# Fail Secure

> A design rule that an authentication or policy failure denies access.

Record: `architecture:fail-secure`
Kind: principle
Layer: [Correctness Core](https://banes-lab.com/records/layer/correctness-core.md)
Severity: mandatory
Scope: auth, access, infrastructure
Canonical: https://banes-lab.com/ontology#architecture-fail-secure

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Fail Safe](https://banes-lab.com/records/architecture/fail-safe.md) and before [Graceful Degradation](https://banes-lab.com/records/architecture/graceful-degradation.md).

## Repair

- Refactored by: Default Deny, Add Explicit Allow
- Detected by: fail-open branches
- Violated by: allowing access after auth/policy failure
- Measured by: fail-open count
- Enforced by: security tests, policy checks

## Requires

- [Secure by Default](https://banes-lab.com/records/architecture/secure-by-default.md)

## Reinforces

- [Security by Design](https://banes-lab.com/records/architecture/security-by-design.md)

## Enables

- [Deny-by-Default Behavior](https://banes-lab.com/records/lexicon/deny-by-default-behavior.md)

## Conflicts with

- [Fail Open](https://banes-lab.com/records/lexicon/fail-open.md)

## In tension with

- [Availability](https://banes-lab.com/records/lexicon/availability.md)

## Tensions

- [Fail Secure / Availability](https://banes-lab.com/records/tension/availability-fail-secure.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Error Handling / Resilience](https://banes-lab.com/records/architecture-category/error-handling-resilience.md)

## Enforced by

- [rules/eslint/no-fail-open-guard.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-fail-open-guard.eslint.rule.ts.md)

## Linked from

- [Execution joins the halves](https://banes-lab.com/software-architecture/principles/execution-joins-the-halves.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Error Handling / Resilience](https://banes-lab.com/ontology/lexicon/lexicon-category-error-handling-resilience.md)
- [Quality Attributes](https://banes-lab.com/ontology/lexicon/lexicon-category-quality-attributes.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)