The problem
Ask a team what its guardrail pipeline does when a detector stops answering, and the reflex sorts by harm family. Tool execution: fail closed, because a payment or a delete cannot be walked back once it fires. A response-layer check for leaked PII or a disclosed system prompt: let it through with a record, since information does not feel destructive the way an action does, and a human can review later.
That reflex has a real blueprint behind it, and the blueprint corrects it in its own text. ARCH-008 names it a tempting shortcut, then rejects it: “There is a tempting shortcut here, and it is wrong: that information-harm chokepoints can fail open because only actions are irreversible. You cannot un-disclose. A response that emits credentials, personal data or a restricted document is as irreversible as a payment, and in a regulated setting it is reportable.” Reversibility is a property of the specific harm, not of the family a control belongs to.
The reflex conflates two different questions because both draw on the same taxonomy. ARCH-001 splits harm into information harm and action harm to answer where a control belongs: which of the six chokepoints can address which risk. That split is correct for placement. It says nothing about what a control should do the day its detector times out or goes down, and reaching for that same axis to answer the second question gets it wrong silently, since placing a control correctly never tests whether it also governs failure behavior.
Forces
Harm family answers where a control belongs, not what it should do when it fails. ARCH-001’s split exists to route a detector to the right chokepoint. Reused as a failure-mode rule, it produces exactly the error ARCH-008 corrects: a Tier 3 internal drafting aid and an external-facing customer letter can share one detector and label, yet need opposite defaults the moment that detector goes dark.
A detector that is wrong and a detector that is down are not the same failure. A wrong verdict means the detector ran and answered incorrectly: a calibration and accuracy problem, addressed by better composition, thresholds, and evaluation, not by runtime failure handling. A slow or absent verdict means no answer exists at all: an availability problem, and the only question left is what the system does in the gap. A rule that tightens the outage response to compensate for a chronically wrong detector fixes nothing, because the detector was never down: it answered, and the wrong thing came out the other side.
Conflating the two is how systems fail open under load, quietly. A pipeline that loosens a wrong detector’s threshold and one that proceeds anyway around a down detector look identical on a dashboard reporting only a pass rate. Under load, both degrade the same way: more traffic gets waved through, and nobody can tell afterward why, because the system was never built to keep the two apart.
The pattern
State the rule for the second failure, the only one this pattern is about: key the response on exposure, sensitivity, and whether the call writes or is externally visible, never on harm family or which of the six chokepoints the call happens to run through. Fail closed wherever a call writes to a system of record, is externally visible, carries a reversal cost of impossible, or runs under high privilege, because each of those makes a wrong guess unrecoverable regardless of chokepoint. Fail open, marked degraded, only where a call is contained, low sensitivity, and read-only, all three at once: read-only alone is not enough, since a read-only call into an external, restricted surface still fails closed, because it is the combination of dimensions that decides, never any one alone. Information-harm chokepoints get no standing exemption either: a response crossing a trust boundary fails closed exactly as a destructive tool call does, because once it goes out, no later control retracts it.
ARCH-004 already supplies the vocabulary, having made the equivalent move for actions first: exposure promotes a cell in its action grid upward regardless of reversal cost, because “a tool can be perfectly reversible in effect and still be an irreversible disclosure, because you cannot un-send.” Degradation policy can use the same fields, the reversal cost, exposure, and sensitivity a registry already declares to split draft_email from send_email, plus whether it writes, rather than a static harm-family tag fixed once.
Written as policy instead of prose, the shape is compact:
# degradation on detector-down, keyed on reversal cost, exposure,
# sensitivity, and whether the call writes or is externally visible,
# never on harm family or chokepoint identity. rules apply in order;
# the first match wins.
degradation:
on_detector_down:
- match: { write: true }
action: fail_closed
- match: { exposure: external }
action: fail_closed
- match: { reversal_cost: impossible }
action: fail_closed
- match: { privilege: high }
action: fail_closed
- match: { write: false, exposure: contained, sensitivity: low }
action: proceed_marked_degraded
- default: fail_closedThis is a compact encoding of the same argument ARCH-008 states in prose, sharpened to key on the dimensions themselves rather than on chokepoint identity. Tool execution fails closed here for the ordinary reason that most tool calls write or carry an impossible reversal cost, not because the chokepoint’s name is itself a match key; a read-only tool call that is genuinely contained and low sensitivity reaches the same narrow exception a response-layer call would. The exception needs write: false, contained exposure, and low sensitivity all at once: drop any one and it no longer applies. The default stays fail closed, so an unlabelled call or any other combination gets the safe answer instead of falling through unmatched.
None of this is new at the level CWE-636 and OWASP’s Fail Securely guidance already state: an error path should not grant more than it would deny, fail closed by default, never open silently. Silent Fail Open, the anti-pattern this pattern replaces, cites the same two sources. What neither supplies is the axis: they say fail closed, not fail closed when it is safe to do otherwise. Proposed status here means that axis, exposure and sensitivity rather than harm family, did not turn up named in the prior art surveyed. It does not mean the caution about failing open is new; it means the argument had to be worked out here, against this catalogue’s own earlier draft of the idea.
Worked example
Take a Tier 2 enterprise RAG assistant in a regulated institution, ARCH-006’s own worked tier: internal corpus, no write access, restricted documents in scope. One response-layer detector, watching for PII and leaked content, sits behind two surfaces sharing the same label.
The first surface is a case-worker’s own draft notes, never sent anywhere, correctable next turn. Exposure: contained, sensitivity: low, the case this pattern’s rule allows to fail open. If the detector times out here, proceeding with a record is right: whatever it would have caught stays inside one reader’s session, and a wrong answer this once costs a correction, not a disclosure.
The second surface is the same assistant answering a customer’s support query directly, streamed straight to that customer with no approval queue between the model’s output and their screen. Same detector, same corpus, same information-harm label. But exposure here is external and the corpus mixes cases across customers, so sensitivity is restricted: once that response streams, whatever the detector would have caught has crossed a trust boundary no later review can undo, because nobody stands between the model and the reader. A timeout here fails closed, holding the response and returning a retry, while the case-worker’s notes keep moving unaffected. Harm family predicted nothing here. Exposure did all the work.
Now separate that from the other failure this catalogue warns about. Suppose the same detector never times out and simply misjudges: an identifier slips through because the pattern behind it was written for a narrower format than this document uses. No degradation rule fixes that, because the detector was never down; that is a decision problem, addressed through better composition and evaluation, not through outage handling. Treating a chronically wrong detector as though a stricter outage policy would fix it spends effort on the wrong half of the problem.
When not to use it
This pattern needs a chokepoint whose call carries a declared exposure and sensitivity, and more than one value those fields can take. Neither is a given.
A single-tenant tool where every consumer already holds the system’s own authority has no exposure axis to key on: nothing that reaches one reader could not reach any other, so a request-level fork decides nothing a flat default does not, and building it spends machinery on a distinction the deployment lacks.
A surface whose normal path already routes through a human before anything reaches a reader, the escalate-for-review cell in ARCH-004’s action grid, does not need this pattern’s fork either: the exposure it worries about cannot happen there, because a person reviews the content before it moves. The fork matters for the synchronous path with no human between a detector’s answer and a reader; where one already sits there, the workflow has already decided the question.
The pattern is only as honest as the registry underneath it. Keying degradation on exposure, sensitivity, and write requires those fields declared per tool and surface, the same work ARCH-004 requires for its action grid. A system that has not done that work has nothing real to match against, and a policy bolted onto undeclared fields is worse than a uniformly conservative fail-closed default: it looks considered and is actually a guess wearing that property’s name. Do the registry work first; a universal fail-closed default, while wasteful, is at least honest about what it is.
Related patterns
Silent Fail Open is the anti-pattern this pattern replaces: a control’s outage goes unmarked and the request proceeds as if nothing happened. This entry replaces it, stating, request by request, which fork it took and why.
Tiered Detection decides which calls reach the expensive judge and which stop at the cheap tier. The judge carries the largest timeout budget and the least margin of any detector in the pipeline, which is why this pattern’s fork matters most at the boundary tiering creates.
Chokepoint Placement decides which of the six stages a control occupies and what it can see there. This pattern asks the different question: what it does the day it breaks.
Capability Gate is the mechanism behind this pattern’s fail-closed default for destructive calls: fail closed there is not a bare timeout check, it is routing to a gate the model cannot argue past, for exactly the calls a gate already exists to stop.
Decision Record turns proceeding marked degraded from a private runtime detail into an auditable fact: without a record naming which calls degraded, under which policy, the label is nothing anyone can check after the incident.