Every system fails eventually. The useful design question is not whether, but which way. For elan1 we wrote the answer as a rule: when anything is unclear or unavailable, elan1 stops and asks a person.
The asymmetry
A change that waits costs time. A wrong change committed to the books costs a correction, an explanation to an auditor and sometimes a restatement. Those costs are not symmetrical, so the failure direction should not be either. Stopping allows is the safe direction.
What happens when
| If… | Then… |
|---|---|
| elan1 Govern is unavailable | Allows stop. Changes wait for a person. |
| The runtime is unavailable | Writes stop. |
| elan1 is unreachable from Run tooling | The gate check fails closed. |
| A named approver does not answer in time | The write expires. Expiry means refusal, with a record, metered at 0.4 of a governed action. |
| elan1 Decide's confidence is below your threshold | The case goes to a person in the Review Console. |
| A check cannot be completed | The write is refused with a typed code, never waved through. |
The person is named, and is not the asker
Failing toward a human only helps if the human can decide well. Where your autonomy level asks for a person, the approver is named, is never the one who proposed the change, and sees the difference, the gates and the policy before saying yes or no. Approvals arrive where people already work: the console, the CA console, through /v1, on WhatsApp or by voice.
An approval that nobody answers does not quietly become an allow. The wait is held on Run's run contract, and expiry means refusal. A record is still written, so the queue that nobody cleared is visible later.
What it costs
Failing toward a human is slower, sometimes noticeably. A month-end close with a stalled approval waits. We think that is the right trade for writes that commit the business, and the wrong one for everything else — which is why the rule applies to consequential writes, not to reading, drafting or answering.
A runtime outage stops writes. An elan1 outage stops allows. Stopping allows is the safe direction.
Corrections
- 10 Oct 2026Status updated at launch: elan1 Govern, Work, Decide and Run are available, with L1 Guarded and L2 Attested. Technical content unchanged.