On 6 August a purchase-order chase reached its approval step exactly as designed. It paused, wrote the case to the record, and emailed a draft out for sign-off.
Twenty-one of twenty-one verification checks were passing. The workflow was active. The execution was parked, waiting on a human, which is what a correctly waiting execution looks like.
The approver could not open the link. The address pointed at a name that only resolves inside the machine the software runs on. Nothing reports that, because from the software’s seat nothing is wrong: it sent a link and it is waiting, patiently, indefinitely.
I would have signed that off. Twenty-one of twenty-one is what a release gate is supposed to tell you.
That was our own 7Flows test environment, which is the only reason this story is cheap.
The failures that cost you are the quiet ones. The workflow reports healthy, the design looks exactly like the one you approved, and the work is not happening.
An error is a different animal. It interrupts somebody, lands in a queue, and eventually gets opened. What you have to design for is the class that never produces one.
01The Hour Nobody Noticed
That same week the same system stopped picking up mail for over an hour.
Nothing reported it. The workflow was marked active. No execution failed. The error handler never fired, and the reason is the point: there was no execution to fail.
Two vendor defaults caused it, and neither is a bug.
The first reconnects to the mail server every sixty minutes. In between, the software depends on the server pushing new messages down a connection it holds open — and connections held open that long get closed routinely, by firewalls, by load balancers clearing idle sessions, by Exchange throttling. Nothing announces it. The workflow still reads as active.
The second is worse. The trigger fetches only mail newer than a pointer it keeps, so anything that arrived while the connection was dead is skipped. Permanently.
We run self-hosted n8n and these are its defaults. Every platform ships choices like these and each is defensible alone. What costs you is the pair of them together, and that nothing tells you when they bite.
The fix took two parts and only the second matters. We overrode both defaults, which makes the gap unlikely. Then we put a probe on a schedule running outside the platform, which is what makes an outage noticed. A watchdog living inside the thing it watches goes down with it and takes its silence along.
Run that at a manufacturer and an hour is not the story. Supplier replies stack up unread, the chase keeps reporting fine, and the first symptom is a buyer asking why a supplier never came back — weeks later, against an audit trail showing the workflow did nothing.
An error handler cannot catch a failure that never produced an execution.
02Detection Gets Its Own Score
Anyone who has run an FMEA has already priced this. You rate three things: how bad the failure is, how often it happens, and whether your controls would catch it. That third one is rated on its own — on the maturity and capability of the detection controls, not derived from the other two.
So hold severity and frequency still, move detection alone, and the priority moves with it. In the AIAG-VDA tables, a failure scoring 7–8 on severity and 4–5 on occurrence comes out Medium priority when the detection controls are proven, and High when there is no established detection method. Same damage, same frequency. The only thing that changed is whether anyone would find out.
The wording on the worst detection rating is worth reading cold: no testing or inspection method has been established or is known. The failure mode will not or cannot be detected.
That is the honest score for a workflow whose only health signal is that it has not complained.
Software operations got there from a different direction. NeuBird’s 2026 State of Production Reliability report, covering over a thousand operations engineers, found almost 40% of incidents are discovered by customers before the engineering team knows anything is wrong, and 78% of organizations had at least one incident where no alert fired at all. It is a vendor survey — NeuBird sells AI incident response, so it is measuring the problem its product is sold against. Weight it accordingly. The direction is not controversial.
03The Setting Nobody Set
A supplier chase went out from our test environment under a purchasing address, carrying a footer we never wrote: this email was sent automatically with n8n, and a link to the vendor’s website.
The sending step has an option that appends it, and it defaults to on. The platform adds the footer after the message is composed — after the template, and after the draft a human approved at the gate. A template with no links in it does not produce a message with no links in it.
An option nobody set renders as nothing at all. You can open that step, look for an attribution setting, find none, correctly conclude that nothing is set, and still be wrong about what leaves the building. Our own notes on that step said no URLs while it was leaking one.
Two fixes, and again the second matters more: turn the option off everywhere, and check the delivered message instead of the template. At a manufacturer that footer reaches a real supplier on the first production send, under the client’s own identity, and there is no recalling it.
04Check It From Outside
Every one of these was found the same way. Something outside the system checked the outcome the system was supposed to produce.
The rule is not sophisticated. Run the probe somewhere else, on its own clock. Inspect the message that was delivered, not the template that made it. Click the approval link from the chair the approver sits in — not from the server, and not as an administrator on the same network, because that passes.
None of it shows up in a demo, and it is the first thing cut when a project is behind. It is also why a workflow that has been running fine for six weeks sometimes turns out to have been running nothing.
Green is a status. Evidence is something a person went and got.
What in your operation is reporting healthy right now — and when did anyone last check it from outside?