Fail closed

Fail closed means that anything CTRLRun cannot decide, it denies. An unknown action, a missing policy, a malformed policy, a missing or expired principal, a missing, expired, consumed or mismatched approval, a template that cannot be resolved, a store whose schema it does not recognise: all refused, before the executor runs. There is no flag that makes a consequential action permissive by default, in the kernel, in verify, or in an adapter.

​

The table

Each is an exception of its own, raised as itself so an agent loop can tell them apart, and each writes a refused receipt and an event naming the reason.

​

Why it is not configurable

A flag that relaxed one of these would be set in exactly the deployment where it mattered, and the receipts from that deployment would say the guard was on. The same rule binds ctrlrun verify, which has no argument that makes its Control behave differently from yours, and every adapter, which ships no auto_approve, no dry_run and no development mode that grants. Observe mode is the one way to run unprotected on purpose, and it says so on every receipt.

​

The guarantee it supports

Fail closed: G6 (unknown action refused) and G7 (no principal refused) in ctrlrun verify, and every row above has an acceptance test.

​

What it does not do

Failing closed is about what CTRLRun decides. It cannot refuse a call that bypasses the decorator entirely, a compromised host, or an executor that raises NotExecuted after the remote acted; those are in the threat model as limits, not as vulnerabilities.

​

Next

• Decisions: the three that can be reached.
• Errors reference: every exception and when it is raised.
• Threat model · Get started · Why.