Graceful degradation
A design property in which a system responds to a detected fault by moving to a reduced-functionality or safe operating state rather than failing catastrophically or continuing to operate on assumptions that may no longer hold. NASA's Mars rover fault-protection software, which places the vehicle into a conservative safe mode when it encounters an unresolved anomaly, is a documented example.
Defined in 3 GAGE programs, which carry 8 distinct definitions of it. The wording above is taught in Engineering Judgment and Professional Formation.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A design property in which a system responds to a detected fault by moving to a reduced-functionality or safe operating state rather than failing catastrophically or continuing to operate on assumptions that may no longer hold. NASA's Mars rover fault-protection software, which places the vehicle into a conservative safe mode when it encounters an unresolved anomaly, is a documented example.
The design property of an AI system that responds to an input it cannot handle by flagging uncertainty and handing off to a human, rather than producing a confident guess. The intended answer to the brittleness question "what happens on an input it has never seen?"
A design pattern in which an agent, on detecting a reason to distrust its own next move, automatically narrows its own authority (for example, from submitting an action to only proposing it) rather than either continuing at full authority or stopping completely.
Designing an AI capability so a business process still works with reduced function when a dependency is unavailable (for example showing popular items when the recommendation service is down), rather than failing entirely.
A design in which a system steps down through pre-built, tested tiers of reduced capability when it cannot do its full job, rather than failing completely. The lowest tier ("the floor") is an honest fallback message.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- The Off Switch · Bounding by Design, Certified Agentic AI Governance Professional (CAAGP)
- Enterprise Integration Strategy · Technology, Platforms and Vendors, Certified AI Transformation Professional (CATP)
- AI Risk Management · Governance and Responsible AI, Certified AI Transformation Professional (CATP)
- AI System Reliability and Safety Engineering · Risk, Resilience and Frontier AI, Certified AI Transformation Professional (CATP)
- Failure-first design: assuming it breaks and planning for it · Engineering Thinking and Elegant Minimalism, Engineering Judgment and Professional Formation
- Designing so that one failure does not become a disaster · Failure Analysis, Learning From How Robots Break, Engineering Judgment and Professional Formation
- Building a personal learning plan that survives a busy life · Learning How to Learn, Engineering Judgment and Professional Formation
- Space and underwater robotics and their extreme constraints · Frontier and Future Horizons, Engineering Judgment and Professional Formation
Where it shows up at work
A definition is where Graceful degradation starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Plans for a vendor failure, an unsafe model change or a suspended service: rollback, manual fallback, data export and safe decommissioning.
3 lessons on this page teach it as a primary outcome.
Designs tests for factuality, robustness, fairness, safety and abuse resistance with rubrics, baselines and thresholds, and says what a score misses.
2 lessons on this page teach it as a primary outcome.
Keeps the living record: each risk with a named owner, rating, treatment, residual risk, monitoring metric, threshold and review date.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Chief Risk Officer, AI risk editionneeds it at depth
- AI Incident Response Leadneeds it at depth · 1 open posting this week
- Model Risk Managerneeds it at depth
- Chief Information Security Officer, AI security focusneeds working knowledge
- Chief Technology Officer, AI engineering editionneeds it at depth
- AI Evaluation Specialistneeds it at depth · 6 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: DORA; NIS2; NIST AI RMF MANAGE 4; NIST AI RMF MEASURE 1 and 2.
One interview question about it
Your AI vendor shuts down next month. What was in your continuity and exit plan, and what did you fail to plan for?
Asked of candidates for ai resilience, continuity and exit planning. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Cybersecurity and IT carries it as a claim to back up: Continuity and recovery planning are part of the job.
- Model risk, credit risk and quantitative analysis carries it as work you can show: Test design and benchmark selection are the craft.
- A computer science or software engineering degree carries it as a claim to back up: Testing is second nature; AI evaluation design is a new shape of it.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.