Your AI Agent Just Deleted a Database, Leaked an API Key, and Lost Half a Response. All in One Request.

It sounds extreme. But every piece of this has happened in production.

An AI agent with tool access ran a destructive query — no one approved it. A user pasted credentials into a chat prompt — the LLM echoed them back in its response. A streaming response cut off mid-sentence because the provider timed out — the user saw a broken message.

Three different failures. Three different layers. And most AI frameworks handle zero of them.

The Three Things That Go Wrong After “It Works”

When teams ship AI features, they celebrate the demo. The LLM responds. The agent calls tools. The chatbot answers questions. It works.

Then production happens.

Failure 1: The Stream That Died Mid-Sentence

A legal tech company built an AI contract reviewer. It streams long-form analysis to lawyers — sometimes 2,000+ words. One afternoon, their provider starts timing out intermittently.

The result: lawyers see half-finished analyses. “Based on clause 7.3, the liability exposure is approximately—” and then nothing. They refresh. It happens again. They stop trusting the tool.

The engineering team adds a retry button. But by then, the lawyers have gone back to reading contracts manually.

What should have happened: When the provider died mid-stream, another provider should have picked up seamlessly. The lawyer should have seen one continuous response — not a broken sentence.

Failure 2: The Secret That Escaped

A fintech startup built an AI assistant for customer support agents. Agents paste customer context into the chat to get help drafting responses.

One day, an agent pastes a support ticket that contains a customer’s API key, SSN, and credit card number. The LLM processes it, stores it in conversation history, and — worse — references the card number in its response: “I see the customer’s card ending in 1111…”

Now there’s PII in the LLM provider’s logs. In the conversation history. In the response the agent copied into the ticket system. A single paste turned into a data breach across three systems.

What should have happened: Before the prompt ever reached the LLM, the secrets should have been automatically detected and replaced with safe placeholders. The LLM should never have seen the real values.

Failure 3: The Agent That Went Too Far

A DevOps team built an AI assistant that can run database queries, restart services, and modify configurations. It’s incredibly useful — until it decides that the best way to fix a slow query is to drop and recreate an index. In production. During peak hours.

No one approved it. No one was even watching. The agent had tool access, and it used it.

What should have happened: Dangerous tool calls should require human approval before execution. The agent proposes the action, a human reviews it, and only then does it run.

Three Safety Layers Every AI App Needs

These aren’t edge cases. They’re the natural consequences of giving AI systems real capabilities without safety layers. Here’s how to add them.

Layer 1: Stream Failover — Never Drop a Response

When you stream from a single provider, you’re betting that one provider will stay up for the entire response. With ElsiumAI, you don’t have to bet:

import { createProviderMesh } from 'elsium-ai'

const mesh = createProviderMesh({
  providers: [
    { name: 'anthropic', config: { apiKey: ANTHROPIC_KEY }, model: 'claude-haiku-4-5-20251001' },
    { name: 'openai', config: { apiKey: OPENAI_KEY }, model: 'gpt-4o-mini' },
    { name: 'google', config: { apiKey: GOOGLE_KEY }, model: 'gemini-2.0-flash' },
  ],
  strategy: 'fallback',
  circuitBreaker: { failureThreshold: 2, resetTimeoutMs: 30_000 },
})

How it works under the hood:

1. The mesh starts streaming from your primary provider (Anthropic)
2. If the provider fails before any content is sent — the mesh silently switches to the next provider. The user never knows.
3. If the provider fails after partial content — the error is captured and the system handles the partial response gracefully.
4. A circuit breaker tracks failures. After 2 consecutive failures, it stops trying that provider for 30 seconds — no wasted time hammering a dead service.
5. When the provider recovers, the circuit breaker closes and traffic flows again.

Real numbers to put this in perspective:

• OpenAI had 47 incidents in December 2025 alone
• Google Gemini had 104+ outages in 9 months
• Anthropic went down globally on March 2, 2026

Every major provider goes down. The question is whether your users notice.

Layer 2: Secret Redaction — Never Leak Sensitive Data

Users will paste secrets into your AI. It’s not a matter of if — it’s when. ElsiumAI scans every prompt before it reaches the LLM:

import { redactSecrets } from 'elsium-ai'

const userInput = `Here's my config:
  api_key: sk-proj-abc123def456ghi789
  aws_key: AKIAIOSFODNN7EXAMPLE
  ssn: 123-45-6789
  card: 4111 1111 1111 1111
  password=SuperSecret123
  Bearer eyJhbGciOiJIUzI1NiJ9.abcdef`

const { redacted, found } = redactSecrets(userInput)

What comes out:

Here's my config:
  api_key: [REDACTED_API_KEY]
  aws_key: [REDACTED_AWS_KEY]
  ssn: [REDACTED_SSN]
  card: [REDACTED_CC]
  password=[REDACTED_PASSWORD]
  Bearer [REDACTED_TOKEN]

6 secrets caught. Zero reached the LLM.

The found array tells you exactly what was detected — type, location, and severity. You can log it, alert on it, or block the request entirely.

What it catches:

• API keys (OpenAI sk-*, Stripe pk-*, generic api_key=)
• Cloud credentials (AWS AKIA*)
• GitHub tokens (ghp_*, gho_*, github_pat_*)
• Auth tokens (Bearer JWT, session tokens)
• Personal data (SSN, credit cards, passwords)
• And it normalizes Unicode first (NFKC) — so attackers can’t bypass detection with fancy characters

You can also plug it into the middleware pipeline so it runs automatically on every request:

import { securityMiddleware } from 'elsium-ai'

const security = securityMiddleware({
  secretRedaction: true,
  promptInjection: true,
  jailbreakDetection: true,
  piiTypes: ['email', 'phone', 'all'],
  onViolation: (v) => alertSecurityTeam(v),
})

Every prompt scanned. Every secret caught. Every policy enforced. Automatically.

Layer 3: Approval Gates — Never Let an Agent Act Alone

AI agents are powerful. That’s the problem. When an agent has access to tools — database queries, file operations, API calls, deployments — one bad decision can cause real damage.

ElsiumAI adds a human-in-the-loop checkpoint:

import { createApprovalGate } from 'elsium-ai'

const gate = createApprovalGate({
  callback: async (request) => {
    // Send to your approval system — Slack, email, dashboard, etc.
    return await waitForHumanDecision(request)
  },
  requireApprovalFor: {
    tools: ['delete_user', 'drop_table', 'modify_permissions', 'send_email'],
    costThreshold: 10.0,  // Any request over $10 needs approval
  },
  timeoutMs: 600_000,    // 10 minutes to decide
  onTimeout: 'deny',     // No response = denied (safe default)
})

How it works in practice:

1. Your AI agent decides it needs to call delete_user
2. ElsiumAI intercepts the call — it’s in the approval list
3. A request is sent to your approval system with full context: what tool, what arguments, why
4. A human reviews it: “The agent wants to delete user #4521. Reason: user requested account deletion.”
5. The human clicks Approve or Deny
6. Only if approved does the tool actually execute

If nobody responds within the timeout? Denied by default. The safe choice is always the default.

What you can gate on:

• Specific tools — list the dangerous ones by name
• Cost threshold — any LLM request over a dollar amount
• Models — require approval to use expensive models
• Custom rules — build any approval logic you need

Every approval and denial is recorded. When your security team asks “who approved that agent action?” — you have the answer.

How These Layers Work Together

These three features aren’t isolated. In production, they compose:

User sends prompt
  ↓
[Layer 2] Secret redaction scans input → strips API keys, SSNs, passwords
  ↓
[Layer 3] Agent proposes tool call → approval gate intercepts dangerous actions
  ↓
Human approves → tool executes
  ↓
[Layer 1] LLM provider fails → stream failover switches to backup provider
  ↓
[Layer 2] Response scanned → any leaked secrets redacted before reaching user
  ↓
Every step recorded in hash-chained audit trail

One framework. Three safety layers. Every event audited and tamper-proof.

Scenarios Where This Saves Real Money

Healthcare: HIPAA Compliance

A telemedicine platform uses AI to help triage symptoms. Patients sometimes paste their full medical records — including SSNs and insurance IDs — into the chat.

Without redaction: that PII hits the LLM provider’s servers. That’s a HIPAA violation. Fines start at $100 per violation and go up to $50,000 per incident.

With ElsiumAI: secrets are caught and replaced before they leave your server. The LLM never sees them. Your HIPAA compliance stays intact.

Finance: SOC 2 Audit

A fintech company’s AI assistant helps analysts draft reports. The auditor asks three questions:

1. “Can you prove which AI model generated each response?” → Yes. The audit trail records the provider and model for every call.
2. “What happens when a provider goes down?” → Automatic failover. With a full audit record of every switch.
3. “How do you prevent sensitive data from reaching third-party AI providers?” → Secret redaction. Automatic, on every request.

Three questions. Three features. One framework.

DevOps: Preventing Agent Accidents

A platform team gave their AI assistant access to Kubernetes. The agent is brilliant at diagnosing issues. But one Tuesday, it tries to scale down a production deployment to zero replicas to “investigate resource contention.”

Without approval gates: the deployment goes to zero. Users see 503 errors. The post-mortem is painful.

With approval gates: the agent’s proposal shows up in Slack. An engineer sees “Scale deployment/api-server to 0 replicas” and clicks Deny. Crisis averted. The agent receives the denial and tries a different approach.

Get Started

npm install elsium-ai

All three features are included. No extra packages. No plugins. 77 KB total.

import {
  createProviderMesh,   // Stream failover
  redactSecrets,        // Secret redaction
  createApprovalGate,   // Approval gates
  createAuditTrail,     // Tamper-proof logging
} from 'elsium-ai'

1,494 tests. Open source. Zero lock-in.

What’s Next

This is part of a series on building AI systems you can trust in production. We already covered multi-provider failover with hash-chained audit trails — how to make your AI app survive provider outages while maintaining a tamper-proof record of everything that happened.

Coming up:

• Cost intelligence — real-time budget tracking, cheaper model suggestions, and alerts before you blow your AI spend
• Record/replay — capture production traffic and replay it in tests for zero-cost regression testing
• Policy engine — fine-grained control over who can use which models, with what token limits, at what cost

Follow the blog at elsiumai.com/blog to catch every deep dive as we publish it.

Star the repo at github.com/elsium-ai/elsium-ai — and if you’re building AI for production, we’d love to hear what safety layers matter most to you.

Every AI framework helps you call an LLM. ElsiumAI helps you trust the result.