What Are Fail-Safe Defaults?

Fail-safe defaults is the principle that a system should deny by default and remain secure when something goes wrong. Access is granted only by explicit permission, and when a component fails or a decision is ambiguous, the system falls back to the safe state — not the convenient one. It is one of the oldest secure-design principles, from Saltzer and Schroeder’s 1975 classic.

What does the principle actually require?#

Two related ideas:

• Default deny — base decisions on what is explicitly allowed, and refuse everything else. A firewall that blocks all traffic and opens only named ports embodies this; one that allows everything except a blocklist does not.
• Fail secure — when a check errors out or a service is unreachable, resolve to denied, not granted.

This is the opposite of the common anti-pattern where an exception in an authorization check accidentally lets the request through — a failure that quietly becomes a bypass.

Fail-closed or fail-open?#

Mode	On failure	Prioritizes
Fail-closed (secure)	Deny access	Security
Fail-open	Allow access	Availability

Security controls should default to fail-closed: if the authorization service is down, deny rather than wave everyone through. The rare deliberate exceptions are life-safety systems — an electronic lock may fail open so people are not trapped in a fire.

Fail-safe defaults pairs naturally with least privilege and zero trust. More at the Security Fundamentals hub.