The postmortems I get called into almost never end at the model. Teams assume a failing agent needs a smarter model, swap it, and watch the system fail the same way at a higher price per token. Across the platforms we operate and the live demo on this site, the deaths cluster in six places, and all six sit in the layers around the model call. This post walks them in the order they usually kill you, each with the receipt from this series where we hit it ourselves.
The short version: production does not test whether your model is smart. It tests whether your system survives being wrong, slow, rate-limited, and unattended, all of which happen in week one.
1. Scope nobody can measure
The most common death happens before any code is wrong. An agent chartered to "handle support" or "automate operations" has no defined input, no defined output, and no number that says whether it worked. That agent cannot fail visibly, which means it fails silently, in production, at scale, while every dashboard stays green. The first article in this series made this the thesis: general agents are how you get silent failure at scale, and the loops that work are narrow and measured.
The fix is scoping, and it costs zero dollars: one loop, one measurable output, everything else refused. The narrow-loop playbook is the step-by-step version. Teams skip this step because narrow scope feels like underambition, and then they discover that "the agent seems fine" is not a statement anyone can defend to a customer.
2. Orchestration that manages instead of routes
Most frameworks ship a manager pattern: an agent that plans, delegates, critiques worker output, and loops until satisfied. In production that produces transcripts that grow faster than answers improve, agents negotiating with each other at your expense, and nobody reading any of it. On the multi-agent platform we run, the shape that survived is a router: split the question, dispatch to specialists, merge only when more than one ran. Single-domain questions, the common case, bypass the machinery entirely and cost one routing decision plus one specialist call.
The failure is expensive rather than loud, which makes it worse. A managing orchestrator usually still produces answers. The bill and the latency creep until someone finally traces a request and finds the committee meeting inside it.
3. Context stuffed until selection breaks
An agent re-reads everything in its context on every turn. Load 200 tool definitions and you pay for all of them on every call while the model's ability to pick the right one degrades, because near-neighbor tools blur together. We lost a month to exactly this on an earlier IoT agent stack before replacing the definitions with one generic tool and a compressed 9k-token catalog, the diet documented in the context engineering post.
The symptom is an agent that gets dumber as the platform gets richer. Every added capability makes every existing task slightly worse, which is the opposite of what anyone intended, and the cause is invisible unless you read what actually rides in the window per turn.
4. Safety requested instead of enforced
"Always filter by the tenant's ID" in a system prompt is a request, and a model under adversarial input can decline requests. On a multi-tenant analytics platform, we stopped asking: every generated SQL query is parsed and the tenant predicate is injected into the AST in code, so cross-tenant leakage is impossible by construction regardless of what the model writes. The general rule from the anatomy post: if a property matters, enforce it where the model cannot vote on it.
Agents that fail here fail once, publicly, and take the product's trust with them. It is the only failure mode on this list where the fix has to arrive before the incident, because the first incident is the last.
5. Quality with no gate
An agent's behavior changes when a provider ships a new snapshot, when someone edits a prompt, and when a retrieval tweak shifts what the model sees. Without a merge gate that scores behavior, those regressions ship exactly as easily as the improvements. The demo's answer is evals as CI: a golden set scored on every pull request, deltas posted next to the diff, merges blocked when the number drops. When the demo's model was retired upstream, recovery was a config change plus one green eval run, because "prove it still works" was already a CI job.
Teams without the gate do not notice the regression. They notice the churn three weeks later and cannot bisect it, because nothing recorded when the quality moved.
6. A substrate that fails on its own schedule
Everything an agent stands on fails independently of the agent. Rate limits turn naive retries into storms that speed up when told to slow down, which cost one platform three weeks at the 429 boundary before bounded concurrency fixed it structurally. Workers die mid-run and take in-flight work with them unless state checkpoints, which is why agent memory treats the context window as a cache and persists everything that matters. Providers retire model snapshots on their own calendar, with 404s as the notice period, per the migration post. And the demo's first week needed five human interventions, none of which were model failures: a retired dependency, an invisible render, a wrong timeout, cold starts, and a rate limiter keyed to a proxy.
That last list is the whole argument in miniature. The model reasoned correctly through every one of those incidents. The system around it is what production actually tested.
The pattern across all six
Line them up and the six failures share a shape: each one lives in a layer the demo video never shows. Scoping, orchestration economics, context budgets, enforced invariants, quality gates, substrate. That list is why the AI engineering curriculum in this series is six surfaces around a model rather than anything inside it, and why the fix for a failing agent is almost never a smarter model.
Every failure mode above has a receipt in a system we operate, summarized in the operator brief, and the smallest end of the discipline runs at the live demo, which survived its own week one in public. Agents do not fail in production because models are weak. They fail because production is a test of everything else, and everything else is buildable.