Failure Propagation and Circuit Breaking in Agent Networks

Failure propagation and circuit breaking in agent networks involve both reasoning and service availability. A network can keep answering requests while it spreads a corrupted premise. To contain that failure, controls must check reasoning, follow dependencies, and enforce policy, with a runtime that can keep state and stop work cleanly.

Why agent networks fail differently from distributed systems

In a conventional microservice mesh, a service that returns a 5xx response or drops a connection makes its failure visible. A health check or circuit breaker can recognize that signal without understanding the work the service was doing. An agent can instead return HTTP 200 with coherent-sounding text built on a false premise. If a downstream agent accepts that text as ground truth, the request has succeeded mechanically while failing semantically. The next agent then reasons from the unreported mistake.

The distinction is between a broken connection and a corrupted assumption. Network telemetry can show that a message arrived, but that alone cannot show whether the text it carries is true. Narayanan and Nagaraj (2026) formalize this dependency problem as a directed graph in which validation failures propagate to reachable descendants. They call this class of risk “Agency Risk” and argue that existing model risk management frameworks cannot quantify it structurally. The unit of concern is therefore not just the individual model, but the reasoning graph that connects agents.

How errors compound as they travel through an agent network

Narayanan and Nagaraj (2026) illustrate the stakes with a 17-agent inventory in which a single Tier 1 failure blocks exactly its transitive descendant set while leaving unrelated branches operational. These descendants are the agents reachable downstream through the graph’s dependencies. Architecture makes the reach of a failure computable.

Each downstream agent reasons from the corrupted premise and draws more inferences that seem sound. In an unstructured “bag of agents,” one output becomes another input without a topology designed to contain that transfer. Errors can therefore accumulate. Better models can improve each step’s chance of success, but they do not remove the compound effect of chaining many steps together.

In a semantic retry loop, an agent rephrases and retries instead of raising an exception, producing thousands of inference calls that return 200 OK while billing continues. Circular delegation creates a related trap when Agent A delegates to Agent B, which delegates to Agent C, which sends slightly rephrased instructions back to Agent A. The conversation keeps moving, but the work has no deterministic exit.

The graph is not the only route through which the damage travels. Stellar Cyber’s late-2026 threat analysis describes how poisoned long-term memory makes agents recall and act on corrupted beliefs in later sessions, days or weeks after the first injection. Here, memory carries the premise across time rather than a message carrying it across an immediate dependency. That persistence means an incident’s visible execution is not necessarily its full scope. Containment must account for what agents retain as well as what they send.

Why classical circuit breakers cannot see these failures

The standard circuit breaker moves through Closed, Open, and Half-Open states in response to signals such as 5xx responses, connection timeouts, or explicit exceptions. While closed, it passes traffic until those signals justify interruption. But a semantic failure loop can complete every inference request successfully. The breaker remains closed because the event it was built to detect has not occurred. This mismatch between the signal and the failure leaves a continuing need for infrastructure protection.

Consider the information that the transport layer cannot distinguish. Repeated actions with the same semantic intent can look like ordinary retries. A rise in the ratio of reasoning tokens to actionable tool calls can show context bloat, but infrastructure-layer breakers do not track that ratio. A hallucination passed downstream as authoritative context can arrive as well-formed JSON. In each case, the message’s mechanical validity conceals a problem with its meaning or purpose.

A single risk threshold also cannot cover every rule for containment. Narayanan and Nagaraj (2026) deliberately separate the blocking condition in their governance framework from an agent’s inherent risk tier, so a high-tier agent is not quarantined merely for being high-tier. Without that distinction and visibility into reasoning, teams may discover trouble only through billing alerts or lagging business metrics. A control that can interrupt semantic failure must monitor the layer where that failure occurs.

The agent-native controls that can actually detect and contain failure

Narayanan and Nagaraj (2026) propose a Trajectory Monitoring protocol that measures distributional cosine drift across ensembled reasoning-trace embeddings against a certified “Golden Path” baseline. A calibrated threshold flags excessive drift before the output reaches downstream agents. This supplies a signal that a successful HTTP response cannot provide.

Yet a different reasoning path is not automatically a harmful one. Narayanan and Nagaraj (2026) use matched-bootstrap calibration because a naive half-split produces a severe false-positive artifact for healthy high-tier agents. Calibration matters because a monitor that flags legitimate variation can obstruct useful work. Their two-stage response distinguishes that variation from detrimental drift, so a single threshold exceedance does not trigger irreversible quarantine.

Narayanan and Nagaraj (2026) use a Composite Risk Propagation algorithm that treats the inventory as a Directed Acyclic Graph. When an upstream agent fails validation, risk penalties propagate to exactly its transitive descendant set while sibling branches continue operating. The boundary follows from the graph’s construction rather than penalty tuning, making it auditable and reproducible. The 2026 Singapore Consensus recommends threat modelling of error transmission and feedback loops, with system-wide controls calibrated to compounding failures, and graph-aware propagation gives that guidance a concrete mechanism.

Policy controls address a different blindspot, which is the authority an agent exercises while its requests remain technically valid. The 2026 Singapore Consensus names Least Privilege as Principle 1, limiting permissions to the current task and making them revocable when that task ends. Hard limits on delegation depth cut off circular delegation by bounding how many hops authority can travel. Validating every sensitive tool invocation against policy-as-code makes the policy layer, rather than the agent, the authorization boundary. A compromised agent therefore cannot give itself access to more tools in the middle of a task.

The 2026 Singapore Consensus names Interruptibility as Principle 8, requiring work to pause and resume cleanly so a human or automated monitor can stop runaway work without corrupting durable state. Interruptibility must be designed into deployment before an emergency occurs. The execution model must make the control’s decision possible to carry out.

How durable execution and structured topology reduce the failure surface before controls are needed

The controls above form a second line of defense, while topology and execution choices form the first. An unstructured network creates more containment work by letting outputs become inputs without clear boundaries. A structured pattern instead gives a single orchestrator the full conversation context and uses ephemeral, isolated subagents that return only compressed summaries. That arrangement limits propagation through the network’s design. Every summary still needs to be checked for correctness, so reasoning-level controls are still needed.

Structured topologies show a saturation threshold beyond which coordination gains level off and coordination overhead grows faster than what the network can do. At that point, more dependencies further reduce reliability as failures compound. Narayanan and Nagaraj (2026) also address quasi-cyclic architectures, where nominally acyclic graphs develop latent feedback loops. Their two-pass execution structure runs validation before risk propagation, so it catches cycles before they complete.

Durable execution tackles a separate source of failure, which is losing the state of work already done. Treating agent steps as persistent, fault-tolerant state machines lets tasks running for hours survive crashes, timeouts, and redeploys without restarting from the beginning. This avoids partial executions that leave upstream outputs orphaned and downstream agents in an undefined state. The agent’s append-only message log is its state, so persisting that log supports recovery, session resumption, and post-incident forensics. Losing it can mean replaying potentially dangerous actions simply to reconstruct context.

That persistence also provides the foundation for interruptibility. With clean checkpointing, the execution substrate can keep the point where work stopped so it can resume from there. But preserving state is not the same as preserving truth, especially when long-term memory can contain poisoned or outdated information. Memory lifecycle management must expire stale facts and update records when new evidence changes their validity. The 2026 Singapore Consensus addresses this through Auditability, Principle 3, requiring traceable records of what entered memory, when it entered, and where it came from, so poisoning can be scoped and reversed.

What governance and observability infrastructure must accompany these controls at the network level

A containment graph is useful only if it reflects the network actually running. Narayanan and Nagaraj (2026) propose Inventory-as-Code, a continuously validated inventory with four phases, namely registration, scoring, propagation, and quarantine. Adding or modifying an agent triggers automated re-evaluation of downstream risk without waiting for a manual audit. Their Degree of Autonomy materiality score assigns tiers using tool complexity and action scope, with a proof that tool breadth alone cannot inflate an agent’s tier.

That living inventory needs both enforcement and a view operators can understand. The 2026 Singapore Consensus separates Runtime Assurance, Principle 7, from Legibility, Principle 9. Runtime Assurance requires continuous enforcement of safety constraints, while Legibility requires enough understanding of the system’s actions and reasons to intervene meaningfully. A complete action log is not sufficient if nobody can interpret it before the failure spreads. Traceable Identity, Principle 2, adds attribution to a specific agent instance with known provenance, giving forensic reconstruction a firmer basis than guesswork.

The 2026 Singapore Consensus treats Human Oversight, Principle 10, as a designed-in control point, with explicit approval before high-risk or ambiguous actions execute. In a human-in-the-loop approval pattern, the agent identifies an issue and proposes a fix with evidence, a human approves it, and the agent executes. The runtime must be able to pause, present that decision, and resume without losing task state.

These requirements make the runtime layer the natural place to attach network-wide controls. A purpose-built agent operating system separates agent logic from runtime concerns, including orchestration, sandboxing, state management, and credentials. That separation lets trajectory monitoring, policy enforcement, quarantine propagation, and durable checkpointing operate consistently across a heterogeneous network. Embedding containment separately inside each agent instead recreates the “bag of agents” problem at the governance layer, with local policies but no shared ground truth or reliable graph-wide quarantine signal. A runtime designed from first principles for agents gives the network a common place to recognize semantic failure, bound its reach, and stop it without losing the work that remains sound.