A fraud firewall sits in your signup path. When it goes down, it must let signups through. A wrong block is worse than a missed send — and that single asymmetry decides how the whole system behaves under failure.
Fail-open vs fail-closed
Fail-closed means: if the guard can't reach a verdict, deny. That's the right default for a bank vault, where the cost of wrongly allowing dwarfs the cost of wrongly blocking.
A verification firewall is the opposite. If Verifence can't decide, blocking means turning away real customers at the exact moment they're trying to sign up. There is no bounded cost to that — you don't know how many, you don't know who, and you can't get them back. So the default flips: when in doubt, allow.
Availability can't depend on us
The rule follows from where the service lives. We're one HTTP call in front of your OTP send. If our being up were a precondition for your signups working, we'd have added a single point of failure to your critical path — and traded a rare fraud problem for a rare total-outage problem, which is worse.
So availability of your signup flow must never depend on Verifence being up. That's a hard constraint, not a nice-to-have.
Degraded mode
Concretely: if Redis is unreachable, the decision doesn't error. It returns allow with a degraded: true flag. The velocity and reputation layers need the cache; when it's gone, they can't run, so the request is allowed on the strength of the layers that still can (the free destination-shape check still rejects garbage).
A cache outage never turns into a 500. A decision endpoint that 500s in the signup path is a fail-closed firewall wearing a fail-open costume — the caller still can't send.
Loud, not silent
Failing open silently would be its own bug. You'd be unprotected and not know it.
So degraded mode is loud: every fail-open decision emits an unconditional log line with a fixed marker string, meant to be wired straight to an alert. Operators learn instantly that the firewall is coasting, and for how long.
The math that justifies it
The nuance people miss: fraud that slips during a rare, short outage is cheap. It's bounded by the outage window and the attacker's luck in hitting it. Blocked real signups are expensive — unbounded, invisible, and permanent.
Optimize for the expensive failure. Let a little fraud through when you're blind, shout that you're blind, and fix the blindness fast. Never hold real users hostage to your own uptime.