Direct answerA fail-safe agent should prefer an explicit incomplete result over claiming success when critical evidence is missing, contradictory or outside the allowed scope.
False success is worse than visible incompleteness
Users can respond to a known limitation. They cannot easily respond to a system that confidently reports work as finished when it is not.
Preserve uncertainty
Missing evidence, conflicting observations and exhausted recovery attempts should remain visible in the final result.
Bound recovery
Allow sensible retries or alternate routes, but cap them. A safe system knows when to stop and ask for human input.
Verify consequential changes
For important state changes, check the resulting state independently rather than relying on the action acknowledgement alone.
Public product claim
A vendor can credibly state that its agent fails safe and verifies outcomes without disclosing the private decision states, retry policy or completion algorithm.