Failure diagnosis
Why AI Integration Projects Fail
Find the failed boundary behind an AI integration: identity, approval, destination completion, retries or operational handover.
AI integration projects fail when a team proves one boundary and assumes the rest. The model produces a plausible answer, so the workflow is called accurate. The API accepts a request, so the action is called complete. A developer recovers a failed job, so the service is called supportable. Each conclusion requires evidence that the preceding demonstration does not provide.
This diagnostic guide is for IT directors, delivery sponsors and operations managers investigating an integration that works in demonstrations but disappoints in production. It separates interpretation, authorisation, execution and recovery failures so that corrective work reaches the actual cause. The AI integration and delivery service can help define a repair scope around that evidence.
Find the first unsupported claim in the success chain
Write down the project's definition of success in observable terms. “The agent completes service reports” is too broad. “An authorised recipient can retrieve the correct approved report associated with the completed job, and the source system records its reference” identifies a business outcome. It also makes missing evidence visible.
For each reported success, ask what was directly observed and what was inferred. Was the input from an authorised source? Did the model extract the right facts? Did a reviewer approve the content actually sent? Did the destination persist it? Can the intended user access it? Does the operational record reflect the same result? Keep these as separate checks even if one interface hides them behind a single button.
The HTTP standard offers a useful concrete warning: RFC 9110 defines 202 Accepted as acceptance for processing without completion of that processing. A downstream status, receipt or reconciliation process must establish the relevant later outcome. The same principle applies beyond HTTP: understand exactly what each acknowledgement confirms.
A failure map that leads to an actionable repair
| Observed symptom | Boundary to inspect | Evidence and repair direction |
|---|---|---|
| Good-looking output attached to the wrong record | Identity and source mapping. | Compare identifiers and issuer rules; fix the join and block ambiguous matches. |
| Approved content differs from the action taken | Approval-to-execution binding. | Compare approved and submitted versions; require a new review after material change. |
| Requests succeed but users cannot find results | Destination persistence and availability. | Trace the business artifact and permissions, not just the transport response. |
| Repeated submissions produce inconsistent records | Retry, uncertainty and reconciliation. | Establish destination state before retrying; implement the supported duplicate-control mechanism. |
| The pilot works but new departments fail | Scope and environment differences. | Compare permissions, custom fields, language, volumes and local workflow rules. |
| Only the original developer can restore service | Operational ownership and handover. | Run a recovery exercise with the receiving team and repair the missing procedures. |
Do not label all of these “model quality”. A better model cannot grant missing permissions, repair an invalid record relationship or confirm a destination write that nobody checked. Conversely, a perfect connector cannot make an unsupported model-generated claim true. Correctly locating the boundary prevents expensive changes to the wrong component.
Worked example: 100% accepted, 90.7% released
Consider an illustrative batch of 300 AI-prepared service-completion reports. All 300 submissions return HTTP 202. Later, 284 reports render successfully; 16 fail during rendering. Of the 284 rendered reports, 272 are released to the intended authorised recipient, while 12 remain blocked at the release step.
The transport acceptance rate is 300 ÷ 300 = 100%. The rendering rate is 284 ÷ 300 = 94.7%, rounded. Confirmed release is 272 ÷ 300 = 90.7%, rounded. These figures describe different stages. Reporting only the successful rendering population would hide the earlier failures; reporting the API response would hide both downstream gaps.
The 12 release blocks may include correct security denials. They still remain incomplete against the original delivery objective, but the remedy is not automatically to loosen access. Investigate whether the recipient was incorrectly specified, authority changed or the request should have been rejected before generation. Separate a control doing its job from a technical defect.
The 272 released reports are not automatically 272 accurate reports. Content correctness and association with the intended job need their own validation. Add that evidence to the outcome definition rather than multiplying unrelated aggregate percentages and calling the result business success.
Reconstruct a small set of cases before changing the architecture
Select successful, failed, denied and unresolved cases from the same defined period and scope. Preserve request references, configuration versions, source evidence, approvals, destination records and operator actions. Use appropriately restricted or masked evidence for investigation. A screenshot of an error is useful, but it rarely establishes the complete causal chain.
Reconstruct the sequence from the earliest relevant input. Look for the first point where actual behaviour diverged from the agreed contract. Distinguish the initiating defect from later symptoms: an expired credential may cause retries, which create queue pressure, which then makes a dashboard look like a model-latency problem.
Compare a failed case with a genuinely comparable success. A different department, permission group or document format can explain the difference better than the model version. The monitoring guide and audit logging guide define evidence that makes these comparisons possible without collecting unrestricted sensitive content.
Test the assumptions that the demonstration avoided
Demonstrations often use prepared data, broad test permissions and a single happy path. Production adds stale records, concurrent updates, unavailable systems, varied language and operators who did not build the application. List those differences explicitly. Treat each as a hypothesis to investigate, not proof that the project was doomed.
Check whether the source and destination owners agreed the same meaning for success, rejection and pending work. A connector team may consider a payload delivered while operations expects a task completed. Resolve that semantic mismatch in the contract and user interface. Do not simply rename the dashboard measure after the fact to make the release look successful.
Review the original testing strategy. Identify missing cases and add tests that reproduce the actual failure. Avoid a large suite of checks that merely restates the implementation. A useful regression check should fail for the observed defect and pass when the intended business behaviour is restored.
Separate a trigger, a defect and a recovery weakness
An incident can have several causes at different levels. A destination outage may trigger the problem; a missing status-reconciliation step may create uncertainty; an absent operator procedure may prolong the disruption. Fixing only the trigger leaves the service vulnerable to the next interruption. Record which condition started the incident, which design assumption amplified it and which operating gap delayed recovery.
For each proposed fix, state what observable behaviour should change. “Improve reliability” is not a test. “After an interrupted submission, the operator can establish the existing report reference before another release is attempted” is testable. Keep the original failed trace and a new acceptance trace together so the project sponsor can see why the repair addresses the defect rather than merely producing a different successful example.
Contain the failure without destroying the evidence
Pause the affected write or release path when continuing it would create further incorrect outcomes. Preserve pending work and the records needed for reconciliation. A blanket restart can erase useful state or repeat actions whose outcomes are still uncertain. Decide separately whether read-only assistance can continue within its approved scope.
Assign a single owner for the incident's business reconciliation. Technical teams may repair several components, but someone must account for which reports, cases or transactions were completed, blocked, duplicated or never created. Record any manual actions so the restored integration does not repeat them.
Use a bounded repair plan: the defect to fix, the cases to reprocess, the control that prevents recurrence and the evidence required to resume. Deployment models can support a limited reintroduction where the architecture allows it. The release decision should follow the risk and observed behaviour, not an arbitrary promise to restart by the end of the day.
Recover the project with an evidence-based delivery reset
A reset should produce a corrected outcome definition, an owned exception list, a repaired interface or decision rule, representative acceptance traces and an operator-led recovery demonstration. Keep known limitations visible. If a missing source capability makes the original scope infeasible, change the scope explicitly rather than hiding the limitation behind more AI reasoning.
Re-estimate only the work affected by the findings, while checking whether the same assumption exists elsewhere. The cost-overrun diagnostic separates scope change, rework, waiting and remaining commitments. This matters because an incident can become a commercial dispute if neither party can explain what the original delivery obligation included.
Finally, update ownership. Name who maintains each interface, approves model or prompt changes, investigates unresolved outcomes and decides when a process must stop. A project is not recovered merely because the developer can reproduce a successful request. It is recovered when the receiving organisation can operate the agreed service and recognise its limits.
For a focused review, bring one complete failed-case trace, one comparable success and the current acceptance wording. Enquire about diagnosing an AI integration failure so the next delivery decision addresses the broken boundary.
FAQ
Your questions, answered.
Why does an AI integration demo work while production fails?
The demo may use prepared data, broad permissions and a single uncomplicated path. Production adds concurrent changes, missing evidence, local customisation and partial downstream outcomes. Compare the environments and reconstruct specific cases before blaming the model. The useful question is which assumption stopped holding and which boundary lacks a defined response.
Does HTTP 202 mean an AI-generated report was delivered?
No. It means the request was accepted for processing, without proving completion. The workflow needs later evidence for rendering, release and availability to the intended authorised recipient. Content accuracy requires another check. Keep the original request population visible so that downstream failures do not disappear from the reported success rate.
Should we replace the LLM when AI integration results are wrong?
First locate the defect. Wrong source identity, stale permissions, missing destination confirmation and unsafe retries are not necessarily model failures. If the model misinterprets valid evidence, evaluate that separately on representative cases. Replace or change a component when the evidence connects it to the observed problem, then verify the complete outcome again.
How do we distinguish a correct security denial from an integration defect?
Inspect the intended action, the authoritative permission result and the user-facing state. A denied action may be the correct control outcome, even though the request remains incomplete. Investigate whether the scope was wrong or authority changed. A defect arises if the system bypasses the denial, misreports success or cannot route the unresolved case appropriately.
What should we preserve before restarting a failed integration?
Preserve request references, versions, approvals, destination outcomes, pending work and manual actions needed for reconciliation. Establish which operations may already have completed. A restart can repeat effects or erase the evidence needed to resolve uncertainty. Pause the affected path deliberately and use a recovery plan tied to the actual business records.
When is a failed AI integration project genuinely recovered?
When the agreed outcome is demonstrated, affected cases are reconciled and the receiving team can operate and recover the service. That includes documented limitations, owned exceptions and tests reproducing the original failure. One successful rerun by the developer does not establish that normal operations, access changes and future source-system failures are manageable.