for an administrative tool the criticality is not determined by the network boundary but by which decisions within the plant are based on these figures
Failover saves the call, not the run. If the provider fails mid-agent run, the second provider starts without knowing which tool calls have already been written, and the retry on a non-idempotent write simply creates the record twice. Without an idempotency key for each tool call and a checkpoint after each write, two providers make you available, but not correctly.
On the egress judge: an LLM reviewing connector calls inline is a probabilistic control sitting where a capability grant belongs. The operations that actually cause damage are largely enumerable: writes, deletes, and bulk reads of personal data. Those should be absent from the scoped token rather than present and then argued about by a judge with a nonzero false-negative rate under adversarial input, with the judge kept for the ambiguous long tail where enumeration genuinely fails. This is the WAF story again, request inspection in front of an app was a useful compensating control, and every team that mistook it for the boundary relearned that the boundary was the parameterized query and the database grant.
The failure mode I would want addressed before putting this in front of an agent fleet is silent quality regression. When a turn gets routed to a cheaper model and the agent still completes the task, the trace reads as a success, and nobody attributes the worse output to the routing decision until it has compounded downstream. In the enterprise pipelines I build the spend win rarely came from per-turn model choice anyway, it came from cutting how many turns hit an LLM at all, with models pinned per workflow step so a regression was attributable to one change. That pinning is what made the system auditable, which is what a buyer's platform team actually signs off on. Do you run a shadow sample where routed turns are also executed on the frontier model, so a customer can see the measured quality delta instead of trusting the router's own confidence estimate?
