Fail closed: what happens when trust is in doubt
The Fibric reference executor is designed to hold a covered action when a required signal is missing or a configured policy does not pass. This is a bounded control objective; deployment safety still depends on policy completeness, credentials, and external-system paths.
Every engineered system has a resting state — the thing it does when nothing tells it what to do. For a circuit breaker, resting is open: no current unless everything is healthy. For most software agents, resting is the opposite. They are built to act, so when an input is ambiguous or a check cannot be evaluated, the path of least resistance is to act anyway, on a guess. The guess is usually fine. “Usually fine” is an acceptable property for a chatbot. It is not an acceptable property for something wired to refunds, door controllers and building plant.
The reference control objective is hold when a required check does not pass. On covered paths, capability, policy, required signal state, and tenant scope are evaluated before dispatch. This does not assert that every risk is encoded as a check or that every external path is mediated.
Doubt, enumerated
“Trust in doubt” sounds abstract until you list what it looks like on a Tuesday:
A required signal is missing. The occupancy feed for a floor went quiet, and a plan wants to cut heating to “unoccupied” rooms.
Declines. Absence of a reading is not a reading. The executor does not substitute a default, a last-known value, or a model’s estimate for a signal the plan requires.
Policy is unmet. A plan proposes messaging a customer, and your policy forbids outbound contact outside business hours.
Declines. The action does not fire, and it does not silently queue to fire at 9 a.m. either — deferral is itself an action, and nobody authorized it.
The plan is stale. State moved between proposal and execution: the order the model reasoned about has already been refunded.
Declines. A plan is checked against the world as it is at execution time, not the world the model saw.
Notice the pattern: in every row, there exists an action a clever system could take. Interpolate the occupancy. Hold the message until morning. Skip the refund since it already happened, and quietly do the rest of the plan. Each improvisation is individually defensible, and collectively they are how a governed system rots into an ungoverned one — one reasonable exception at a time. The executor is deterministic code precisely so it cannot be reasoned into an exception. Policies are checks it runs, not arguments it weighs.
Declining is not failing
A recorded decline can show the unmet condition and the proposal it blocked on supported paths. That is useful operational evidence, though the fix may require broader investigation rather than a simple upstream refresh.
In the illustrative hotel pattern, a stale BACnet point should hold action for the affected scope rather than invite interpolation. A real deployment must define dependency boundaries and confirm that one missing signal does not invalidate a wider control decision.
Safety as the cheap path
The deepest consequence of fail-closed is economic rather than technical. The reference contract requires an affirmative policy decision before a covered action dispatches. That reduces accidental authority, but public connector publishing is not open and each managed path must verify credentials, policy coverage, and bypasses.
“Hold when required trust is missing” is an important control objective. It is not, by itself, enough to leave a building unattended.
Keep reading: Governed by default · Guardrails the model can't argue with