Fail-Closed vs Fail-Open
Also: fail-safe vs fail-secure · default-deny on error · secure failure mode
When a safety check errors or is unavailable, deny the action (fail-closed) rather than allow it (fail-open).
Why CCAR-P tests this
The exam checks whether you understand that a control which fails open provides worse-than-zero security by creating false assurance.
A control fails closed when, on any error, timeout, or unavailability, it denies the protected action. It fails open when, under the same conditions, it allows the action through. For a safety or authorization control, fail-closed is almost always correct.
The key insight the exam wants: a control that fails open is worse than having no control at all. With no control, everyone knows the path is unguarded and treats it accordingly. With a fail-open control, the system looks protected — it passes reviews, appears on the control register — but silently lets requests through whenever the moderation API is down, the classifier throws, or a timeout fires. Attackers can even induce the failure (e.g. by overloading the check) to bypass it.
Design each guardrail so its error path is deny. If a content filter, injection detector, or authorization service cannot return a clear allow, treat the result as a block and, where appropriate, escalate. Reserve fail-open only for non-security features where availability genuinely outranks safety, and make that trade-off explicit.
Exam trap
"If the moderation service times out, let the request proceed so users aren't blocked" is the trap — that is fail-open, and it converts a control into a false sense of security.
Commonly confused with
Independent, unofficial study material from Claude Cert Prep. Not affiliated with Anthropic.