Fail Closed Without Blocking Everything

A denial is useful only when it is correct

Fail closed means an invalid or unavailable policy prevents a sensitive action instead of allowing it. This is appropriate for credential exposure and tool execution. For low-risk chat, a controlled unavailable response may be better than taking the whole service down.

Build a decision table with allowed input, blocked injection text, oversized input, valid output, malformed JSON, missing keys, and forbidden enum values. Assert both allowed and the reason. Test policy reloads and bad regex compilation before deployment.

Warning: A blocklist cannot enumerate every harmful request. Combine configuration rules with authentication, authorization, rate limits, tool allowlists, output validation, and human approval for high-impact actions.

Version rules beside tests, require review for policy changes, and record the policy version with decisions. Monitor rejection rate and false positives without logging the sensitive content that caused them.

Goal: Fix only rules.json in the guardrails lab. Bound input, block an injection pattern, require both output fields, forbid debug status, and keep ordinary input plus valid output working.