Agentic AI Security
Fail-Closed vs Fail-Open: What's the Difference?
- Failure behaviour
- Availability vs safety
- Configurable policy
Short answer
Fail-closed means a security control that stops working blocks the traffic it was guarding. Fail-open means traffic continues without the control. Fail-closed favours confidentiality and fail-open favours availability. The right choice depends on what a failure costs on each path, and a good product tells you which one applies where.
Maskflare Engineering Updated
What do the two terms mean?
Every control can fail: a rule can't compile, a service can't be reached, a body can't be read. The designer has to decide what happens next. Standards bodies use related terms such as fail-safe, defined by NIST's glossary (from CNSSI 4009) as a mode of termination of system functions that prevents damage to specified resources. In security tooling, the everyday words are:
| Fail-closed | Fail-open | |
|---|---|---|
| When the control breaks | The request is refused | The request goes through |
| Protects | Confidentiality | Availability |
| Cost of a failure | People are blocked, work stops | Unchecked data may leave |
| Fits | Regulated data, high-impact paths | Low-risk paths, urgent business flows |
| Risk in practice | Users find a workaround | Nobody notices the gap |
A door lock is the classic example. A fire exit that fails open lets people out when the power drops. A server-room door that fails closed keeps thieves out when the power drops. Both are correct for their purpose.
Why does it matter for AI traffic?
A masking layer in front of an AI provider is only useful if you know what it does on its worst day. Imagine the masking rules fail to load at 09:00 on a Monday. If the layer fails closed, support agents get an error until it is fixed. If it fails open, their next 200 prompts reach the provider as typed, with customer names in them. Either may be acceptable. Not knowing which is not.
How does Maskflare behave on each path?
| Path | When masking can't run | Configurable? |
|---|---|---|
| Chat through the AI gateway | The organization's failure action decides: forward sends the request on, block returns a 503 masking_unavailable before the provider is contacted. Forward is the default | Yes, per organization |
| Chat response, masker raises mid-response | The text the masker was handling is never sent. A stream ends with the provider's own end event and the event is recorded as failed. A document read whole is refused with a 503 | No, same under both actions |
| Embeddings and batch uploads | Fail closed: the provider is never contacted and the request is recorded as blocked | No |
| Desktop agent, cannot reach Maskflare | AI sites are refused rather than sent unmasked | Yes, a policy can switch to fail open |
Some details behind that table.
Chat through the gateway
Masking itself never blocks chat traffic. A match is handled by the action on its rule: mask, redact, alert, block and so on. Separately, if masking fails, meaning a rule can't compile or raises, a text body isn't valid UTF-8, or the masker throws, the organization's failure action applies. With forward, the request goes on, which means that request may reach the provider unmasked. With block, the gateway answers 503 before any provider contact and records the request as blocked. Each event carries a masking status and, on failure, a failure code, never the content.
Do not confuse this with a block rule. A block rule is a deliberate decision: a request that contains a value you said must never leave is refused with a 403 that names the rule key and never the value. The failure action is about the case where the rules could not be applied at all.
Responses
On a streamed response the headers are already out, so the gateway can't return a clean error. If the response masker raises, what it had consumed is never released, whichever failure action is set. With forward, the stream ends after what was already masked, using the provider's own end event where one exists (Gemini's stream simply stops), and the event is recorded as failed. With block, the stream ends before the chunk that couldn't be masked.
Embeddings
Embeddings requests fail closed. If the masking key required for deterministic masking is missing, the body can't be read, or the rules are unavailable, the provider is never contacted and the request is recorded as blocked.
The desktop agent
The desktop agent routes AI hosts through Maskflare. If it cannot reach Maskflare, AI sites are refused instead of being sent unmasked: fail-closed by default. A policy can switch to fail open, which sends traffic directly while Maskflare is unreachable. The last good policy is cached for offline use, so a short outage doesn't change what rules apply.
How do you choose?
- Rank the paths by what a leak costs. Patient notes and payment data justify fail-closed. A marketing brainstorm may not.
- Rank them by what an outage costs. An on-call engineer debugging an incident at 03:00 is a reason people ask for fail-open. Decide in advance who may approve it and for how long.
- Make failure visible. Whichever you pick, alert on masking failures so a quiet fail-open window doesn't last a month.
- Test it. Break a rule on purpose in a staging environment and watch what each path does.
- Write it down in your AI usage policy so the choice is deliberate and auditable.
In a gateway setup, the same logic applies to agent traffic: a failed check on an MCP route should be as deliberate a decision as one on a chat route. Agents also act on what they receive, which is one more reason to lean toward closed for tools that can write.
Frequently asked questions
Is fail-closed always safer?
For confidentiality, yes, but it can hurt availability and push people to unmanaged tools. Safer overall depends on what people do when the control blocks them.
What is Maskflare's default when chat masking fails?
The default failure action for chat through the gateway is forward, which sends the request on. An organization can set it to block, which returns a 503 before the provider is contacted.
Does any Maskflare path always fail closed?
Yes. Embeddings requests and batch uploads fail closed, and so does a response masker that raises, in the sense that it never releases text it could not mask.
What does the desktop agent do if it loses its connection?
By default it refuses AI sites rather than sending them unmasked. A policy can switch it to fail open.
How is a failure different from a block rule?
A block rule is a deliberate policy decision when a request contains a value you chose to stop. A failure means the rules could not be applied at all.