Fail-closed is treated as a config flag.
It is a property of six separate places, and each can become fail-open on its own:

  • missing rule returning allow;
  • recompute falling back to client-supplied values;
  • warm cache never re-checked against source;
  • blanket except;
  • legacy path that predates the gate, and non-atomic grant consumption.

The dependency table is where people get it wrong:

Policy evaluation fails -> Block Budget reservation fails -> Block Audit write already durable -> Allow + retry Telemetry fails -> Allow + drop

Treating every dependency the same is how fail-open gets introduced by careful people.

Read full article here