When your agent's safety check can't run, should the call go through, get blocked, or wait for a human?
A builder running a local guard over every agent tool call asks the fail-open vs fail-closed question: if the guard server is down, should unchecked calls proceed, block, or wait for human approval? The discussion highlights a real production gap — most agent guardrail designs never define the degraded mode, which is exactly when the system is most vulnerable.