Perhaps you can get some ideas from what I do:
I use a parastolic pump with the ATO water below tank level to prevent siphon and ensure water can not fill too fast.
I limit the amount of time the pump can possibly run per day so that under normal circumstances it would take over 4 days to over flow the sump even if stuck on. I think it runs for a max of 60 seconds per 15 min in my case, but I'd have to look it up to be sure.
I have an Avast pressure sensor (most reliable I've found) for normal level control.
I pair that with a float sensor for too low (email alert, return shuts off) and an optical sensor for too high (they can fail on, but never off IME).
Finally, I have a leak detector.
The only single point of failure is the APEX powerbar that flips on the pump. If this fails I have a max of 20G available to the system, and it would take many hours to dose it (you never want a pump that's too fast for this, the time gives me a better chance of catching it). This would cause about 5G worth of flood if I did not catch it. To mitigate this risk I could have a mechanical timer that only allows dosing in a few windows throughout the day.
But, my concern is low because the APEX power bar is much more likely to fail off than on with a relay outlet and low power draw. It's also programmed to fall back to the off position in case of loss of communication of course.
Whiskey