomes are contained without cascading harm or loss of trust.
Success indicators
- The system limits harm when errors occur.
- Failures are contained and do not spread across the system.
- The system clearly communicates when it cannot complete a task.
- Uncertain situations lead to conservative or safe system behavior.
- Users can recover and continue work after a failure.
One-line summary
Before intelligence can be trusted, failure must be survivable.