Fail-closed is treated as a config flag.
It is a property of six separate places, and each can become fail-open on its own:
- missing rule returning allow;
- recompute falling back to client-supplied values;
- warm cache never re-checked against source;
- blanket except;
- legacy path that predates the gate, and non-atomic grant consumption.
The dependency table is where people get it wrong:
Policy evaluation fails -> Block
Budget reservation fails -> Block
Audit write already durable -> Allow + retry
Telemetry fails -> Allow + drop
Treating every dependency the same is how fail-open gets introduced by careful people.
Read full article here
Top comments (0)