I ran a catalog translation pipeline over a handful of products, read every output myself, and shipped it.
Then it ran over the full catalog, and I had no idea whether it was working.
Nothing crashed. Every item came back well-formed: fields populated, language correct, no exceptions, no retries. The pipeline called all of it a success. Then a later sample showed units quietly converted, a model code rewritten as if it were an ordinary word, and attribute keys that no longer matched the ones search and delivery depended on.
The model was not where this broke. In testing I was the grader: I read each output and decided whether it was right. In production nothing played that part, so a plausible answer and a correct answer looked the same to the system.
What I do differently now: every step emits a verdict that something outside the model can check. Invariants pulled from the source (numbers, units, identifiers, the set of attribute keys) have to survive the transform, and an item that breaks one gets parked instead of published. The agent is allowed to be wrong. It is not allowed to be wrong silently.
I write up more of these production failure modes on my blog: https://polycratia.com/c/b56d3b37
If you run agents at scale, what catches a bad output in your pipeline before a user does?