CAIN-42 CAIN StudioCCAS · Module 3 of 5 · 12 min
Fail-closed decisions: UNKNOWN and ERROR never allow
A fail-open system treats doubt as permission: a timeout, an unknown identity or a crashed policy check lets the action through. Attackers aim for exactly those paths.
CAIN's rule is the opposite. UNKNOWN and ERROR never become ALLOW. No policy match is a deny. An identity with no trust history gets REQUIRE_APPROVAL, not an automatic yes. Only a known identity, a matching allow policy, a low-risk screen and established trust produce ALLOW.
Test fail-closed behaviour deliberately: kill the policy service, send malformed arguments, use an unregistered tool. Each must produce a refusal and a record.
Key points
- Doubt is a refusal, never a permission.
- No policy match = deny.
- New identities are held for a person.
- Test the failure paths, not just the happy path.
In the CAIN-42 codebase
platform-gateway/cain_trust_kernel.py— FormalTrustKernelInvariantChecker: 'No Auth No Exec' and 'Unknown/Error Never Permits'
Practice check
Practice 1 · choose one
A policy service times out. A fail-closed system…
Practice 2 · true or false