Failproof AI is designed so an enforcement failure is visible rather than silently allowing risky work.
Diagnose a failure-closed block
- Go to Admin → enforcement and open the machine.
- Check its last check-in, assigned deployment, and reported deployment.
- Go to Observe → policy and open the denied decision’s session.
- Confirm whether the reason reports daemon reachability, version skew, or the policy itself.
Rerunning failproofai config updates and restarts the daemon after a package upgrade. failproofaid, the daemon is the only evaluator. If it is unreachable or its protocol version does not match the CLI, hook evaluation fails closed. The action is denied with a reason that directs the operator to check or update the daemon.
Before daemon configuration, hooks evaluate policies in process. Once daemon configuration is recorded, Failproof AI does not silently fall back to a second evaluator when the daemon fails.
Respond to a failure-closed decision
- Run
failproofai config --status.
- If versions differ, rerun
failproofai config after updating the package.
- If the daemon is unreachable, inspect its service state and local logs.
- Resume agent work only after a known policy evaluation path is healthy.
Do not repeatedly retry the blocked action. A failure-closed response means the system could not establish that the action was safe.
