The concept comes from resilient distributed systems, but agent workflows add new trip signals such as repeated policy denial, runaway token spend, unsafe output, or an unexpected volume of external actions. The NIST AI Agent Standards Initiative provides the broader secure-operation context for controls that contain agent failures.
How does an agent circuit breaker work?
In the closed state, approved calls proceed and the breaker records outcomes. When failures cross a threshold within a defined window, it moves to open and blocks more attempts. After a cooldown, a half-open state permits a small health probe. Success can close the breaker; failure opens it again. A circuit breaker contains repetition before repetition becomes an incident.
The breaker belongs outside the model loop. A model that is already repeating a failed action should not decide whether the repetition is still safe.
What signals should trip the breaker?
Useful signals include consecutive tool failures, high error rates, repeated agent timeout events, policy violations, cost spikes, and unhealthy dependencies. Thresholds should reflect the effect being protected. One failed read may be harmless, while one unauthorized payment attempt may require an immediate stop. Trip conditions must measure business and safety impact, not only HTTP errors.
Avoid a single global threshold for every tool. A payment adapter, search API, and internal cache have different consequences, retry behavior, and recovery evidence.
How does it interact with retries and recovery?
An agent retry policy decides whether and when a failed operation may run again. The circuit breaker overrides that permission when the system appears unhealthy. Once open, it should return a structured failure that routes the workflow into fallback, escalation, or agent recovery. Retries handle isolated failure; the breaker handles a pattern.
The half-open probe should be narrow and safe. It should not replay the entire customer action merely to discover whether a dependency recovered.
How is a circuit breaker different from a kill switch?
An agent kill switch is a direct operator control for emergencies or uncertain situations. A circuit breaker is automatic and governed by predefined signals. Teams usually need both: automation for known failure patterns and human authority for events the metrics did not anticipate. Automatic reopening should require positive recovery evidence, not the passage of time alone.
Review trips after incidents and tune thresholds with production evidence. If operators routinely bypass the breaker, investigate the workflow or signal quality instead of weakening the control until it never activates.