Fail closed without confusing denial, outage and stale state

In traditional web applications, “Fail Open” is a reasonable default. If the authentication service is down, you might choose to allow cached sessions to continue — because the cost of locking out users exceeds the security risk of the brief gap. The application fails gracefully, users stay productive, and the security team accepts a small, bounded risk.

Autonomous agents have no equivalent. “Fail Open” for an agent means the agent continues executing — calling tools, taking actions, spending money, modifying data — while your security controls are offline. The gap is not brief. The agent doesn’t wait.

The Multiplication Problem

A single human hitting a website during an auth service outage creates one session worth of risk. An autonomous agent calling tools during an enforcement outage creates risk proportional to how fast it can work.

A high-frequency trading agent processes thousands of decisions per minute. An orchestration agent managing customer support might handle hundreds of concurrent sessions. During a 5-minute enforcement outage, these systems can take thousands of ungoverned actions — actions that cannot easily be reversed.

This is the multiplication problem: autonomous systems scale their damage during failures in ways that human systems do not. Fail Open for agents is not a minor risk. It is an existential risk for the deployment.

What “Fail Closed” Means in Practice

Fail Closed for AI agents means: if the policy enforcement layer cannot evaluate a tool call, the tool call is blocked.

Not delayed. Not retried. Not allowed through while logging a warning. Blocked.

The agent receives a structured error:

{
  "error": "enforcement_unavailable",
  "tool": "payments.transfer",
  "decision": "deny",
  "reason": "Policy engine unavailable. Fail-closed default applied.",
  "retry_after": 30
}

The agent can be configured to handle this in several ways:

• Surface the failure to the user and pause
• Place the task in a queue for retry when the enforcement layer recovers
• Escalate to a human operator

What it cannot do is proceed with the tool call.

Designing for Fail Closed

Building a Fail Closed system that stays fast in the execution path requires careful architecture. The naive approach — checking with a central policy service on every call — creates a single point of failure that blocks all agent activity when the service is down.

Where GovernorAI fails closed, and where it does not

• The gateway adapters. The Envoy ext_proc, MCP proxy and forward-auth adapters treat a transport error, timeout, non-2xx response or unreadable verdict from the GovernorAI gateway as a deny, and mark the denial as fail-closed so it is not mistaken for a policy deny.
• No matching policy. When no policy matches an action, the gateway denies it.
• Kill switches on a customer-managed gateway. A gateway that takes its kill switches from a signed policy bundle denies every call when that bundle is missing or expired, because it cannot confirm which switches are active.

Some paths can still let a call through: embedded OPA before it is initialised, hybrid mode after an OPA error (it falls back to the built-in verdict), a policy with fail_closed off for the tools it does not list, and some framework integrations. A customer-managed gateway keeps serving its last tenant snapshot while the control plane is unreachable, so a control-plane outage does not stop it. Check the path you deploy.

The Safe State

An enforcement point that fails closed defines a “Safe State” — what it does when it cannot get a decision. At the GovernorAI gateway adapters, the Safe State is: no new tool call proceeds without a verdict. A call already decided is not recalled. The rule is the same every time, so a team knows what an adapter will do during an outage.

Autonomy and Safety Are Not Opposites

There is a misconception that Fail Closed makes systems less autonomous. In reality, it makes systems more deployable. Organizations that cannot guarantee safe behavior during failures will not deploy high-autonomy agents in production. Fail Closed is what enables confidence — and confidence is what enables autonomy.

Agents that fail safely earn more trust. Agents that earn more trust get more permissions. More permissions mean higher value. The path to autonomous AI at scale runs through Fail Closed.