Classify failures first
Retry transient network interruptions, rate limits, or temporary unavailability only when the operation is safe to repeat. Do not keep retrying validation or permission errors that require a changed request or configuration.
Choose a maximum attempt count and elapsed-time budget based on the workflow’s purpose and user expectations. Add jitter when many jobs could retry together, and honor a service-provided retry-after value where applicable.
Make exhausted work recoverable
When the limit is reached, move the item to a visible failure or review state with its attempt history and correlation identifiers. Avoid discarding the original payload or losing which side effects already completed.
Provide a controlled replay path after the cause is fixed. Preserve idempotency keys and check prior effects before retrying so recovery does not create duplicate payments, messages, or records.