What does graceful degradation look like for a multi-step agent?

NorthWave Mobile runs a self-service agent that resolves data-overage disputes in five steps. Marisol Devany is a hotel night auditor who has used it three times before, always without a hitch, and always after midnight.

How to answer this, stage by stage

Nobody is grading whether you can name five pipeline stages. They're grading what the agent says the moment one of them breaks.

Let's learn

What happens when step three of five quietly fails, and the customer never finds out that steps one and two were already fine?

NorthWave Mobile's agent answers one question for a customer: does this overage charge get credited back, and how much. Before it, a customer called a rep, waited on hold, and read out two months of usage history by phone, a slow process that at least never lost any part of what had already been said.

Slow, but nothing in this chain ever got thrown away halfway through.

Now the agent runs five steps in about four seconds: verify identity, pull the usage log, calculate the credit, apply it, send a text confirming it.

Step three is the one that occasionally needs a human. The chain was built to treat all five as one unit anyway.

Here's the turn: the extra failures at step three were never the real problem. The real problem is what the agent does the moment step three can't finish. Right now it shows one flat message, "we couldn't process this," and a "start over" button, throwing away two steps a customer just watched succeed.

At its worst, a customer restarts three times, each attempt losing the same verified identity check, gives up, and pays an overage charge that was never actually owed.

Same failure. Only what the screen was willing to keep changed.

What I would leave alone: the four out of five disputes where all five steps sail through don't need any of this. Nothing here slows down the common case.

The lesson: a chain that treats "mostly working" the same as "fully working" will eventually throw away good work to punish one bad step.

Now here is the same thing as a story

The short version above is what you'd say defending this design to NorthWave's engineering review. Read this one for how close the near miss actually came.

Marisol Devany runs the night desk at a downtown hotel, and she does most of her personal errands between 1 and 3 in the morning, the only quiet stretch in her shift. She'd used NorthWave's dispute agent three times before, always for small data overages, and it had always worked in under five seconds.

This time her bill showed a forty-two dollar overage from a month she'd barely used her phone. She opened the agent, and it verified her identity instantly, pulled her usage log a second later, both green checks right there on the screen, and then sat spinning on "calculating your credit" for eleven seconds before returning "we couldn't process this request, please try again."

Marisol tapped "try again." The agent re-verified her identity, re-pulled the same usage log she'd already watched it confirm, and stalled at the same spot a second time. She tried a third time. On the fourth attempt it finally went through.

The old message gave Marisol none of these four. She had no way to know steps one and two were fine every single time she retried.

Two days later, checking her account out of habit, Marisol noticed two separate text confirmations for the same credit, one from her second attempt, one from her fourth. Both had gone through. She called NorthWave before either credit posted twice to her account, and a rep caught it just in time, reversing the duplicate before it cleared.

With the redesigned chain, the moment step three stalls, the screen shows two settled checkmarks, identity and usage, a clear line, "calculating your credit needs a quick human look, usually done within the hour," and nothing else re-runs. Run the same night forward: Marisol sees her two verified steps standing, gets a single text an hour later confirming one credit, and never taps "try again" at all.

The old chain asked Marisol to trust that nothing was lost every time it made her start over. The new one shows her exactly what's still standing, and the redesign's own numbers below show the same pattern holding up on a completely different chain.

I built the chain as one unit because it felt safer, nothing half-done ever reaching a customer. It took a near-duplicate credit to see that "nothing half-done" and "nothing thrown away" are not the same promise.

SPARK, in one screenNot a lecture on error handling. SPARK is what tells you which single decision the whole chain hangs on.

Four rules, not a whole rebuild. This is the entire anchor.

The recap, one line per letter: situation is a customer on hold reading out their own usage history, payoff is teaching customers to trust a partial result instead of restarting on doubt, anchor is stamping each step final and naming the exact break, risk is the night step three genuinely can't resolve alone, and keep out is holding back any guessed rollback logic.

Each of these sounds reasonable to want eventually. None of them is needed to fix the actual problem.

And if you want to be sure it really works, try it somewhere elseSame five letters, a customs clearance agent instead of a phone bill. A different chain, the same broken atom.

Portmere Customs Brokerage runs a five-step agent that clears imported goods: classify the goods, check the tariff code, calculate duty owed, flag inspection risk, generate the paperwork. Corin Vasquez is a brokerage clerk who runs dozens of shipments through it daily. Mapped onto SPARK: situation is a clerk today, manually cross-referencing tariff codes in a binder, a task that used to take twenty minutes per shipment; payoff is the habit to build, trusting the steps already cleared instead of re-checking a whole shipment from scratch.

The anchor here is structurally the same idea aimed at a different break: freeze each cleared step, and when the inspection-risk flag can't resolve on its own, a case with an unusual country-of-origin combination, show the goods classification and tariff code as already settled, and route only the risk flag to a customs officer. The risk Portmere's team designed against was a clerk seeing any failure and manually re-keying the entire shipment, including the tariff lookup that was already correct, adding twenty minutes back for a problem that only ever touched one step.

Swap "credit calculation" for "inspection risk," and the same broken atom shows up in a completely different industry.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "stamp each step final on completion, and on failure show what's settled and name the exact broken step," and stop.
Cost: there's no engineering time this quarter to rebuild the whole pipeline's state model. Say so honestly, and start with the one step that fails most, since that's where nearly all the wasted restarts come from.
The model gets better, for real: if the credit-calculation step's accuracy improves and near stops failing, that's still not a reason to remove the partial-completion design. Even a rare failure deserves to keep the work already done.

Where people run it wrong.
They treat "add a retry button" as the fix, when a retry on an atomic chain just repeats the same all-or-nothing loss.
They assume a clean single error screen looks more trustworthy than showing partial progress, when it's actually just less honest.
They wait for a near-duplicate charge to notice the design gap, instead of asking upfront what a customer sees the first time one step alone fails.

How to use it live. When someone asks what graceful degradation looks like for any multi-step system, ask one question first: if step three failed right now, would the customer lose steps one and two? Design so the honest answer is always no.

Flashcards (tap any card to flip it)

Check yourself Score: 0 / 0