Every automation flow will break someday. A third-party API changes, credentials expire, the network drops mid-process. The question isn't whether it fails, but what happens when it does.
Fragile flows fail silently. It only surfaces a week later when someone asks why the report never arrived. The cost isn't just the wait — it's the trust that never comes back.
Four things we build into every flow: idempotency so re-running doesn't create duplicate data; retry queues with increasing backoff for transient failures; notifications to a channel people actually read; and an audit trail readable without opening the database.
One more principle: don't automate 100%. Ambiguous cases should escalate to a human. A flow that hands off 9% of cases to a person is far more useful than one that forces everything through and gets 12% wrong without telling anyone.