Fail-open / fail-closed
Definition
Fail-open and fail-closed describe how a control system behaves during an outage: fail-open lets traffic continue unchecked (availability over control), fail-closed stops it (control over availability). Which behavior is right depends on the risk of the protected actions.
In agent control the two modes form a pair: monitor mode is deliberately fail-open (observation must never endanger operations), enforce mode deliberately fail-closed (an unchecked refund is worse than a delayed one). The per-connection choice belongs in your documentation - auditors ask about it.
Related terms
tokyn.trail puts tracking, rules and human approvals in front of your MCP server - in 10 minutes, no code changes.
Learn more