Fail-closed
Fail-closed means a system denies when in doubt: if information is missing or a check fails, the action is not executed.
For agents this is the only defensible default. A verifier that lets actions through on error grants a blanket authority whenever something breaks. The verification model follows the same principle: what could not be checked never counts as proven.
Example
A decision service cannot fetch a mandate's status list. Following the fail-closed principle, it denies the payment instead of allowing it for lack of counter-evidence.
How it differs
Fail-open lets things through when in doubt; fail-closed stops them. For payments and legally binding actions, fail-closed is the cautious choice; for pure information, fail-open can be acceptable. What matters is that the rule is chosen deliberately and documented for every check.
In practice
- For every check, define what happens when information is missing. Unclear cases should never silently count as allowed.
- Distinguish between a technical failure and a negative result, and log both separately. This shows whether a system is disrupted or an agent tried something it was not allowed to do.
- Test failure behavior regularly, for example with a deliberately unreachable status list, and confirm that the action is actually denied.
Role in KYA
KYA applies the principle to the verdict: what is not proven does not count as valid. If essential evidence is missing, the verdict is “indeterminate”, never “valid”.
A term from the flow, not a check of its own. To the method
Frequently asked questions
What does fail-closed mean?
In case of an error or missing information, an action is denied rather than allowed.
Why does fail-closed matter for agents?
Because otherwise an agent could act unchecked whenever something fails, such as an unreachable status list.
How does KYA implement fail-closed?
If core evidence is missing, such as the revocation check, the verdict is not “valid” but “indeterminate”, with reasons in the certificate.
Is fail-closed always the right choice?
For actions with consequences, such as payments or contracts, yes. For pure read requests, a less strict rule can be acceptable if it is chosen deliberately.
How does KYA tell invalid from indeterminate?
Invalid means evidence is disproven, for example by a wrong signature. Indeterminate means nothing is disproven, but not everything essential is proven.
Does fail-closed make systems unreliable?
It makes disruptions visible rather than dangerous. A denied action can be repeated once the disruption is fixed; a payment allowed by mistake often cannot be recovered. Good monitoring keeps such denials rare.