Circuit breakers between agent pipeline stages

Control objective

This control checks that an agentic AI pipeline has circuit breakers between its stages, so that a fault in one agent or handoff cannot cascade and bring down the whole workflow - important in banking where multi-step agents may chain document extraction, retrieval, and chat to complete a customer request, and an unchecked failure could stall or corrupt the entire chain. A circuit breaker monitors each handoff and, when a downstream stage starts failing or hanging, trips to stop further calls, isolating the fault and letting the system degrade gracefully or fall back rather than retrying into a cascade. To implement it, wrap each inter-stage handoff with a breaker that counts consecutive failures and measures latency against a normal baseline, emit telemetry on trip events, and run a recurring drill that deliberately injects failures to confirm the breakers contain them. No separate metric or formula is defined for this control, so operate it against the stated thresholds: place a circuit breaker at each handoff, configured to trip on more than 3 failures or more than 10 times normal latency, and perform a monthly cascade test. A trip should halt the affected stage, raise an alert, and trigger fallback or safe termination; a failed monthly cascade test should trigger remediation of the breaker configuration. This aligns with OWASP ASI08 and MAESTRO L3/L4.