How would you design a production AI agent to hit 99.9%...

High availability for an agent is mostly standard distributed-systems design, with one failure mode that’s specific to agents: the LLM provider itself becoming unavailable.

• Stateless workers. No agent state should live in a worker process’s memory — it belongs in an external store (Postgres, Redis) keyed by a thread or session ID. A crashed worker then loses nothing but the one task it was mid-way through, and any healthy worker can pick up any request, which is what makes horizontal scaling and failover both trivial.
• Multi-region, active-active. Traffic routes to whichever region is currently healthy. A regional outage — a real, recurring event at cloud-provider scale — degrades capacity rather than taking the system fully down.
• LLM provider failover. This is the piece specific to agents and the one most designs skip. Configure a primary provider and at least one fallback, and switch automatically once the primary’s error rate crosses a threshold. Depending on a single provider for a production-critical agent is a single point of failure exactly as serious as depending on a single database with no replica.
• Per-tool circuit breakers. Each external tool gets its own breaker: repeated failures open the circuit, and subsequent calls get a cached result or a degraded response instead of hanging the entire run waiting on something that isn’t coming back.
• Graceful degradation as a design principle, not an afterthought. If a search tool is unavailable, answer from the model’s own knowledge with an explicit disclaimer rather than failing the whole request outright — a partial, honestly-labeled answer beats no answer.

None of these individually gets you to 99.9%; together, they mean no single failed component — a worker, a region, a provider, or a tool — takes down the whole system.