I spent a week reviewing LLM apps for a client and found a pattern that surprised me. Every loud failure - a refused prompt, an exception, a blocked tool call - was handled fine. The app had guardrails. The failure that almost caused a real incident was the one that raised no error at all : the model quietly complied with a slightly reworded request, returned a normal-looking response, and the downstream code logged it as a success. I am calling these soft failures . They are the expensive ...