The Circuit Breaker Pattern for AI Agents

A circuit breaker for AI agents is an automatic control that pauses an agent the moment a measured condition crosses a threshold (too many errors, too much spend, too many actions, too many retries) and then refuses to resume until a human re-authorizes it. It does not wait for a person to notice trouble and react. The threshold is always watching, even at 3 a.m. when no one is. When the breaker trips, the agent stops doing damage on its own, and restarting becomes a deliberate human decision rather than an automatic retry. That single property, firing by itself and resuming only on a human's say-so, is what separates a circuit breaker from every other stop.

This article covers what the circuit breaker pattern is, why agents need automatic thresholds instead of attentive humans, what to trip on, how resume semantics work, how the AI agent circuit breaker differs from a kill switch and a rate limit, and how it fits the LoopRails method (Grade · Guard · Show · Prove) described in is the anti-pattern where an agent runs with full autonomy and nothing contains a cascading mistake. It looks fine right up until it doesn't, and then there is no brake. A circuit breaker is the most basic thing standing between your agent and that edge. When you cannot catch the mistake in time, you contain the outcome automatically.

What to trip on

A circuit breaker is only as good as the signals it watches. Pick conditions that indicate "something is going wrong," set them server-side (not in the prompt, where the agent can ignore them), and wire each to a hard auto-stop.

• 
  Error / failure rate. The classic trip. If the share of failed actions, tool calls, or rejected outputs crosses a threshold over a window, open the breaker. A rising failure rate is the earliest sign an agent has lost the plot.


• 
  Spend. Track cost (API spend, tokens, real money the agent moves) against a budget. Trip when it crosses, and trip harder when the rate of spend spikes, which catches a runaway before it drains the budget.


• 
  Action volume. Count consequential actions per unit time. An agent that suddenly sends 200 messages or opens 50 tickets is doing something a healthy agent doesn't. Volume is often the first quantitative tell of a loop.


• 
  Repeated retries. A tight retry loop (the same action failing and being re-attempted) is a runaway in miniature. Trip on N retries of the same operation before the loop becomes the whole workload.


• 
  Anomaly signals. Anything that deviates from the agent's normal envelope: unusual targets, off-hours bursts, actions outside the expected category, accumulated blast radius across many small steps. Softer, but they catch failures the hard counters miss.

The rule across all five: trip on a measured condition, not a vibe. "We'd notice" is not a threshold. A counter is.

Half-open and resume semantics

The whole point of the pattern is governed resumption, so the state machine matters. Borrowed from software reliability, an AI agent circuit breaker moves through three states:

• 
  Closed (normal). Actions flow. Counters watch the trip conditions in the background.


• 
  Open (tripped). A threshold crossed. The agent is halted and consequential actions are blocked. The breaker stays open. It does not quietly retry on a timer.


• 
  Half-open (probing). A limited, supervised trial: a small number of actions are allowed through so a human can see whether the problem is resolved before fully reopening.

The non-negotiable rule for agents: resuming requires human re-authorization. A software breaker may auto-close after a cooldown because the only cost of a wrong guess is a few more failed calls. An agent acting in the real world is different, because resuming into an unresolved problem can be irreversible. So an open breaker does not auto-close on a timeout; "resume" is a deliberate, logged human decision. The half-open state is a tool for that human to confirm the fix under a cap, not a license for the system to reopen itself.

This is why the trip and the resume must both be Logged: a record of what crossed the threshold, what was in flight when it opened, and who re-authorized it and why.

Circuit breaker vs kill switch vs rate limit

These three get conflated constantly. They are complementary, and a mature agent uses all three. The difference is the trigger and the job.

Circuit Breaker: automatic, threshold-triggered, requires re-authorization to resume. It fires on its own when a measured condition crosses a line, then holds the agent stopped until a human re-authorizes. Its job is to catch known failure modes automatically, because the threshold is watching when no human is.

runs continuously. The circuit breaker sits on top: when the aggregate of those capped actions still trends wrong, the breaker pulls the plug.

How much breaker you need scales with the grade of the actions your agent can take. Grade each by reversibility, blast radius, and stakes; the : a circuit breaker is expected. Actions like git push, spending within a budget, or modifying shared state move faster than per-action review, so automatic thresholds earn their keep.