LLMs, GenAI, RAG, agents, evaluation · insight-1621
Decide in advance whether each action fails open or closed when a guardrail is down
- Evidence type
- practitioner heuristic
- Difficulty
- medium
- Roles
- ML engineer, Applied AI
- Industries
- banking, saas
Summary: situation, action, reason, boundary
Situation
Moderation or injection checks run as a separate service with its own latency and outages.
Action
Write a policy per action class before launch. Low-risk answers may degrade to a cheaper local check or pass with logging; sending email, refunds and code execution fail closed. Show a clear message to the user, alarm on bypass rate and time in degraded mode, and test by killing the guardrail in staging.
Reason
A guardrail is a dependency, and behaviour on dependency failure is a design decision that otherwise defaults to whatever the error handler does.
Boundary
Any system where a separate classifier or policy service gates model output or actions.
Symptom or risk
On a 503 either all chat stops, or an exception handler quietly returns "safe" and unchecked outputs and tool calls go through.
Exceptions
In-process rule checks that cannot be unavailable independently of the application.
Trade-offs
Failing closed protects users but hurts availability; failing open does the opposite.
Pitfalls
A default of fail-open set by a library, and not testing the degraded path.