SUMMARY: A system makes policy during failure through the outcomes it preserves, denies, delays, or delegates when ordinary dependencies are unavailable. Fail-open and fail-closed are not merely engineering defaults. They distribute risk and continuity.
Every service has a degraded state, even when it is undocumented. A credential check times out. A payment ledger becomes read-only. A moderation queue stops loading. A correction cannot reach a downstream partner. The remaining code and procedure decide what happens next.
Fail-Closed Protects One Side of the Boundary
Denying an action when verification fails can protect funds, infrastructure, and safety. It can also strand a person whose valid credential cannot be confirmed. The rule transfers uncertainty to the participant and treats interruption as the safer outcome, regardless of who bears its cost.
Procedural borders become especially visible here. A dependency outage turns an administrative check into a hard boundary because the system has no alternate proof path.
Fail-Open Can Preserve Hidden Exposure
Allowing continuity can reduce immediate harm, but an unbounded fail-open state may preserve obsolete permissions, bypass revocations, or accept transactions that cannot be reconciled. The decision is defensible only when scope, duration, evidence, and rollback are explicit.
Otherwise degraded service develops provisional permanence. A temporary exception remains because normal verification never returns cleanly, and the emergency route becomes an undocumented entitlement.
Queues Are Failure Policy Too
Many systems neither allow nor deny; they defer. Requests accumulate until a dependency recovers or an operator reviews them. Queue order then becomes policy. Priority tiers, retry limits, expiration rules, and missing status notices determine who waits longest and who must begin again.
Corrections deserve special treatment. If a restriction can continue offline but its remedy waits for full restoration, the architecture extends harm through correction lag.
Define the Consequence Before the Default
Choose degraded behavior by consequence class, not convenience. Specify maximum duration, participant notice, evidence retained, operator escalation, and the reconciliation required when normal service returns. Test the rule with people and obligations at the edges, not only the most common transaction.
Intel assessment: when infrastructure fails, its defaults reveal which losses the institution has already decided are acceptable.