---
slug: "FailClosed"
name: "FailClosed"
type: "Primitives"
layer: "Infrastructure"
ref: "FailClosed#dfbc"
sema_id: "sema:FailClosed#mh:SHA-256:dfbcf50c68d036ae4f18719bf59f41eddd83b5510bd60ff1326f8854240d8066"
tags: ["Infrastructure","Primitives"]
updated: 2026-11-11
mindscape: "bootstrap"
index_url: https://mindscape.pages.dev/bootstrap/index.json
url: https://mindscape.pages.dev/bootstrap/FailClosed/
related: ["CircuitBreaker","OutputGuard","System","AgentProtocol","Exception","GracefulDegradation","InputGuard","ThreeLevelCollision","ToolDiscovery","ErrorCostAsymmetry"]
---

# FailClosed

Default-deny policy for uncertain states

Layer: Infrastructure · Category: Primitives

## Mechanism

Safety Default. If an operation fails, times out, or returns an ambiguous result, the system MUST treat it as a Negative (Deny/Stop/Reject). Prevents 'bypass on error' vulnerabilities. It acts as the wrapper for input guarding, [OutputGuard](https://mindscape.pages.dev/bootstrap/OutputGuard.md), and [CircuitBreaker](https://mindscape.pages.dev/bootstrap/CircuitBreaker.md), enforcing a default-deny policy on any error or ambiguity.

## Invariants

- Default Deny: Ambiguity == Rejection.
- Error Atomicity: Partial failure = Total failure (Transaction Rollback).

## Preconditions

- Fallible operation initiated

## Postconditions

- [System](https://mindscape.pages.dev/bootstrap/System.md) state remains invariant (no side effects) OR Operation succeeds

## Failure modes

- Availability Hit: [System](https://mindscape.pages.dev/bootstrap/System.md) shuts down during minor outages (False Positive Denial).
- Dependency Deadlock: a non-critical dependency fails and the system locks up; compounds along a chain of fail-closed dependencies.

## Parameters

- `timeout_action` (Enum, {Reject, BoundedRetry}): Default: Reject. BoundedRetry defers the denial, it does not replace it. A fallback route on error is excluded — that is bypass-on-error.
- `retry_limit` (PositiveInteger, [1, 10]): Attempts before Rejecting when timeout_action is BoundedRetry.

## Builds on

- [CircuitBreaker](https://mindscape.pages.dev/bootstrap/CircuitBreaker.md) (Infrastructure; References)
- [OutputGuard](https://mindscape.pages.dev/bootstrap/OutputGuard.md) (Infrastructure; References)
- [System](https://mindscape.pages.dev/bootstrap/System.md) (Infrastructure; References)

## Used by

- [AgentProtocol](https://mindscape.pages.dev/bootstrap/AgentProtocol.md) (Society; References)
- [Exception](https://mindscape.pages.dev/bootstrap/Exception.md) (Infrastructure; References)
- [GracefulDegradation](https://mindscape.pages.dev/bootstrap/GracefulDegradation.md) (Society; References)
- [InputGuard](https://mindscape.pages.dev/bootstrap/InputGuard.md) (Infrastructure; References)
- [ThreeLevelCollision](https://mindscape.pages.dev/bootstrap/ThreeLevelCollision.md) (Society; References)
- [ToolDiscovery](https://mindscape.pages.dev/bootstrap/ToolDiscovery.md) (Society; Composes with)

## Identity

- Sema ID: `sema:FailClosed#mh:SHA-256:dfbcf50c68d036ae4f18719bf59f41eddd83b5510bd60ff1326f8854240d8066`
- Ref: `FailClosed#dfbc`
- Supersedes:
  - `sema:FailClosed#mh:SHA-256:ae79e8e091ca9f68f749936a99d55a386fba49254f9e7e958806b16b860332a1`
  - `sema:FailClosed#mh:SHA-256:eae70da02880916a695d85d3752a59e16201c9f81b8a9af238d31863b3b6b157`
  - `sema:FailClosed#mh:SHA-256:408814ddae0d3fa2b4022f997c1feab5eef743a155cdedeba75bc42d26e467ac`
  - `sema:FailClosed#mh:SHA-256:ac1b0e4a6452ffc852d32a25914ef7907a49428004765f92e68ac7d232530ad0`
  - `sema:FailClosed#mh:SHA-256:d23bf6663e53ecbee5c12a120f4fe379c1dfe8bc05f0b9bf2250703d4131faaf`

## Links

- [Pattern page](https://mindscape.pages.dev/bootstrap/FailClosed/)
- [View in the interactive graph](https://mindscape.pages.dev/bootstrap/#FailClosed)
- [JSON](https://mindscape.pages.dev/bootstrap/FailClosed.json)
- [Index of all patterns](https://mindscape.pages.dev/bootstrap/index.json)