CAIN-42 CAIN StudioFail-closed: UNKNOWN and ERROR never become ALLOW
Most outages of a security control are silent: the policy server times out, a checker throws, a new stage answers in a word the decision code never heard of, and the request goes through because nothing said no. CAIN-42 inverts that. An enforcing check that does not give a clean answer blocks. This page shows the rule, the two blind sets we threw at it, and the hole they found in the code that turns stage answers into the final verdict.
#17 of the CAIN-42 Top 25 3 gaps found and fixed fix live after the next gateway deploy
malformed requests to 144 public routes: 0 said yes, 0 crashed
held on blind set 2 (the verdict function) before the fix
held after the fix
live decisions affected (the hole was latent)
Try it
The attack lab runs 14 real decisions and refusals from your browser. Or:
curl -s -X POST https://cainstudio.online/fabric/try -H 'Content-Type: application/json' \
-d '{"scenario":"malformed-plan"}'
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.