Fail closed by construction

The quiet default

Ask an agent platform what happens when its policy service times out and you often get a pause. The honest answer is usually that the call proceeds, because blocking on an unreachable dependency felt unacceptable during implementation.

That is a policy decision made by an exception handler. It is also the failure mode an attacker will aim at: any control that degrades open can be disabled by making it slow.

Invariants a tenant cannot switch off

Configurability is good, but some conditions should not be configurable at all. A useful line: tenants configure what is permitted; they never configure away the conditions under which the system refuses to decide.

• Classification absent, unavailable or errored denies.
• Classification from an unpinned model denies.
• Identity assurance below the configured floor denies.
• No matching rule resolves to the configured default of deny or review.
• A malformed request or policy denies with diagnostics, and never throws.

Order of operations is a security property

Write the decision to the ledger before the upstream call, and make a failed append a denial. It feels backwards until you consider the alternative: a system that logs after the fact has, by definition, a window in which actions happen unrecorded.

The same logic applies to credentials. Mint the token after the decision, scope it to that call, and make it single-use, so a decision and its authority cannot drift apart.

Say the cost out loud

Fail-closed trades availability for containment. When the classifier is down, work stops for calls that needed it. That is a real cost and teams should choose it deliberately — which is also why tool profiles matter: a profiled tool needs no classifier and keeps working.