How a RAG agent fabricated support answers while all monitoring showed green

A support agent confidently gave a user completely fabricated steps for resetting two-factor authentication, yet every monitoring dashboard reported a successful 200 response with normal latency. The root cause was an empty retrieval step that returned no relevant documentation, after which the language model simply invented a plausible-sounding answer to fill the gap. Standard monitoring tools treat an entire agent run as a single HTTP call, making them blind to failures occurring inside intermediate steps like retrieval or tool calls. The engineer resolved the issue by adding a short-circuit guard that halts the pipeline when retrieval returns empty, and by configuring the agent to explicitly tell users when it cannot find relevant documentation. The key debugging insight was visualising each agent run as a nested tree of steps rather than a single event, which made the empty-retrieval failure immediately visible instead of appearing as a random hallucination.