Fail-Closed vs. Fail-Open: The Decision That Defines Your Agent's Security

Every security system eventually hits a case it can't classify. The question is what happens then. Fail-open means: when in doubt, allow it. Fail-closed means: when in doubt, block it. For agent security, this is the single most important design decision you'll make.

Fail-open is a suggestion box

Fail-open is tempting because it's convenient. The agent keeps working, nothing gets blocked, no one gets annoyed. But it means your enforcement layer is a suggestion box. An attacker who finds an edge case, an ambiguity, or a novel technique gets through, because the system defaulted to allowing.

Fail-closed is the only real boundary

Fail-closed is the opposite. When the system can't verify that an action is safe, it doesn't happen. That's inconvenient, but it's the only posture that actually protects you. The cost of a false block is a minor annoyance. The cost of a false allow is a breach.

Why the default matters more than the rules

You can write perfect rules and still lose, if the default is to allow when the rules are ambiguous. Attackers don't need to beat your rules. They just need to find the gap where your system shrugs and lets something through. The default is the real security posture; the rules are just the edges.

This is why AgentInterdict is fail-closed by default. If we can't prove an action is safe, it doesn't execute. That's not a bug. It's the entire point.