Money-path defaults must fail closed
Lesson 3 of six in Claude Code Field Notes: Running AI Coding Agents in Production, drawn from operating more than twenty live software surfaces with Claude Code.
A settlement toggle shipped opt-in, defaulting to false. Production was missing the column entirely, so every priced endpoint mapped to dry-run, and dry-run skipped the payment challenge. The result: every paid endpoint was free to call, while the billing system reported itself live.
The fix inverted the default. Missing or null now means charge; only an explicit toggle disables it.
The generalization applies past payments to any control whose failure is expensive: when a default must be wrong in one direction, choose the direction that fails safe. For revenue, absence should mean charge. For access, absence should mean deny.