Fail-Closed Configuration

The foundational principle of fail-closed design is a default-deny stance. When a component failure, timeout, or anomaly is detected, the system immediately revokes all access rights and blocks pending actions. This contrasts with fail-open configurations, which prioritize availability by granting access during failure. In agentic systems, this means an agent's tool-calling permissions are instantly severed if its liveness probe fails or its behavioral drift exceeds a defined threshold. The system assumes breach until integrity is verified.

Fail-closed architectures rely heavily on the circuit breaker pattern to prevent cascading damage. When an agent repeatedly fails to execute an operation successfully, the circuit breaker trips to a closed (failing) state, immediately rejecting all subsequent requests without attempting execution. Key states include:

• Closed: Normal operation, requests pass through.
• Open: Failure threshold exceeded, all requests are immediately denied.
• Half-Open: A trial period where a limited number of requests are allowed to test if the underlying issue has resolved.

Upon entering a fail-closed state, the system must execute an idempotent rollback to the last known safe configuration. This involves restoring an immutable state snapshot captured before the failing operation began. For autonomous agents, this rollback must be atomic—either the entire state is reverted, or nothing changes—to prevent partial restoration that could leave the agent in an inconsistent or unsafe condition. The rollback process is managed by the agent's termination handler, ensuring critical cleanup tasks like releasing database locks and revoking temporary credentials are completed.

A fail-closed event triggers immediate forced quarantine of the affected agent. Network policies dynamically restrict the agent's communication to only a controlled observation environment. This prevents a potentially compromised or runaway agent from influencing peer agents in a multi-agent system. Key isolation mechanisms include:

• Network micro-segmentation: Restricting egress traffic to a forensic logging endpoint.
• Process cgroup limiting: Capping CPU and memory to prevent resource exhaustion.
• Credential zeroization: Executing a zeroize command to wipe API keys and session tokens from memory.

A fail-closed architecture mandates a synchronous human-in-the-loop override for recovery. The system cannot autonomously transition out of the fail-closed state. A human operator must explicitly acknowledge the incident, review forensic logs, and issue a signed command to restore service. This gate prevents an agent from automatically resuming operations while still in a compromised or unstable condition. The override mechanism itself is protected by a dead man's switch—if the operator becomes unresponsive during recovery, the system reverts to the fail-closed state.

The transition to a fail-closed state is often initiated by a tripwire—a passive monitoring rule that fires when a specific anomaly is detected. These tripwires monitor for conditions such as:

• Runaway resource consumption: CPU or memory usage exceeding 95% for more than 30 seconds.
• Permission escalation attempts: An agent trying to access tools outside its manifest.
• Output validation failures: Generated actions that fail safety classifiers repeatedly. When a tripwire fires, it triggers an automated process termination signal (SIGTERM) followed by a timeout-based kill (SIGKILL) if the agent does not terminate gracefully within the defined window.

A safety mechanism that automatically triggers a kill command or safe state when the human operator fails to provide a periodic confirmation signal. Originating from locomotive engineering where a pedal must be continuously pressed, this pattern ensures that operator incapacitation does not leave an autonomous agent running without supervision. In agentic systems, a dead man's switch might require a human to acknowledge a prompt every N minutes; failure to respond triggers an immediate fail-closed shutdown of all agent operations.

A hardware or software mechanism that physically or logically prevents an agent from executing a dangerous action unless specific safety preconditions are met. Unlike a simple kill switch, interlocks are preventive rather than reactive—they gate access before harm occurs. Examples include:

• A robotic arm that cannot operate above a certain speed unless a light curtain confirms no humans are in the zone
• An agent that cannot execute financial transactions above a threshold without multi-party authorization
• A drone that refuses takeoff if GPS lock is not achieved

The dynamic and immediate removal of an agent's access rights to specific tools, APIs, or data sources. This serves as a non-lethal containment measure—more surgical than a full kill switch. When an agent exhibits suspicious behavior, operators can revoke its database write permissions while leaving read access intact for diagnostic observation. In OAuth-based agent architectures, this involves token invalidation at the authorization server, instantly severing the agent's ability to act on protected resources without terminating its process.

A design strategy that allows an autonomous system to maintain limited, safe functionality when a component fails, rather than suffering catastrophic total failure. In contrast to a hard fail-closed shutdown, graceful degradation prioritizes partial service continuity. An autonomous vehicle experiencing sensor failure might reduce speed and pull over safely rather than stopping abruptly in traffic. This pattern requires pre-planned degraded operating modes with clearly defined capability boundaries and automatic fallback triggers.