From electrical circuits to AI control
The circuit breaker pattern originates in electrical engineering: a device that detects overcurrent and interrupts the circuit before damage propagates. Software engineering adapted the concept for microservices — a wrapper that monitors call failures and stops routing traffic to an unhealthy service. AI control systems adapt it again, at the decision level.
An AI circuit breaker monitors proposed actions, evaluates them against policy and authority, and interrupts execution when conditions warrant intervention. Unlike a microservices circuit breaker, which reacts to downstream failures, an AI circuit breaker evaluates the content and authority of the action itself — it can deny a perfectly valid call to a healthy service because the policy prohibits it or the authority is insufficient.
Circuit breaker states for AI systems
A basic AI circuit breaker has three states: closed (normal operation), open (intervention active), and half-open (recovery testing). In the closed state, actions are evaluated and may proceed. In the open state, actions are blocked or escalated to human review. In the half-open state, a limited set of actions are permitted to verify that the system is safe to resume.
DecisionHypervisor extends this model with six decision states that provide graduated control: Authorized (proceed), Modified (proceed with changes), Escrowed (hold for time-window verification), Review Required (escalate to human), Routed (redirect to alternative handler), and Denied (block). This allows the system to respond proportionally rather than binary.
Detection triggers
An AI circuit breaker should trip on multiple signal types: policy violations (the action is prohibited by rule), authority failures (the actor lacks sufficient permission), behavioral anomalies (unusual volume, scope, or pattern of actions), external triggers (regulatory alerts, security incidents, operator commands), and resolution failures (the control plane cannot reach a deterministic decision).
The detection logic should be deterministic and auditable. Probabilistic anomaly detection can inform the decision, but the final resolution should follow fixed precedence rules so that the system's behavior is predictable and can be reconstructed in forensic replay.
Recovery and half-open testing
Recovery from an open circuit breaker state must be governed as carefully as the shutdown itself. The half-open state permits a limited set of actions to verify that the system is safe to resume — but the criteria for what constitutes 'safe' must be defined by policy, not by the AI system's self-assessment.
A structured recovery process includes: root-cause confirmation, policy or model changes applied, controlled test of intervention and failover mechanisms, multi-party recovery authorization, staged reactivation with enhanced monitoring, and formal incident closure. Each step produces evidence that becomes part of the permanent record.