What it means
The correct response depends on the mission and loss scenario: some systems must deny access, some must preserve life or availability, and some must enter a controlled degraded state.
Why it matters
Default failure behavior is an architecture decision. Leaving it implicit can turn an ordinary outage into unauthorized access, data loss, or unsafe operation.
Practical focus
- Identify failure modes and competing safety, security, and availability needs
- Define controlled degraded states
- Test dependency loss and partial failure
- Provide monitoring, recovery, and manual override with accountability
Common mistakes
- Assuming fail closed is always safest
- Ignoring the failure of identity or policy services
- Designing only for total failure
- Providing an override without logging or expiration
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: