Fail-closed governed autonomy

The trap in "human in the loop"

The common answer to agent safety is a human in the loop: let the model do what it wants, but have a person approve each action. It feels safe, and for low volumes it can be. But it does not scale, and worse, it quietly degrades. A person asked to approve the two-hundredth routine action of the day approves it without reading it. The loop is still there on the org chart and gone in practice. Safety that depends on sustained human attention is safety with a half-life.

The deeper issue is that "human in the loop" can put the human in the wrong place. It asks them to catch bad actions one at a time, forever. A stronger pattern lets people set enforceable rules and reserve manual review for ambiguous or high-risk cases. That reduces unsafe paths; it does not make every unsafe outcome impossible.

Propose and dispose: a hard line

The reference architecture draws a structural line through a governed action path. On one side, the language model proposes: it reasons over the available operational picture and produces a structured plan. On the other side, deterministic code disposes: it can translate an allowed plan into an action after configured checks pass.

This separation is a control boundary, not a proof that no other path exists. Its strength depends on connector implementation, credentials, policy coverage, and whether external systems can also be changed outside Fibric. Each deployment must verify that the model has no direct actuation credentials and that bypass paths are controlled.

Fail-closed, not fail-open

The word that does the most work here is fail-closed. On a covered path, the absence of a required affirmative policy result should hold the action. This protects only conditions the deployment has encoded and mediated; unknown bypasses or missing policy cannot be treated as solved.

This is the same principle that governs a safe deadbolt or a circuit breaker: when in doubt, deny. It costs you something, an action that was actually fine will sometimes be held because the system could not confirm it was fine. We think that trade is correct for a system acting on the physical world, where the cost of a wrong action is almost always higher than the cost of a held one. You can always review and release a held action. You cannot un-send a message.

Policy as a veto you own

Deterministic policies are hard checks evaluated outside the model. Examples include holding outbound contact outside approved hours, requiring confirmation above a value threshold, or rejecting data tagged as fallback. Their effectiveness depends on complete inputs, correct policy code, and a verified execution boundary.

This makes covered governance less dependent on model behavior, not independent of the whole system. An adversarial proposal still meets the same checks, while implementation defects, credential leaks, and uncovered paths remain security concerns.

What governance gives back: the receipt

On supported governed paths, the gate can produce a consistent record of the proposal, evaluated policies, decision, and observed downstream response. This improves reviewability, but an external timeout or an action outside the governed path can still leave missing or ambiguous evidence.

The honest limit

Fail-closed controls do not make the model correct or fully contained. A flawed proposal that satisfies incomplete policy can still execute, credentials can be mis-scoped, and external systems may offer other action paths. Governance can bound the authority of a verified deployment; grounding improves what is proposed. Both require testing, monitoring, and independent safeguards appropriate to the consequence.

Related: Point and go · Neuro-symbolic root-cause