Reference document
The Atruvo
Platform Failure Modes Index.
30 named ways platform investments fail before AI rolls out. Built from 12 platform engagements. Each mode is documented, severity-scored, and tied to a published field note or a remediation pattern. Updated quarterly.
30
Failure modes
6
Categories
12
Engagements analysed
6
Catastrophic-tier
Methodology
12 anonymised platform engagements from 2022 to 2026. Each review documented failure modes by symptom, blast radius, and business impact. Modes appearing in multiple engagements were named and codified.
Severity scale
How to use this
Scan the index for symptoms you recognise. Each mode links to the field note that explains it. To diagnose your own platform against the index, book a Platform Failure Map.
Visibility failures
The dashboards are green, but the system is degrading. Failure modes where the observability stack is structurally unable to see what is actually breaking.
Dashboards measure activity, not outcomes
CriticalUptime, latency, and error rate look healthy. Nobody is measuring whether the system is producing the correct result.
Silent drift below alert thresholds
HighP99 latency or accuracy slowly drifts over weeks. No threshold trips. SLO budget consumed before anyone notices.
Blast radius unmapped
CriticalNobody can answer 'what else fails if this fails?' until the incident is already in progress.
SLOs gamed against customer ground truth
CriticalDashboard reports 99.95% attainment. Customers file tickets. Definition creep, aggregation, and synthetic monitoring hide the truth.
Verification debt cascade (DORA blind spot)
CriticalAI-authored code makes deployment frequency and lead time look favourable on the dashboard. The bottleneck moves to verification capacity, review queue depth by seniority, and rollback rate — places DORA does not measure.
AI monitoring is just uptime monitoring
CriticalThe infra layer is monitored. Output quality and drift are not. AI degradation is invisible until customers report it.
Ownership failures
Every team thinks their part works. The failure lives in the seams between teams. Organisational failure modes that no amount of tooling can solve.
AI pipeline has no owner
CatastrophicData, ML, and Platform teams each confirm their part is green. The pipeline between them is broken and unowned.
AI strategy without operations plan
CatastrophicBoard approved roadmap, vendor selection, and budget. No on-call, no rollback plan, no cost controls, no fallback.
Wrong job description attracting wrong hires
HighTeam is staffed with researchers who cannot ship to production, or platform engineers without AI context.
AI governance unowned by platform
CriticalCompliance, audit trail, and rollback are treated as policy documents, not platform features. Nobody operationally owns them.
Brittle services hidden from architecture diagrams
HighArchitecture diagrams show critical services. On-call data shows different services pay the reliability cost. Engineering time is invested against the wrong systems.
Truck factor of one on the deployment pipeline
CriticalOnly one engineer can deploy to a given environment. Tribal Ansible, undocumented credentials, named-person approval gates. Deployments wait when that person is on leave.
Cost failures
AI costs are being measured wrong. The visible costs are the smaller half. The real cost lives in the shared infrastructure that existed before the AI project started.
Data pipeline is the real AI cost
HighBusiness case focused on model and GPU costs. The data pipeline is 60-70% of total spend and nobody budgeted for it.
AI workloads hidden in shared compute
HighGPU, LLM API calls, and embedding jobs buried in 'general compute' line items. Nobody can attribute cost to a specific AI feature.
Capacity ceiling unknown until breached
CriticalPlatform is running at 80% of an unknown ceiling. Adding AI workload pushes it over. Discovery happens during incident.
No agent budget boundary
CriticalToken consumption controlled per request, not per agent run. One stuck tool call burns a month of FinOps headroom in an hour. No max-iterations circuit breaker.
Architecture failures
The substrate underneath the AI was not measured before deployment. Cache layers, queues, retries, and scheduling assumptions that AI workloads break.
Platform substrate never measured
CatastrophicAI bolted onto a platform with unknown cache layers, undocumented queues, and engineers on leave. Hidden failure modes detonate at week 8.
Kubernetes scheduling for GPU workloads
HighCluster designed for CPU autoscaling cannot serve GPU AI workloads. Scaling takes 5 minutes. Cold start kills inference SLOs.
RAG infrastructure not scaled for production
HighVector DB latency, stale embeddings, and retrieval drift all break differently from dev to prod. Each one looks like a model problem.
Stalled migration debt
CriticalMigration stalled at 60% for 18 months to 4 years. The last 40% is a different project than the first 60%. Reporting tracks against a plan that no longer reflects reality.
Multi-cloud without commercial justification
HighMulti-cloud strategy doubles platform cost without delivering the promised resilience. Adopted as a hedge against indecision, not a real risk.
Agent runtime without a production contract
CatastrophicPlatform built for stateless HTTP cannot host non-deterministic, long-lived, tool-invoking agent workloads. No token budget per run, no eval floor, no gateway SLO. Agents stall before reaching production.
Portal without a paved road
HighIDP measures catalog coverage rather than developer outcomes. Adoption sits at 10% because developers correctly route around it. AI agents route around it too because it was built for humans clicking a UI, not machines invoking structured tools.
Resilience failures
Failure modes where the system is unable to degrade gracefully. Where rollbacks corrupt state. Where fallbacks are worse than failures.
Silent AI fallback is worse than hard failure
CatastrophicWhen the model fails, the system silently returns cached or default results. Errors are hidden for weeks before customers notice.
Model rollback creates state inconsistency
CriticalRolling back a model leaves embeddings, stored decisions, and downstream state from the new model in place. System breaks differently.
AI guardrails only check format, not facts
CriticalGuardrails pass 100% in dev. In production they let through 28% of wrong-but-well-formed answers because they never checked correctness.
Security and compliance failures
AI-specific security and compliance failure modes where the defence is in the wrong place, or the audit evidence does not exist.
Prompt injection defended at application layer
CriticalEach application implements its own regex filter. One gap exposes the entire org. The defence belongs at the platform gateway.
AI audit trail missing or incomplete
CriticalInputs, outputs, model version, and confidence scores not stored. Compliance audit cannot prove what the model saw or returned.
AI compliance audit will fail
CatastrophicStrategy, governance, and policy all exist on paper. The platform cannot produce the evidence the audit will demand.
AI security as policy, not platform
CriticalCISO writes correct policy. Platform has no AI gateway to enforce it. Each team implements badly. CISO blocks rollouts because policy is unenforceable.