Fail-Open Resilience

AgentWatch is designed with a fundamental principle: our infrastructure never causes your production to go down. This is achieved through fail-open architecture at every layer.

What "Fail-Open" Means

When AgentWatch infrastructure is unreachable or experiencing issues, budget checks silently fail open — allowing API calls to proceed to the upstream provider without enforcement. This ensures your agents always work, even during AgentWatch outages.

How it Works

Because AgentWatch operates as a pure proxy with zero dependencies, our fail-open strategy relies on the high availability of Cloudflare's Edge Network (99.99% SLA) and graceful degradation within the worker itself.

Graceful Degradation

If the proxy receives a request and Cloudflare KV (where budgets are stored) is unreachable or times out, the proxy catches the exception, logs a warning asynchronously, and immediately forwards the request to the upstream provider (e.g., OpenAI or Anthropic).

This means that during a partial outage:

• Your API calls still succeed.
• Budget enforcement is temporarily suspended.
• Telemetry is queued for later or dropped if the queue is unavailable.

Configuration

Fail-open is the default behavior. Enterprise customers can configure fail-open vs fail-closed per-tenant via the dashboard settings API.

What Happens During an Outage

Component	Behavior
Budget check	Fails open, API call proceeds
Telemetry logging	Queued or silently dropped, no data loss where possible
Anomaly detection	Disabled
Dashboard	May show stale data
Compliance reports	Delayed

Monitoring AgentWatch Health

Monitor AgentWatch availability via the health endpoint:

curl https://agent-watch.dev/healthz
# Returns: ok

If this endpoint returns non-200, AgentWatch edge routing is experiencing severe issues.