Fail closed is a security design principle where a system denies access or stops processing when it cannot confirm authorization, integrity, or another required check. In other words, uncertainty is treated as a reason to block, not to allow.
This matters because many attacks exploit ambiguity: a missing permission check, an expired token, a broken identity lookup, or a failed policy call can all become accidental bypasses if the system “fails open.” A fail-closed design is common in access control, API gateways, secure file retrieval, and AI retrieval pipelines. If a document’s ACL cannot be verified, the request should be denied rather than returning content. The tradeoff is availability, but the benefit is reducing unauthorized disclosure and limiting the impact of partial outages, misconfiguration, or permission drift.