Single-model dependence is fragile
The model provider has outages. Rate limits hit. Capacity tiers fluctuate. A serious system has a fallback chain so the user keeps getting answers even when the primary path is unavailable.
The chain shape
- Primary — best quality, your default.
- Secondary — different provider, similar capability. Different infrastructure = different outage profile.
- Tertiary — cheaper or local model, lower quality but available. Last-resort.
- Cached / static fallback — for some prompts, a cached "sorry, try again" with a useful pointer is better than a blocked request.
Wiring
- Detect failure: 5xx, timeout, content-policy refusal on a benign request, validator-fail-and-retry-failed.
- Step the chain on failure; log every step.
- Set hop budget: 3 hops max; after that, fail clean to the user with a structured error.
- Track per-step quality — if your tertiary is regularly serving traffic, your eval should include it.