What happens when Decionis can't be reached

The action callback never runs: a timeout, invalid proof or an unreachable authority returns executed: false.

Checked against packages/sdk-node/src/ExecutionAuthority.ts

The call throws with no verdict, and the Express and Fastify gates stop before the route handler runs.

Checked against packages/sdk-node/src/Client.ts; src/Express.ts; src/Fastify.ts

The guard runs locally and blocks when its policy snapshot is missing, expired or unsigned.

Change it:

degradation_mode: "fail_open" on a request.

If it continues:

The result carries degraded: true and no execution grant.

Checked against packages/sdk-node/src/AgenticGate.ts

The request is refused with 503 and is not forwarded.

Change it:

--failure-policy failOpen (failurePolicy: FAIL_OPEN in the config).

If it continues:

The response carries agentsafe-execution: FORWARDED_UNGOVERNED, and the evidence chain records EXECUTION_UNGOVERNED.

Checked against decionis/agent-safe-pipeline: packages/agentsafe/src/gateway/Gateway.ts

The action is blocked with 503 and not forwarded.

Change it:

fail_strategy: "allow" on a request, applied only to an outage; any other failed evaluation stays blocked.

If it continues:

verdict null, status FAIL_OPEN_UNGOVERNED, execution FORWARDED_UNGOVERNED.

Checked against apps/api/src/routes/DecisionLifecycleRoutes.ts

In enforcement the checkout is refused with 503 and no grant. In Shadow Mode the answer comes back before any evaluation and never holds the checkout.

Checked against apps/api/src/routes/UcpRoutes.ts

The checkout is refused in every mode, with no grant.

Checked against apps/api/src/routes/AgenticRoutes.ts

In enforcement, admission is refused. In Shadow Mode, the default, requests are admitted and evaluated in the background.

Change it:

failureBehavior: FAIL_OPEN in the policy config or the Helm values.

If it continues:

An admission warning, and the decionis.com/decision: ERROR annotation.

Known gap:

With FAIL_OPEN set, requests are also admitted when the authority answers with an error, not only during an outage.

Checked against apps/kubernetes/src/admission/AdmissionDecisionService.ts; src/config/PolicyConfig.ts

The handler does not run, and EventBridge records are dropped.

Change it:

DECIONIS_FAIL_OPEN=true (FailOpen in the CloudFormation template), outages only.

If it continues:

failedOpen: true and the guard_failed_open reason code.

Checked against packages/aws-lambda-guard/src/Guard.ts; src/Config.ts

The agent's action group receives a blocked result.

Change it:

failOpen in the guard config, or DECIONIS_FAIL_OPEN.

If it continues:

guard_failed_open, delivered to the onDecision hook.

Known gap:

The agent's own response does not show that it proceeded ungoverned.

Checked against packages/bedrock-guard/src/Wrap.ts

The tool call is denied on any gate error, local or remote.

Change it:

A repository with no DECIONIS_POLICY.md is not governed when the plugin passes --allow-ungoverned; a policy that exists but cannot be read still denies.

Known gap:

The host cannot tell a call allowed in an ungoverned repository from a governed allow.

Checked against apps/mcp/src/agent/LocalAgentGate.ts; apps/mcp/hooks/hooks.json

Anything other than an explicit approve returns 503, and the request does not reach the backend.

Change it:

Swap in the shadow policy during rollout.

Checked against docs/marketplace/microsoft/azure-api-management/policies/decionis-gate-enforce.xml

Requests always reach the backend.

If it continues:

x-decionis-shadow-outcome: UNAVAILABLE on the response.

Checked against docs/marketplace/microsoft/azure-api-management/policies/decionis-gate-shadow.xml

The wrapped tool does not run, including in shadow mode.

Checked against packages/langchain-decionis/src/DecionisGateTool.ts

If the Decionis gate cannot be reached, a local fallback gate decides with fixed rules (allow, block, delay or escalate), and a request missing required fields is blocked.

Change it:

Set DECIONIS_PROTOCOL_FAIL_CLOSED=1 to block instead.

If it continues:

The dossier is marked federated: false, with a local id.

Known gap:

The call to the Decionis gate has no timeout.

Checked against decionis/Commerce: apps/sap/srv/decionis-client.js; apps/sap/docs/runtime-config.md

The governed Flow action stops and downstream updates are halted, in every mode. The shadow observers only record, after the record is saved.

Checked against apps/servicenow/app/script-includes/DecionisControlPlaneUtils.script.js; DecionisVerifyIntentAction.script.js

The action returns an error message and no decision. A Flow that requires continueAction to be true stops; a Flow that does not check it continues.

Change it:

Your Flow's condition on continueAction.

If it continues:

errorMessage is set and continueAction is empty.

Checked against docs/marketplace/salesforce/starter-package/force-app/main/default/classes/DecionisActionGate.cls

The step retries once, then Zapier replays it; later steps in the Zap do not run until Decionis answers.

Checked against packages/zapier-decionis/creates/DecisionDossierClient.js

Make connects through its HTTP module. Decionis answers 502, and your scenario's error handling decides whether the next module runs.

Change it:

The error handler on your scenario's HTTP module.

Checked against apps/web/app/docs/automation-connectors/page.tsx (Make recipe); apps/api/src/routes/ProtocolRoutes.ts

The Decionis node throws and the workflow stops.

Change it:

n8n's own "On Error: Continue" node setting lets the workflow continue.

If it continues:

With Continue set, the output item carries only an error field.

Checked against packages/n8n-nodes-decionis/nodes/Decionis/Decionis.node.ts

Webhooks carry signals in and decisions out; they never hold an action themselves. Senders should retry 5xx answers and timeouts with backoff.

Checked against apps/web/app/docs/webhooks/page.tsx

The extension shows decisions and verifies records offline; it does not hold container actions.

Checked against Registry scope (visibility and offline verification); extension source at github.com/decionis/docker

The connector never runs the action itself. If Decionis cannot answer, the tool returns an error and no authority card; what the assistant does next is up to the assistant and you.

If it continues:

The tool result is marked as an error.

Checked against apps/protocol/src/mcp/McpTools.ts

The connector never runs the action itself. If Decionis cannot answer, the tool returns an error and no authority card; what the assistant does next is up to the assistant and you.

If it continues:

The tool result is marked as an error.

Checked against apps/protocol/src/mcp/McpTools.ts

AuthZEN feeds Decionis a signal; it is not a gate. If Decionis is down, the SDK call it feeds decides, strict by default. If your PDP is down, no signal is sent and your policy's rule for a missing signal applies; the starter policy holds the action for review.

Change it:

required_signals and on_failure in your policy, and the PDP timeout (five seconds by default).

Checked against packages/sdk-node/src/AuthZenEntitlementProvider.ts; docs/architecture/authzen-input-adapter.md

Checkout keeps enforcing the signed policy snapshot already pushed to the store, so an outage changes nothing until that snapshot expires after seven days. After that, or if the snapshot is missing, checkout is blocked.

Change it:

Each rule has an "If Decionis is unreachable" setting in the app, fail closed by default.

Known gap:

Only the net-margin rule's setting reaches checkout today; the other rules' settings are stored but not applied. A product with no cost on file is margin-checked as if its cost were zero.

Checked against decionis/Commerce: apps/shopify/extensions/*-hard-gate; app/lib/policies/RuleEnforcement.server.ts

If the store cannot reach Decionis, checkout continues by default.

Change it:

"If Decionis is unreachable" in the plugin settings: fail open (the default) or fail closed.

If it continues:

The order records the decision as bypassed, with the reason.

Known gap:

An error inside the gate is still answered as allow, so the order proceeds even when fail closed is set. An order with no cost on file proceeds without a margin check.

Checked against decionis/Commerce: connectors/woo/plugin/includes/checkout/RuntimeClient.php; includes/orders/DossierMetadata.php

Listings are left as they are; the monitor never reprices or withdraws a listing without an answer.

If it continues:

The sweep result reports the listing as observed, with the enforcement error.

Checked against decionis/Commerce: connectors/adapters/ebay/src/enforcement/Enforcer.ts; connectors/ebay/src/Monitor.ts

Checkout continues: the Magento hook is optional with a two-second timeout, and an engine error is answered as success.

If it continues:

Log lines at checkout; the post-placement sweep records orders it could not check.

Known gap:

A skipped checkout check is only logged, not stored as a decision record.

Checked against decionis/Commerce: connectors/adobe/magento-module/etc/webhooks.xml; connectors/adobe/src/App.ts

Amazon has no way to hold an order, so Commerce Gate records decisions only. During an outage the order ships untouched.

If it continues:

The sweep is recorded as failed.

Checked against decionis/Commerce: connectors/amazon/src/orders/AmazonOrderGate.ts

Orders are released without a margin check, after the buyer-remorse hold where one applies.

Known gap:

Nothing is stored for an order released this way, and the returned detail reads as a missing cost rather than an outage.

Checked against decionis/Commerce: connectors/tiktok/src/interception/OrderInterceptor.ts

Orders are acknowledged without a margin check. Refunds up to the fallback limit proceed, and larger refunds are held until the check is back.

Change it:

The refund fallback limit is set per deployment (1,000 by default); order acknowledgment behaviour is fixed.

If it continues:

Order Guard records the order as released without a margin check.

Known gap:

An engine fault is recorded with the same wording as a missing cost, and the refund record does not say the fallback limit was used.

Checked against decionis/Commerce: connectors/walmart/src/interception/OrderInterceptor.ts; src/policy/RefundPolicyGate.ts

Commerce Gate does not release the order; it stays in the seller's own Jumia workflow.

Change it:

release_mode decides whether Commerce Gate releases orders at all (advisory by default).

If it continues:

The intercept is recorded as observed, or as failed when a release attempt fails.

Checked against decionis/Commerce: connectors/jumia/src/interception/OrderInterceptor.ts; connectors/adapters/jumia/src/settings/JumiaSettings.ts

An engine error is answered as allow and the order proceeds.

If it continues:

The response says bypassed; nothing is stored.

Known gap:

How the storefront handles a timeout is outside the connector repository and is not stated here.

Checked against decionis/Commerce: connectors/bigcommerce/src/App.ts

An engine error is answered as allow and the order proceeds.

If it continues:

The response says bypassed; nothing is stored.

Known gap:

How the storefront handles a timeout is outside the connector repository and is not stated here.

Checked against decionis/Commerce: connectors/shopware/src/App.ts