RS Glossary
Fail-closed
A control is fail-closed when a failure, missing check, or unresolved uncertainty makes it deny, stop, or enter a restricted state instead of allowing the action to continue.
- Review state
- Reviewed in POC
- Freshness
- Current
- Version
- 1
- Fail-closed
- Fail Closed
Remember it this wayIf the check cannot say yes, the system says no.
In plain language
The system needs a valid yes before it proceeds. If a permission service is unavailable, a rule cannot be evaluated, or a required approval is missing, the safer default is to stop or reduce capability rather than assume permission.
Why it matters
AI agents can act across changing tools, identities, and data. A permissive default can turn a temporary outage or ambiguous state into an unauthorized action. A fail-closed design contains that uncertainty and creates a clear path for recovery or escalation.
Example
An AI payment agent cannot reach the service that verifies transfer authority. It does not send the payment. It places the request in a restricted queue and asks an authorized person to resolve the failed check.
Common misconception
Fail-closed is not always the safest behavior for the whole system. A locked emergency exit, unavailable medical device, or blocked recovery path can create a different danger. Designers must choose the safe failure state for the actual consequences and provide a controlled way to recover.
Related terms
Sources
- NIST CSRC, “fail secure”describes termination that preserves a secure state when a failure occurs or is detected.
- IETF, RFC 4949, *Internet Security Glossary, Version 2*provides the underlying security terminology for failure modes that do not compromise security.
Learn more
- Identify which operations must stop through [[guardrails|Guardrails]] and which conditions require a documented [[exception|Exception]].
- Connect fail-closed behavior to live enforcement through [[runtime-governance|Runtime Governance]].
Public history
30 recorded events · 30 public summaries
A potential shared concept was discussed and selected for initial glossary drafting.
The captured candidate received a complete initial draft and entered section-level human review.
Radar reviewed the initial definition draft for human consideration.
Radar reviewed the initial plain-language-explanation draft for human consideration.
Radar reviewed the initial why-it-matters draft for human consideration.
Radar reviewed the initial example draft for human consideration.
Radar reviewed the initial common-misconception draft for human consideration.
Radar reviewed the initial remember-it-this-way draft for human consideration.
Radar reviewed the initial related-terms draft for human consideration.
Radar reviewed the initial sources draft for human consideration.
Radar reviewed the initial learn-more draft for human consideration.
Definition review recorded as approve.
Plain-Language Explanation review recorded as approve.
Why It Matters review recorded as approve.
Example review recorded as approve.
Common Misconception review recorded as approve.
Remember It This Way review recorded as approve.
Related Terms review recorded as approve.
Sources review recorded as approve.
Learn More review recorded as approve.
All wording and media review gates are approved; the term is now canonical.
Definition review recorded as approve.
Plain-Language Explanation review recorded as approve.
Why It Matters review recorded as approve.
Example review recorded as approve.
Common Misconception review recorded as approve.
Remember It This Way review recorded as approve.
Related Terms review recorded as approve.
Sources review recorded as approve.
Learn More review recorded as approve.
Source: vault/Glossary/terms/fail-closed/term.md · sha256:9ef1a99b2fe11f66394c912adc5b1013b9db42f46a20ebb2d6616647deea6440 · Release: rs-glossary-glossary-team-poc-0.5.5-2026-09-02