Architecture & practice·Risk, blast radius and change
the permissions service timed out, and the system denied everything rather than letting everything through.
Fail-safe
Also calledfail-closed, fail-secure
Choosing which way a component falls over when it cannot do its job. Fail-safe denies, fail-open allows, and each is correct in different places — an authorisation check should fail closed, a recommendation widget should fail open. The failure to make this choice explicitly is how an outage in a non-critical dependency takes down a checkout, and it is one line in a design document that pays for itself.