Infrastructure · Primitives
FailClosed
Default-deny policy for uncertain states
Definition
Mechanism
Safety Default. If an operation fails, times out, or returns an ambiguous result, the system MUST treat it as a Negative (Deny/Stop/Reject). Prevents 'bypass on error' vulnerabilities. It acts as the wrapper for input guarding, OutputGuard, and CircuitBreaker, enforcing a default-deny policy on any error or ambiguity.
Preconditions
- Fallible operation initiated
Postconditions
- System state remains invariant (no side effects) OR Operation succeeds
Invariants
- Default Deny: Ambiguity == Rejection.
- Error Atomicity: Partial failure = Total failure (Transaction Rollback).
Risks
Failure modes
Availability Hit
System shuts down during minor outages (False Positive Denial).
Dependency Deadlock
a non-critical dependency fails and the system locks up; compounds along a chain of fail-closed dependencies.
Relationships
Builds on
References
Fail-fast protection against cascading failures
Final egress filter for safety and privacy
Complex whole of interacting parts
Used by
References
Society
Standard patterns for multi-agent coordination
Runtime anomaly signal
Society
When verification fails, fall back to inline definition
Input validation and sanitization
Society
Stub, hash, and homograph collisions are different threats
Composes with
Society
Discover and invoke external tools via structured capability manifests
Reference
Parameters
timeout_actionEnum, {Reject, BoundedRetry}- Default: Reject. BoundedRetry defers the denial, it does not replace it. A fallback route on error is excluded — that is bypass-on-error.
retry_limitPositiveInteger, [1, 10]- Attempts before Rejecting when timeout_action is BoundedRetry.