LLM providers fail like every other dependency — except their failure modes include rate limits that punish exactly the retry behavior your circuit breaker would otherwise cause. Electrical engineering's oldest pattern, tuned for a dependency that can bill you for failing.

The mechanics are classic: a breaker wraps each provider call and tracks failures in a sliding window. Closed, calls flow. When the failure rate crosses the threshold, the breaker opens — calls fail instantly without touching the provider, which is the whole point: the fleet stops pouring traffic into an outage and stops burning money on 429-failed requests. After a cooldown, a half-open probe tests recovery; success closes the circuit, failure reopens it. The pattern prevents the retry storm that turns a provider's thirty-second hiccup into your fifteen-minute outage.

LLM-specific tuning makes the difference between textbook and production. Classify errors before counting them: 429s and 529s (overloaded) say "back off, maybe open"; 400s say "your request is broken — opening the circuit changes nothing." Rate-limit responses carry retry-after hints; a breaker that ignores them retries into a deeper hole. And because providers fail per model and per region, breakers key on (provider, model, region) — a degraded small model should not block calls to a healthy large one.

The Degradation Ladder

• Rungholder model: on open, fall down a ladder — alternate provider, smaller model, cached or precomputed response, and finally a graceful refusal that says what the system can do.
• Budget-aware shedding: under provider stress, shed the long tail first — pausing batch jobs ahead of interactive users is a policy decision, so make it explicit.
• Probe with cheap calls: half-open probes cost tokens; use short prompts, and rate-limit probe frequency by budget, not just by time.
• Alarm on ladder position: how often the system runs on fallbacks is an SLO in itself — silent degradation is still degradation.

The uncanny part of operating agents at scale is how completely the old reliability liturgy applies — breakers, bulkheads, fallbacks — with one new verse: the dependency can think, which makes graceful refusal prompts part of resilience engineering. Write them before the outage, not during.