ShrikeFail closed vs fail open
Fail closed means a security control that cannot complete its check refuses the action; fail open means it lets the action proceed. Neither is universally right: the choice weighs the harm of a wrongly allowed action against the harm of a wrongly stopped system, decided per control, not per product.
Agent governance uses both, deliberately. A check that gates an irreversible action (a deletion, a payment, an external send) usually fails closed: better a delayed task than an unreviewed loss. A check that only enriches context or attribution can fail open: better a less-informed verdict than a stalled pipeline. What matters is that each control's failure posture is an explicit, documented decision, because the accidental version of this choice is how outages become incidents and incidents become outages.
What Shrike does when a check cannot complete
The SDKs and the MCP server default to fail closed. A scan that cannot complete is retried with backoff, and a backend that keeps failing trips a circuit breaker rather than being hammered. If the check still cannot be made, the SDK raises an error instead of returning a verdict. That distinction is the whole point: a failure never produces an allow, because an allow the caller cannot distinguish from a real one is worse than an exception the caller has to handle.
Fail open is available and has to be chosen. Set it explicitly and an unreachable backend returns an allow carrying degraded: true, so a caller can always tell a scanned-and-clean verdict from one where enforcement was skipped. The two are never the same object.
The trade-off is real and we state it plainly: fail closed means a Shrike outage can stop your agent from working. We think that is the correct default for a control sitting in front of actions that execute, and we think the wrong version of this choice is the one nobody made on purpose. What is not configurable is the inline enforcement gate, which never fails open.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Watch an agent get refused in the playground, where every tool call is scanned for real, or read what is action governance.