# Fail Secure

Record: `arch:fail-secure`
Kind: principle
Layer: [Correctness Core](https://banes-lab.com/records/layer/correctness-core.md)
Severity: mandatory
Scope: auth, access, infrastructure
Canonical: https://banes-lab.com/ontology#arch-fail-secure

## Repair

- Refactored by: Default Deny, Add Explicit Allow
- Detected by: fail-open branches
- Violated by: allowing access after auth/policy failure
- Measured by: fail-open count
- Enforced by: security tests, policy checks

## requires

- [Secure Defaults](https://banes-lab.com/records/lex/secure-defaults.md)

## reinforces

- [Security by Design](https://banes-lab.com/records/arch/security-by-design.md)

## enables

- [Deny-by-Default Behavior](https://banes-lab.com/records/lex/deny-by-default-behavior.md)

## conflicts-with

- [Fail Open](https://banes-lab.com/records/lex/fail-open.md)

## tensions-with

- [Availability](https://banes-lab.com/records/lex/availability.md)

## tensions

- [Fail Secure Availability](https://banes-lab.com/records/tension/availability-fail-secure.md)

## referenced-by

- [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md)