Every system that produces something eventually hands you a success signal: a 200, an "ok," a job marked complete. It is tempting to treat that as the end of the story. It is the middle.
On Whitespace, our app that turns writing into narrated audio, a text-to-speech vendor once returned eighteen minutes of audio for a five-minute session. No error. The job reported complete. Everything downstream believed it. A user would have pressed play and been stuck in a session more than three times longer than they asked for, in an app meant to help them fall asleep.
A global limit would not have caught it. "Sessions should not run past thirty minutes" lets eighteen minutes through without blinking. What caught it was a smaller, sharper check: each chunk of audio was measured against a ceiling derived from its own input text. A given amount of text can only produce so many seconds of speech. When the numbers did not reconcile, we retried the chunk, and if it kept misbehaving we failed loudly, with no charge to the user.
This gets more important every month, because more of what our systems consume is machine-generated. The AI writing the code, the model producing the content, the vendor returning the data: all of them will, at some point, hand back something confidently wrong with a success status attached. "It ran" and "it is correct" are different claims. Only one of them is verified by a green checkmark.
The habit worth building: for anything generated or third-party, check the output against an invariant derived from its own input, not against a global cap. A cap catches the catastrophic. An invariant catches the merely wrong, which is more common and, over time, more expensive.