---
title: "ADR-0004: Enforce by default, Observe only as a visible migration mode"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0004@main"
source: "Adr/ADR-0004-FailClosedAndModes.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# ADR-0004: Enforce by default, Observe only as a visible migration mode {#adr-0004}

-   *Status:* Historical proposal (original status: Proposed)
-   *Date:* 2026-10-08
-   *Original decision makers:*

    Project architecture/security owners; approval
    still pending in the original proposal.

-   *Requirements:* HG-003, HG-004, HG-021, HG-033, HG-034, HG-043
-   *Original supersession:* None; a new decision for the proposed product.

> [!NOTE]
> This is the full English translation of the historical proposal dated
> 2026-10-08, originally Proposed. Its pending approval is historical and
> creates no additional alpha approval gate. Current
> [Security model and limits](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security@main), [Development and tests](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development@main), [Verification report](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-report@main) and
> [Requirements and security invariants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development-requirements@main) describe the operative scope and evidence.
>
> The later single-package decision is recorded in [ADR-0015: One installable extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0015@main).

## Context {#adr-0004-context}

A newly installed security extension creates an assumption of protection.
Silent fallback without cURL or with invalid policy would violate that
assumption. An existing project also needs controlled inventory of its
internal connections. Vault currently deliberately provides weaker behavior
without cURL.

Sources: `[S04-S06, S16]`.

## Decision {#adr-0004-decision}

New installation: `enforce`, with no internal grants. Missing
optional configuration uses safe defaults; invalid existing configuration
fails. Unsupported transport conditions block before contact with the target
or proxy.

`observe` is an explicit operator decision. Where verifiable, it
records `would_deny` or `unverifiable`, but delegates to the
previous transport and must not be considered protected. A diagnostic problem
must not appear there as a successful security check. Existing Core/Vault
controls remain untouched.

`disabled` is transparent and visible. There is no automatic switch
from Enforce to Observe or Disabled. Rollback and exceptions require changes
to trusted project configuration. No switch may come from an HTTP parameter or
a remote response header.

## Rejected alternatives {#adr-0004-rejected-alternatives}

-   **Observe as the installation default:** does not initially provide the
    expected protection.
-   **Warn instead of blocking transport gaps:** makes loss of the invariant
    difficult to recognize.
-   **Fail open on configuration errors:** a typo would expand permissions.

## Consequences {#adr-0004-consequences}

Failures are unambiguous; existing installations may fail after activation
until legitimate internal accesses are recorded. Rollout needs an inventory,
diagnostics and deliberate authorization. Observe telemetry does not qualify
the Enforce transport.

## Evidence and acceptance in the original proposal {#adr-0004-verification-and-acceptance}

`T005, T006, T042, T065, T066, T067`. Details and expected results
are in [Original verification specification](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/06-verification.md). These tests were specified, not
executed as part of the original documentation delivery.

## Reasons to reconsider {#adr-0004-reassessment-trigger}

Changing the installation default is a product-wide security/compatibility
decision. Automatic downgrading remains prohibited regardless.

## Related documents {#adr-0004-related-documents}

[Original ADR](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/adr/ADR-0004-fail-closed-und-betriebsmodi.md), [Original product requirements](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/01-product-requirements.md), [Original security model](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/02-security-model.md),
[Original architecture](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/03-architecture.md) and [Original source catalogue](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/08-evidence-and-sources.md) (`S01-S23`),
plus the [ADR index](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-index@main). [Original sources](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-original-sources@main) explains
the immutable source index.