802.1X enforcement day: how do you get an owner to sign fail-open, admitting whoever is in the cabinet, or fail-closed, a site dark for a day?

## Why this is not an engineering decision Fail-open and fail-closed are usually argued in the network team as if the answer were technical. It is not. One choice buys availability and pays in exposure; the other buys assurance and pays in outage — and in an estate of unstaffed sites the outage is not an inconvenience, it is a depot that cannot dispatch, a store that cannot trade, a substation whose operators lose remote visibility. **Nobody in the security team is accountable for any of those, so nobody in the security team can accept that risk on the business's behalf.** The failure this question is really testing for is the engineer who makes the call alone and discovers on the first outage that they own a consequence they never had the authority to accept. ## Segment the estate before you argue A single global posture is almost always the wrong answer, and proposing one is what makes the conversation unwinnable — you are asking an owner to accept the worst case of both options at once. Classify sites by what being dark costs and what being open exposes: | Site class | Cost of dark | Exposure if open | Typical posture | |---|---|---|---| | Safety- or continuity-critical, unstaffed | Severe and immediate | Physical access is hard, reach can be kept local | Fail open, tightly scoped and alarmed | | Trading site with a till or a depot | Real revenue per hour | Public-adjacent floor space | Fail open to a narrow operational VLAN, short time box | | Staffed office floor | Inconvenience, people can move | Wall ports in reach of visitors | Fail closed | | Data centre and management network | Handled by other paths | Highest value in the estate | Fail closed, no exception | The table is the deliverable. It converts an argument about principle into a set of small decisions an owner can actually make, and it lets them accept exposure where the cost of denial is genuinely intolerable while conceding closure everywhere else. ## What you must state honestly to the signer Three things, in plain language, because a signature obtained without them is worthless: 1. **Fail-open is a control an adversary can trigger.** They do not have to defeat authentication; they have to make the authentication servers unreachable from that site, and a rural circuit is not hard to disturb. You are signing for an off switch whose operation is partly in someone else's hands. 2. **Fail-closed means no remote recovery.** The engineer who would fix it, the jump host and the patch source are behind the same control. If the answer is fail-closed, the organisation is funding an out-of-band path or accepting drive-time as the mean time to repair. 3. **The evidence obligation.** If you cannot show which ports took the fallback and what they did while there, you cannot tell the difference between a rough night and a breach. That is a monitoring cost with a real price attached, and it should be funded in the same decision, not discovered afterwards. ## Bound the open posture, and make it cheap to say yes Most owners will sign fail-open if the exposure is bounded and observable. Your job is to shrink it until it is signable: a fallback VLAN with a short list of reachable destinations and no route to management; an alarm per port placement, not a daily digest; an automatic re-evaluation and a review of the port list after every event; and a stated maximum duration after which the site is treated as an incident rather than a degraded state. Each of those turns an open-ended concession into a bounded one. ## Write the back-out before enforcement day, not during The operator on the bridge at 02:00 should be reading a decision somebody already made. That means: the trigger conditions for backing enforcement out, the scope it applies to, who may invoke it without waking an executive, the time box, and how enforcement is verified as restored afterwards, site by site. If those five lines do not exist, enforcement day is not ready, and saying so is the most senior thing you can do in this conversation. A rollout that begins with an undecided posture will make the decision anyway — at three in the morning, under pressure, by whoever happens to be on the call. ## The failure modes an interviewer is listening for Saying 'we fail closed, security first' with no acknowledgement of who absorbs the outage. Saying 'we fail open, availability first' with no scoping or detection. Presenting a single global posture. Owning the decision personally when the consequence lands elsewhere. Treating the signature as paperwork rather than as the moment the organisation actually chooses which failure it prefers.