Failure Messages That Don't Lose the Citizen

The kiosk said '504 Gateway Timeout' at 11:40 in a hall where nobody knew what a gateway was. The next screen said 'please try again later' in English after a Hindi session. There was no ticket. There was no window number. The man in the queue had taken casual leave. He did not try again later. He told the bus.

Agents fail. Models refuse, hallucinate, time out, lose a tool, meet a font that will not render, or simply do not have the language. The failure message is the last public servant in the room. If that servant is a raw exception, you have chosen to be rude at scale.

This guide is the failure chapter of the style sheet. Write it before go-live. Test it by pulling the plug, not by hoping.

Not legal advice. Outage communications for some services may already sit under departmental or sector instructions. Follow those first.

The anatomy of a failure that does not lose the person

Language of the session, not the language of the log. If you cannot render that language, use a pre-translated pack, not a model that is already on fire.

A cause class the citizen may hear: we could not read the file, we could not reach the record, we do not offer this language, we are down, we are not sure and will not guess. Not the exception name. Not a lie that 'the server is busy' when the model refused.

One next step: wait here for window 3, call this number, come on this day, upload again as a photo, ask the clerk to take over. If there is no next step, you have published despair.

A reference the department can find: a ticket, a correlation ID that is not an Aadhaar, a time. Staff must be able to pull the packet from that reference.

Classes you should pre-write

Do not generate failures from the same model that just failed. Pre-write them. Version them. Translate them as a pack. The model may choose a class. It may not invent a cause.

Pre-written classes. Fill the next-step column with your real desks.

Class	Citizen-safe meaning	Must include
DOWN	The service is not working	Human path + when to retry if you know
LANG	We cannot continue in this language	Desk that can, or another channel
UNREAD	We could not read the document	What to photograph, or human scan
UNSURE	We will not guess	Human path; no invented scheme
REFUSE-RIGHTS	This needs an officer	Why in one line + desk; no fake yes
IDENTITY	We could not match the record	What to bring; no partial Aadhaar echo

What never to show

Stack traces, model names, vendor ticket URLs, internal hostnames, other citizens' data, and full identity numbers. CERT-In and ordinary security practice already hate this. Dignity hates it too.

Humour. A failing pension kiosk is not the place for a shrug emoji.

Blame. 'You spoke unclearly' may be true in a lab and still be the wrong public sentence. Prefer 'we could not understand; here is another way'.

False hope. 'Your request is probably approved' is a new failure.

Test by breaking it

In UAT, kill the tool, kill the model, serve a language you do not have, upload a black photograph, and pull the network. Photograph each screen. If any screen is English-only after a Hindi session, the pack is incomplete.

Citizen testing must include one forced failure. People decide whether to trust you when you fail, not when you are on the happy path.

Two failures, only one kept the person

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We cannot know the cause in production.

You can know the class. Map exceptions to classes offline. Unknown maps to DOWN or UNSURE plus a human path. Never maps to a raw string.

Pre-written messages will be stale.

Version them with the scheme list. Stale next-step phone numbers are a real risk — own them like any other public number.

The model can generate a nicer apology.

The model can also generate a nicer lie. Apologies are templates.

[IVRS](/blog/designing-ivr-agents-for-rural-callers) cannot do all this.

Then IVRS gets a shorter pack: class, next step, callback number. Do not play a thirty-second English error on a vernacular line.

Two weeks to a failure pack

Write the pack in the languages you claim, including the language you are weakest in.

1. Week 1: list classes. Draft one message each, with a next step that exists. Translate as a pack, not via the live model.
2. Week 2: map exceptions to classes. Break the system in UAT. Photograph. Fix the English leaks. Add the pack to the standing order.

File note you can paste

Subject: Citizen-facing failure messages — pre-written pack.

Raw exceptions will not be shown. Each failure maps to a class in the attached pack, in the session language, with a next step and a reference. Forced-failure tests are part of UAT. This note is not legal advice.

Channels that fail differently

A kiosk can print a token. An IVRS cannot. A WhatsApp session can send a PDF. An SMS cannot. Write the pack per channel, not one paragraph reused everywhere. The class can be shared. The next step cannot.

WhatsApp is where departments hide English errors behind a blue tick. If the session was in Hindi, the failure must stay in Hindi even if the BSP template was registered in English. Register the templates. That is a TRAI / BSP job and a language job at once.

If you use a QR poster in a hall, the poster is a failure surface when the network is down. Print the human path on the poster. A QR that opens a 504 is how you spend print money to insult people.

What we will pre-write

Prcept AI will ship class-based failures you edit, on your side, in the languages you tested. We will not let a dying model narrate its own death. We will fail UAT if a Hindi session ends in an English stack trace.

A sovereign agent that fails in the citizen's language is still a public servant. One that fails in HTTP is a leak.

This article is informational field guidance for Indian public institutions, not legal, language-policy, procurement, finance or engineering advice. Confirm against the live Gazette, Official Languages Act and Rules, your State's official-language law, MeitY / IndiaAI notices, GFR, GeM terms, DPDP text, departmental manuals and your counsel before you file it.

How to test this with real speech, not staff English

“Failure Messages That Don't Lose the Citizen” fails in the field if you only tested officers. A P1 CIO/CTO should hear a first-generation student, a rural caller, or a Hinglish grievance before claiming “AI error message design”.

A stack trace in English is how you lose a citizen who did everything right. Failure is a designed state: language match, honest cause class, one next step, a ticket, a human path. If you did not write the failure, the model will write a worse one. Twenty-two scheduled languages is a Constitution fact, not a model fact. Script support is not language support. Official language rules may require bilingual output even when the model prefers one script.

• Name the languages and scripts in the eval set.
• Include code-mix and scheme-name tests.
• Measure comprehension, not BLEU alone.
• Design a human fallback when language fails.

Close this loop before the next CAB

Put “Failure Messages That Don't Lose the Citizen” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI error message design” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “Failure Messages That Don't Lose the Citizen” is only a heading, it will not survive a file inspection. A P1 CIO/CTO should be able to attach one artefact that proves “AI error message design”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “AI error message design” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.