Fail-safe defaults

What are Fail-Safe Defaults?

In information security, fail-safe defaults mean that access is denied unless a permission rule allows it. Saltzer and Schroeder (1975) describe this as basing access on permission rather than trying to enumerate every reason to refuse it.

How fail-safe defaults work

Suppose a new file has no sharing permission. With a fail-safe default, other users cannot open it until access is granted. The alternative is to let them in unless someone remembered to forbid it. Those designs behave very differently when a permission is overlooked.

Fail-safe defaults beyond access control

The term is also used more broadly for defaults intended to reduce harm. That broader use should not be confused with the specific access-control principle or with the behavioral default effect.

A safe failure state depends on the system and hazard. Stopping a medical device is not always safer than continuing a controlled function. Such decisions require domain-specific safety analysis; the security principle alone cannot establish them.

Why it matters

A default determines what happens when no explicit decision covers the case. With a fail-safe default, access stays restricted if someone forgets to grant permission. In a physical system, the designer must identify which failure state actually reduces harm. “Stop everything” is not a universal answer.