What is Fail-Closed?
Fail-closed is a security posture where if PolicyLayer cannot evaluate a policy — due to a configuration error, crash, or unexpected condition — the tool call is denied by default, ensuring no unvalidated operations reach the MCP server.
WHY IT MATTERS
Every security system must answer the question: "What happens when things go wrong?" There are only two answers. Fail-closed denies access when uncertain. Fail-open allows it. In the context of AI agents calling external tools with real-world consequences — creating charges, modifying files, deploying code — the safe answer is almost always fail-closed.
The reasoning is straightforward: the cost of a false denial (agent cannot complete a task, human intervenes) is almost always lower than the cost of a false allowance (agent executes an unvalidated operation with potentially irreversible consequences). A denied tool call is an inconvenience. An uncontrolled tool call could be a security incident, a financial loss, or a compliance violation.
Fail-closed is the default in mature security systems for good reason. Firewalls fail-closed. Kubernetes admission controllers fail-closed. Certificate validation fails-closed. These systems prioritise safety over availability because the consequences of uncontrolled access are worse than the consequences of denied access. The same logic applies to AI agent governance.
HOW POLICYLAYER USES THIS
PolicyLayer defaults to fail-closed behaviour. If the policy evaluation pipeline encounters an error — malformed policy, unexpected argument type, internal error — the tool call is denied with a descriptive error message. This extends to startup: if policy files cannot be loaded or validated, PolicyLayer refuses to start rather than operating without policies. Fail-closed behaviour is configurable per-server for development environments where fail-open may be preferred.