Choosing a background job retry policy

Retry network timeouts and 5xx responses with bounded exponential backoff, but send validation failures straight to a review queue.

Include an idempotency key in the job. A retry policy without idempotent handling can turn recovery into duplicated orders or notifications.

Expose the final failure with enough context to replay safely, while redacting secrets and personal data from logs.