Audit a teammate's first-draft failure-mode catalog for the support copilot, then write the real one — user impact, detection signal, and product response per mode — plus a staged rollout with cohort gates, eval thresholds, kill criteria, and a prompt-rollback procedure. The draft misses two failure modes and one rollback trigger.
Kabir's support copilot is approaching a wider launch, and his APM has drafted the failure-mode catalog and rollout plan. It looks complete — which is the problem. First drafts of failure catalogs reliably contain the failures that announce themselves and reliably omit the ones that stay silent. Your job is the audit and the rewrite: this is the "how would you launch an AI feature safely" interview answer, produced as a document.
DRAFT v1 - Failure catalog + rollout (APM, for review)
FAILURE CATALOG
FM-A Invented policy/commitment. Impact: bad promises to customers.
Detection: customer complaints. Response: agent edits draft.
FM-B Wrong price quoted. Impact: revenue leakage, disputes.
Detection: complaints + weekly finance spot-check.
Response: correction email, price table in prompt.
FM-C Rude or dismissive tone. Impact: CSAT drop.
Detection: CSAT surveys, complaints. Response: tone rules.
FM-D Unsafe advice on safety topics. Impact: physical risk, legal.
Detection: complaints, agent reports. Response: hard-coded
safety responses, immediate incident review.
ROLLOUT PLAN
Stage 1: 5% of tickets, agents review every draft. Gate to Stage 2:
eval score >= 90% on copilot-eval-v1 and no Sev-1 incident in 2 wks.
Stage 2: 25%, agents review every draft. Gate: eval >= 90%, CSAT flat.
Stage 3: 100%, agents review drafts for safety categories only.
KILL CRITERIA / ROLLBACK
- Any Sev-1 safety incident -> disable feature, roll prompt back.
- Eval score drops below 85% on any release -> block release.
ROLLBACK PROCEDURE
- Re-deploy previous prompt from the shared doc where prompts live.
Audit the catalog against Lab 07's taxonomy first. Lay the draft's four modes beside the five mechanisms error analysis found. Something observed in production traces is absent from the catalog. Name it, and note why first drafts drop it — what property makes it easy to forget? Write your finding before touching AI.
Run the silence test on every detection signal. For each mode ask: if this failure happens today, does anyone actually notice? The draft leans on "customer complaints" three times. Interrogate that: which failures produce complaints, and which produce silence? A customer wrongly told "no refund" rarely complains — they leave. A price quoted wrong in the customer's favor never generates a complaint. List every mode whose real-world detection signal is nothing, and design an active signal for it (sampled human review of N drafts/week, edit-rate tracking, judge-scored production samples from Lab 09).
Hunt the missing time-based mode. The catalog treats failure as a fixed property of the model. But Lab 07 found stale prices — failures created by the world changing after launch. Add the drift mode: correct-at-launch behavior invalidated by policy edits, price updates, new SKUs. Impact, detection (eval re-run on every policy-card change; freshness checks), response (retrieval from live data rather than baked-in facts; content-update hook that triggers regression evals).
Rebuild the catalog properly. One row per mode — aim for six or seven: the draft's four (tightened), plus your finds. Columns: mode, user impact (concrete, not "bad experience"), detection signal (must pass the silence test), product response (what the product does when detected: fallback UX, human takeover, disable category), and owner. Every "detection: complaints" surviving your rewrite should be a deliberate, argued choice.
Stress-test the rollout gates. Two questions per stage: what does this gate actually measure, and what slips through? Note that every gate in the draft is an eval score or an incident — nothing measures production behavior in between. Add production gates: agent edit-rate below a threshold, escalation rate stable, sampled judge scores on live traffic ≥ target. Then check the cohort logic: Stage 3 removes review for everything but safety — is FM-A caught at Stage 3? By what?
Find the missing rollback trigger. The draft rolls back on Sev-1 incidents and blocked releases — both event-shaped. What about degradation with no event: edit rates creeping from 10% to 35% over three weeks, evals still green because the eval set doesn't cover the new traffic pattern? Write the drift trigger: a production metric threshold, measured on live traffic, that forces rollback review even when evals pass and nothing "happened."
Rewrite the rollback procedure until it is executable at 2 a.m. "Re-deploy from the shared doc" fails the 2 a.m. test. Specify: prompts versioned in git with tagged releases (this becomes Lab 15's contract), the exact rollback command/owner, verification step after rollback (smoke-run the eval set's safety cases), customer-facing state during rollback (feature off? previous prompt? human-only?), and the incident note template. Time-box: rollback executable in under 15 minutes by the on-call, no PM required.
Red-team the final plan with AI. Prompt: "You are a hostile auditor. Here is a failure catalog and rollout plan for an AI support copilot. Find every failure that would be detected late or never, every gate that can be passed while quality degrades, and every step of the rollback that could fail at 2 a.m." Adopt what lands, rebut what doesn't, and note one attack you had missed.
A failure mode without a detection signal is not "covered" by being listed — the catalog's real content is the detection column, because unfound failures compound daily.
A complete lab has all of the following:
Failure catalogs fail by omission, and the omissions cluster where failures are silent — false refusals, drift after content changes, degradation without incidents. Detection signals that pass the silence test, production-metric gates, and a 2 a.m. rollback are what make an AI launch plan real.