Know what can go wrong.

Catches agent state that changed in a way the workflow cannot account for: a field that switches type, a status that moves backwards, a value nullified, an identity rewritten, or a reference to an ID that was never seen.

For exampleA tool call silently reset an order's status and erased its tracking ID after it had already shipped.

Catches secrets and personal data surfacing in Dify node outputs: API keys, bearer tokens, password and secret assignments, SSN and card number shapes, email addresses, and environment variable references.

For exampleA workflow includes a private API key in its customer-facing response.

Judges the retrieval step itself rather than the answer: whether the documents fetched were relevant to the query, whether the set covers what the question asked for, and what share of it was usable.

For exampleA search for the current returns policy retrieves outdated pages that do not answer the customer's question.

Scans the documents a retrieval step returned for injection payloads planted inside them, and checks whether the agent's output went on to reproduce that content.

For exampleA knowledge-base article carried a hidden instruction to leak an admin token, and the agent complied.

The graph is looping without converging.

For exampleA graph keeps alternating between plan and review without ever executing the plan.

Reads the handoff spans in a multi-agent run and flags escalation that never resolves.

For exampleBilling sends a refund request to support, and support sends it straight back to billing repeatedly.

An autonomous desktop agent takes destructive action against the user's real files.

For exampleA desktop agent deletes the only copy of a shared project folder while trying to tidy up.

The agent is visibly in trial-and-error mode (saying "let me try", retrying after errors, calling the same tool over and over) and performs an irreversible action anyway.

For exampleWhile guessing how a database tool works, an agent tries a command that permanently deletes records.

A sub-agent holds evidence that contradicts something the orchestrator already asserted, and softens or drops that contradiction in its reply instead of stating it.

For exampleA researcher finds that the lead agent used the wrong price but agrees with it instead of raising the discrepancy.

The agent holds relevant information in its internal state and leaves it out of what it passes on.

For exampleTold the release agent 'minor issues' while quietly leaving out three failed health checks and a security warning.