# Fail-Closed vs Fail-Open

When a safety check errors or is unavailable, deny the action (fail-closed) rather than allow it (fail-open).

## Why the CCAR-P exam tests this

The exam checks whether you understand that a control which fails open provides worse-than-zero security by creating false assurance.

## Definition

A control **fails closed** when, on any error, timeout, or unavailability, it **denies** the protected action. It **fails open** when, under the same conditions, it **allows** the action through. For a safety or authorization control, fail-closed is almost always correct.

The key insight the exam wants: **a control that fails open is worse than having no control at all.** With no control, everyone knows the path is unguarded and treats it accordingly. With a fail-open control, the system *looks* protected — it passes reviews, appears on the control register — but silently lets requests through whenever the moderation API is down, the classifier throws, or a timeout fires. Attackers can even *induce* the failure (e.g. by overloading the check) to bypass it.

Design each guardrail so its error path is `deny`. If a content filter, injection detector, or authorization service cannot return a clear allow, treat the result as a block and, where appropriate, escalate. Reserve fail-open only for non-security features where availability genuinely outranks safety, and make that trade-off explicit.

## Exam trap

"If the moderation service times out, let the request proceed so users aren't blocked" is the trap — that is fail-open, and it converts a control into a false sense of security.

## Commonly confused with

- **escalate-on-policy-not-confidence** — Fail-closed governs the error path of a check; escalation policy governs the normal path for high-risk actions.
- **least-privilege** — Both are default-deny ideas, but least-privilege scopes granted permissions while fail-closed decides behavior when a check breaks.

## Related

- least-privilege
- guardrail-placement
- escalate-on-policy-not-confidence

---

Source: Claude Cert Prep — an independent, unofficial CCAR-P study resource (domain P5). Not affiliated with Anthropic.