A workflow needs a plan for items that cannot complete on the first try. Separate temporary failures from conditions that need a person. Design the retry, review, and replay paths before relying on the workflow for routine operations.
Classify the failure
A service timeout or a temporary limit may merit a bounded retry. An invalid record, missing permission, or conflicting decision normally needs correction or review. Preserve the item identifier and a safe error reason. Decide what data an operator needs to diagnose the issue without copying secrets into a log.
Protect against duplicate actions
Identify a stable event or record key and decide how the destination can recognize a completed action. Treat a timeout after a write as uncertain until the destination is checked. Use limits and increasing wait periods where the service supports retries. Define what ends automatic attempts and where the item goes next.
Rehearse a controlled replay
Send an example through a temporary failure, a permanent failure, and an ambiguous result. Check that the review queue identifies the owner and preserves the information needed to recover. Before replaying, compare the source item with the destination record. Record the outcome so the next person can see what was attempted.
Example
Show how a repeated order event is reconciled and a missing account is assigned for manual review.
What to do next
Define a bounded retry and a human recovery path for each important operation, then test both with representative items.