Every step of an AI workflow can pass its own check — so why can the whole thing still go wrong?

This explores whether a multi-step AI system can look fine at every individual checkpoint and still fail as a whole. The corpus says yes, and gives a specific reason. Local checks test different properties from the ones that decide whether the end-to-end behavior is safe. A step can be plausible, aligned, and protocol-compliant, and none of those is the property that matters at the end Can individual components pass safety checks if the system still fails?.

The gap shows up in three ways. The first is over time. A per-action check can't state a rule that depends on what happened earlier, so a sequence of individually permissible actions can collectively break a system constraint Can stateless checks ever catch sequence-level constraint violations?. Security ends up being a property of behavior over time, not of any single step Can step-by-step approval miss harmful behavior patterns?. The second is across agents. Agents that each pass their own safety checks can still cause harm together, because messages, shared state, aggregation, and delegation carry failures across boundaries that nobody is monitoring Can individually safe agents fail when working together?. The third is through accumulation. Even the strongest frontier models corrupt about 25% of a document's content over long relay workflows. The errors compound silently and can slip past spot checks Do frontier LLMs silently corrupt documents in long workflows?.

The failure can also be set up before the workflow exists. Inspecting only the generated workflow is too late for attacks that bias the planning signals upstream Can inspecting generated workflows catch planning-time attacks?. Scoring only the final answer has the same blind spot. In long reasoning traces, most failures are process violations rather than wrong answers, and adding intermediate verification raised task success from 32% to 87% Where do reasoning agents actually fail during long traces?.

The fixes all move the check to where the whole picture exists. One option is a validation gate at the commit point, just before an irreversible action, where the assembled workflow can be judged as a whole. That gate complements planning-boundary and per-hop defenses, because each catches attacks the others miss Where should workflow validation gates be placed for safety?. Another is verifiers that run alongside generation and step in only on violations, with near-zero latency cost on correct runs Can verifiers monitor reasoning without slowing generation down?. Checkers can also fail, so when an LLM does the judging, mechanical safeguards go around it, such as running unarguable checks before contestable ones and planting known cases as alarms Can deterministic checks protect LLM judges from failure?.

This failure is easy to miss because of how we look for it. Deployed AI failures tend to be plausible rather than shocking, and distributed rather than localized. Workflows also normalize them, so an evaluation built to catch a dramatic single-point error has nothing to flag Why do safety failures remain invisible to our evaluation methods?. Every step can be green because the failure lives between the steps.