Fallback Path

Version

v4 · 2026-08-30 · History

Prime #

1367

Origin domain

Systems Thinking & Cybernetics

Subdomain

resilient system design → Systems Thinking & Cybernetics

Aliases

Fallback, Backup Channel, Alternate Path on Failure, Contingency Route

Related primes

Functional Redundancy (Degeneracy), Contextual Mode Switching

Core Idea

A fallback path is a maintained alternative route that carries a function when the preferred route cannot, entering service on a declared condition and delivering a stated floor rather than the full measure of performance. ^[1] The prime names a small ordered machine, not a general posture of preparedness. Six commitments must be present together: a primary route that normally does the work; at least one distinct secondary route that reaches the same outcome by other means; an activation condition fixing when the handoff occurs; an ordering rule settling which alternative is taken and in what sequence; a minimum service contract naming what must still arrive; and a termination test reporting whether the secondary succeeded or the ladder ran out. ^[2]

Everyday speech applies the word to anything one might do next, and that looseness is what the prime exists to tighten. An alternative that was never provisioned, a route nobody has authority to order into service, and a substitute with no agreed floor each fail the test differently, and the difference matters because each defect surfaces at a different moment: the first during the incident, the second during the argument about the incident, the third during the review afterwards.

The bargain is deliberately asymmetric. The secondary is accepted as worse along whichever dimension the primary was optimized for — speed, cost, precision, richness, coverage — in exchange for the function continuing at all. ^[1] Because that price is set in advance, the arrangement converts an open-ended outage into a bounded degradation whose shape was chosen while the designers were calm rather than improvised while the system was down. The ordering is the load-bearing part: remove it and what remains is a set of interchangeable options with no account of which one the system will actually take.

Structural Signature

Preferred route carrying a function → detected unavailability or insufficiency of that route → ordered selection from a provisioned alternative set → continued delivery at a declared floor → resolution, reversion, or exhaustion. ^[2]

Recurring features:

• Asymmetric priority. The alternatives are ranked rather than merely enumerated, so what the system will do is knowable before the failure rather than after it.
• A testable trigger. The handoff is governed by a condition that can be evaluated — a timeout, a threshold crossing, a failed health check, a shortfall against a target — and that condition is held separately from the routes it selects among.
• Provisioned, not nominated. The secondary has real capacity, live credentials, a compatible interface, and a party with standing authority to invoke it, all in place before the moment of need.
• A floor rather than a copy. What the secondary guarantees is a named subset of what the primary delivered: fewer features, coarser data, longer latency, smaller volume, but still the part that mattered.
• Bounded exposure while degraded. The alternative carries limits — a value cap, a time budget, a narrowed scope of authority — that stop the cost of running degraded from growing unobserved.
• A terminus. The ladder ends somewhere: either the function is restored, or a defined last rung refuses to continue rather than descending indefinitely.
• A return rule. Something states when the primary is trusted again and how the function moves back, making the degraded state a passage rather than a destination.

What It Is Not

A fallback path is not a plan. Naming an alternative in a document, listing a vendor who could supply the part, or noting that staff could work on paper describes an intention; until capacity is reserved and the route can be exercised on demand, nothing has been built, and the outage will proceed as though the paragraph had never been written.

It is not the same as doing less on the same route. A service that drops image quality, samples fewer sensors, or returns a shorter result set is reducing what it delivers while the delivery travels exactly where it always did. There is no second route and no handoff, so the questions this prime asks — which route, chosen by what rule, guaranteeing what — have nothing to attach to. ^[1]

It is not the improvisation an operator invents at three in the morning. That improvisation may be brilliant and may save the day, but it was not available beforehand to be tested, costed, or authorized, which is precisely the property that makes a maintained route worth its holding cost.

It is not automatically safer. A degraded route can approve what a fuller check would have refused, can buy minutes where hours were needed, and can conceal the primary's failure until the remaining margin is gone. Whether continuing beats stopping is a real question, and the existence of an alternative is not the answer to it.

Nor is it permanent. A route that has been carrying production for a year is not a fallback; it is the primary, now running without one, and the original ordering has become documentation of a system that no longer exists.

Broad Use

Networks and distributed systems. Routing protocols withdraw a failed adjacency and install a precomputed alternative; resolvers move to a secondary nameserver; services answer from cache when the authoritative store is unreachable and mark the answer stale; a system enters read-only mode rather than refusing every request outright. ^[3]

Clinical practice. Treatment lines are ordered, with a second-line agent held for failure of response or tolerance of the first, and airway management runs an explicit ladder from mask ventilation through a supraglottic device to a surgical airway, the transitions and the stopping point rehearsed rather than debated in the room.

Aviation and marine operations. A flight plan nominates an alternate field and carries the fuel to reach it, which makes the secondary route's feasibility a quantity loaded before departure; flight-control systems define reversion modes of reduced protection; navigation moves from satellite fixes to inertial and dead-reckoning positions whose error grows in a known way.

Energy and facilities. Utility supply gives way to stored energy that bridges a transfer interval, which in turn gives way to a generator. Here the ordering is temporal as much as preferential, because each rung exists to cover the start-up time of the next.

Supply and procurement. A qualified second source is held at a small standing allocation so that qualification stays live, tooling stays warm, and the relationship survives; that allocation is the visible premium paid for the option. ^[4]

Biology. Collateral vessels carry perfusion around an occlusion; alternative metabolic routes engage when a preferred one is blocked or its substrate is absent, with a concentration serving as the trigger and a sustainable rate of energy production serving as the floor.

Law and institutions. Default rules supply terms the parties did not write, intestacy supplies a distribution the deceased did not specify, and provisional ballots let a vote be cast when eligibility cannot be confirmed at the desk — each preserving a minimum outcome when the preferred instrument is missing.

Language and interaction. A speaker who cannot retrieve a word takes a longer route to the same referent through description, and repair sequences escalate in a recognizable order from a minimal signal of trouble to explicit reformulation.

Clarity

The confusion this prime dissolves is between having options and having a route. A team can hold three vendors, two data centres, and a spare crew without any of it constituting a fallback path, because nothing states the condition under which an alternative is taken, who takes it, or what it promises to deliver once taken. Writing those three things down turns a survey of possibilities into the inspection of a single mechanism. ^[5]

A second confusion it dissolves concerns what "up" means. Availability reported as one fraction hides route identity, so a system that has spent six weeks on its last remaining path reports the same number as one running comfortably on its first. Naming the route restores the missing dimension: uptime and remaining depth are different quantities, and only the second predicts what the next failure will cost.

It also settles the recurring argument about whether an event counted as an outage. With a minimum service contract in hand the question becomes a measurement rather than a negotiation — the floor was held or it was not — and the disagreement moves to where it belongs, onto whether the floor was set at the right height.

Manages Complexity

What this construct lets you stop tracking is the primary's failure modes, consumer by consumer. Downstream callers do not need to know whether the store is unreachable because of a partition, a full disk, a bad deployment, or an expired certificate. They need to know what they are still entitled to and how to tell that they are receiving it. The contract absorbs the taxonomy of causes, which is the part of the problem that grows without bound. ^[6]

It also collapses scenario planning. Without the construct, preparedness work enumerates situations — what if the region is lost, what if the supplier is shut down, what if the only specialist is unavailable — and that list has no natural end. With it, the work reduces to maintaining a small set of routes, keeping each trigger honest, and confirming that the floor is still reachable, so effort scales with the number of routes rather than with the number of imaginable disasters.

The third saving is in coordination. Because the ordering is fixed in advance, two teams meeting the same failure make the same choice without conferring, and nobody reconstructs priorities under time pressure. Reasoning that would otherwise happen during the incident happened once, beforehand, and now belongs to the system rather than to whoever is on call.

Abstract Reasoning

The prime licenses a compact diagnostic: name each role in the case at hand, and let the missing one predict the failure. An absent trigger yields a route that exists but is entered late, by argument, once somebody notices. An absent ordering rule yields contention, with two candidates each believing itself next. An absent floor yields a post-incident dispute nobody can settle, because the parties never agreed what continuing was supposed to mean. An absent terminus yields indefinite retrying with no escalation, a system politely failing forever. An unprovisioned alternative yields improvisation, and an absent return rule yields a system that never comes home. ^[2]

Two counterfactual tests follow. The first is direct: remove the primary now and ask what carries the function, who decides, within what interval, and to what floor. An answer that requires a person to think is a workaround; an answer that names a route and a rule is the real thing.

The second test concerns independence and is the one most often skipped. Ask whether the condition that fires the handoff could also disable the route being handed to. If the same power feed, certificate authority, clearing bank, or underlying carrier sits beneath both, the ordering is nominal: the alternative will be unavailable in exactly the states that call for it, and the true depth is one rather than two.

Knowledge Transfer

What crosses substrates is the skeleton and the interrogation that comes with it. Anyone who can ask what the floor is, what fires the handoff, who may order it, and where the ladder stops can question a routing design, a treatment protocol, a procurement policy, or a constitutional succession clause with the same short list and get informative answers from all of them. ^[5] The characteristic pathologies travel too: the untested alternative, the unannounced handoff, the undersized secondary, and the shared dependency turn up wherever ordered routes are maintained.

What does not cross is everything quantitative and everything about cost. Switching latency ranges from microseconds in a forwarding table to months in supplier requalification, and that scale alone decides whether the trigger can be automatic or must be judged by a person. Holding cost differs in kind rather than degree: a standby generator consumes capital and fuel tests, a second source consumes margin and volume, an alternative metabolic route consumes expression capacity, and a circumlocution consumes nothing at all until it is used. Reversion may be free or may be a second full transition carrying its own risk. Whether the floor can be written down varies as well — a bandwidth figure is contractible, a clinician's judgment of adequate oxygenation is not — and where it cannot be specified, the minimum has to be carried by training and rehearsal instead. Transfers that ignore these differences import the shape correctly and the economics not at all.

Examples

Formal/abstract

Take a directed graph with positive edge weights, a source, a destination, and a preferred path chosen as the least-cost route between them. For every element on that path, precompute an alternative that avoids the element and remains loop-free when installed unilaterally, so no coordination is required at the moment of the switch. The trigger is a local event, namely that the element stops answering. The floor is a promise about reachability rather than about cost: traffic still arrives, along a path that may be substantially longer. Exhaustion is well defined too, because for some elements no avoiding path exists at all, and the computation reports that in advance rather than at failure time. ^[3]

The instructive subtlety is that edge-disjointness is the wrong independence condition. Two edges sharing no endpoints may still share a conduit, a fibre bundle, a power feed, or one vendor's equipment, and a cut that severs either severs both. Independence therefore has to be defined over a partition of the edges into shared-risk groups, with the backup counting as genuine only if it avoids the failed element's whole group rather than the element alone. Under the weaker condition the ordering is an artifact of the model. ^[7]

Mapped back: every role appears explicitly and can be pointed at. The least-cost route is the primary, the precomputed avoiding route is the provisioned secondary, the local liveness event is the trigger, the loop-free precedence relation is the ordering rule, reachability is the minimum service contract, and the report that no avoiding path exists is the exhaustion test. The shared-risk refinement is the formal statement of this prime's commonest real defect, which is that the depth a design claims exceeds the depth its dependencies permit.

Applied/industry

A card payment terminal normally sends an authorization request through the acquirer and the card network to the issuing bank, which answers on the cardholder's live balance and risk profile. When the issuer is unreachable or does not respond inside the network's timeout, the network may authorize on the issuer's behalf under rules the issuer supplied in advance — narrower rules, applied to less information, but rules the issuer wrote and owns. If the network is unreachable as well, the terminal may approve locally for amounts under a configured limit and store the transaction for transmission once the link returns. ^[8]

The ladder is ordered, the triggers are timeouts and link state, and the floor is that a legitimate sale completes rather than being refused at the counter. Exposure is bounded in two directions: by the value limit on locally approved transactions, and by a cap on how many may be held before the terminal stops accepting them, at which point the last rung deliberately declines instead of descending further. The price of the degraded route is made explicit as a shift in who bears the loss when a stored transaction later proves bad: in US industry guidance for communications outages the merchant absorbs it if the issuer afterwards declines the stored authorization and the customer has already left with the goods, and on this entry's reading that allocation is what keeps the option honest, since the party who benefits from continuing also pays for continuing badly. ^[9]

Mapped back: this is the same machine as the graph, executed by institutions instead of routers, and the divergences are exactly the ones that never transfer. The trigger interval is set by human patience at a counter rather than by packet timing, the floor is commercial rather than topological, and the cost of running degraded shows up as credit and fraud loss rather than as extra hops. The construct's standing warning applies unchanged: because the ladder usually works, its lower rungs are exercised rarely, and rules held for stand-in use can drift out of date for years before anyone finds out.

Structural Tensions

T1 — The rehearsal gap. A fallback is invoked rarely by construction, so its defects accumulate where nobody is looking: the generator that will not start, the restore never once attempted, the second source whose tooling was quietly scrapped, the procedure whose authorising officer has left. Readiness is assumed rather than measured, and the assumption is tested for the first time by the emergency itself. Deliberate exercise is the only cure, and deliberate exercise means spending real availability to buy confidence in something that is otherwise pure belief.

T2 — Silent success consumes the margin. A handoff that works quietly destroys the evidence that the primary broke. The function continues, indicators stay green, and the system runs on its last remaining route for weeks while everyone believes it still has depth. The alarm therefore has to fire on the transition rather than on the outcome, which inverts the usual instinct to alert only when something visibly goes wrong. Organizations that get this backwards learn their true depth on the day the second route fails too.

T3 — The alternative is sized for an imagined fraction. Secondaries are provisioned against a partial shift — a share of traffic, a portion of demand, a subset of cases — because provisioning for the whole load costs nearly what the primary costs. Real failures are frequently total, and the entire load arrives at a route built for part of it. The alternative then collapses under a burden it was never meant to carry, turning a recoverable partial outage into a complete one and adding the confusion of two simultaneous failures.

T4 — Continuing versus refusing. Degraded operation is not always the right choice. An authentication path that accepts weaker evidence, a control loop running on stale sensor values, and a settlement process approving without a live balance check can each do more damage than a clean stop would. The contract has to state not merely what is preserved but what is not worth preserving without, and that judgment belongs to whoever bears the resulting loss rather than to whoever is inconvenienced by the refusal.

T5 — Independence asserted, correlation delivered. Routes designated as alternatives are usually independent when designed and less so every year afterwards, as consolidation moves both onto one carrier, one region, one certificate authority, one clearing bank. Nothing announces the change, because each individual step improves cost or simplicity on its own terms. The ordering survives on paper while the depth it describes has already collapsed, and the discovery is made during the single event the whole arrangement existed to survive.

T6 — Invocation drifts toward the cheap route. If the alternative is easier, faster, or less policed, operators and adversaries both learn to reach for it. Staff route around a fussy primary until the degraded path becomes the working norm and its reduced guarantees are silently accepted as the baseline. Attackers do the same deliberately, inducing the trigger to force negotiation down onto a weaker route. A fallback worth having is therefore one that is genuinely worse to use and cannot be summoned by anyone who profits from summoning it.

Structural–Framed Character

Fallback Path sits at the midline of the structural–framed spectrum — mixed-framed, aggregate 0.5, with every diagnostic at 0.5. The skeleton is a small ordered machine: a preferred primary route carrying the function, a distinct secondary route identified before or at the point of need, a check detecting primary unavailability or inadequacy, an activation or selection rule, and a preserved minimum function at possibly reduced quality. Network routing, emergency procedures, supply sourcing, biological pathways, and conversational strategies preserve those primary–trigger–secondary–minimum roles.

Human-practice-bound at 0.5 does most of the explanatory work: the ordering and the minimum service contract are declared in advance. A fallback must be executable, not merely imaginable, and primary–secondary priority is load-bearing rather than an incidental label: someone has designated it. Biological pathways sitting among the substrates that preserve the roles is what keeps the prime off the framed pole.

Vocabulary travels partially at 0.5 — route, handoff, minimum service carry an engineering and operations accent that supply sourcing and conversational strategies restate. Evaluative weight is 0.5: a preferred route, and a trade of optimal performance for continued operation, carry a mild normative load. Institutional origin is 0.5, routing and emergency procedure being the home register. Import-versus-recognize is 0.5: in engineered systems one recognizes an ordering already installed; elsewhere the primary–secondary framing is laid over routes not labelled that way.

The grade permits wide transfer provided the roles are real: without an activation condition, an ordering rule, a stated minimum, and a way to detect success or exhaustion, the case is redundancy, contingency planning, failover, or graceful degradation.

Substrate Independence

Fallback Path is a highly substrate-independent prime — composite 4 / 5 on the substrate-independence scale. The transportable machine has six parts and no vocabulary of its own: a primary route carrying a function, a testable condition fixing when the handoff occurs, an ordered set of provisioned alternatives, a declared floor naming what must still arrive, a terminus where the ladder refuses to descend further, and a rule for reverting. Network routing, emergency procedure, second-source supply, tiered decision rules, redundant metabolic pathways, and conversational repair all preserve that ordering. What holds it at four is the design commitment sitting inside it: something must have ranked and provisioned the alternatives in advance, so in systems nobody engineered the ordering has to be argued for rather than read off.

• Composite substrate independence — 4 / 5
• Domain breadth — 4 / 5
• Structural abstraction — 4 / 5
• Transfer evidence — 4 / 5

Relationships to Other Abstractions

Current abstraction Fallback Path Prime

Parents (2) — more general patterns this builds on

• Fallback Path is a kind of Contextual Mode Switching Prime

  Fallback is context-triggered switching among maintained operating routes with failure or insufficiency as the cue and priority ordering as its differentia.

• Fallback Path is a kind of Functional Redundancy (Degeneracy) Prime

  Fallback Path is the ordered primary-secondary species of diverse pathways that can realize the same minimum function.

Children (2) — more specific cases that build on this

• Exception handling Domain-specific is a kind of Fallback Path

  The proposed strict upward parent is prime:fallback_path.

• Augmentative and Alternative Communication (AAC) Domain-specific is a decomposition of, conditional Fallback Path

  Removing the child’s frame leaves the reusable structure named by Fallback Path.

Hierarchy paths (14) — routes to 9 parentless roots

• Fallback Path → Contextual Mode Switching → Adaptation

Show alternative paths (13)

Neighborhood in Abstraction Space

Fallback Path sits in a sparse region of abstraction space (89^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely rather than landing on a neighbor.

Family — Formal Systems & Structural Conditions (20 primes)

Nearest neighbors

• Path Dependence — 0.69
• Desire Path — 0.68
• Optionality — 0.68
• Return Path — 0.68
• Reaction-Channel Back-Action — 0.68

Computed from structural-signature embeddings · 2026-09-10

Not to Be Confused With

Fallback Path must first be separated from Functional Redundancy (Degeneracy), its parent in the catalog and the source of most of the confusion around it. Functional redundancy holds that several non-identical pathways can each realize the same function, so losing one need not eliminate it. That is a claim about the space of sufficient pathways and nothing more: the pathways may be unranked, may be discovered opportunistically, and may all be running at once. Fallback Path adds three commitments the parent does not require — a designated preference among the pathways, a condition governing movement between them, and a floor the chosen pathway must clear. Degeneracy is the raw material; this prime is degeneracy with a policy attached. A protein family whose members cover for one another under different conditions exhibits the parent. A protocol that attempts one named cipher and, on refusal, a named weaker one, exhibits the child.

It is equally distinct from Contextual Mode Switching, its other parent, which describes a controller selecting one maintained mode from a repertoire in response to a context cue rather than composing a response afresh. Mode switching is symmetric about its modes: a speaker moving between registers, or a machine moving between operating profiles, is matching a mode to a situation rather than descending a ladder, and no mode is a demotion. Fallback Path is the asymmetric special case in which the cue is specifically the preferred mode's failure or insufficiency and the modes are ranked by desirability. Every invocation of a fallback is a mode switch; most mode switches are not fallbacks, because nothing has gone wrong and there is no floor being defended.

Redundancy duplicates components so that losing one does not remove the capacity it supplied. Its instances are copies of the same thing, frequently running concurrently with load shared between them, and the identity of the surviving unit is immaterial. This prime requires neither duplication nor concurrency, and it does care about identity, since the entire construct concerns which route is carrying and in what order. Reserve stands one step further off: a deliberately maintained surplus held beyond expected need absorbs variation without any change of route, and spare fuel, held cash, or buffer inventory does not become a fallback merely by existing. The two combine well, because reserve capacity is often what makes an alternative executable, but a surplus with no trigger and no ordering is only a cushion.

Fail-Safe points the opposite way along the same axis. Where this prime preserves function at a reduced level, a fail-safe abandons function to reach a state that is safe when things go wrong: the brake that engages on loss of pressure, the interlock that opens, the valve that shuts. Both are triggered by failure, but their guarantees contradict each other — one promises that something continues, the other promises that nothing dangerous continues. Mature systems contain both, arranged so the ladder's last rung hands over to a fail-safe stop. Conflating them produces designs that keep operating past the point at which operating was the hazard.

Circuit Breaker is a protective cutoff that trips on a danger threshold, isolates what lies beyond it, and can be reset. It is a detector and an interrupter, not a route. The two are deployed together so often that the pair is frequently named as one thing, but the division of labour is clean: the breaker decides that the primary must stop being attempted and holds that decision stable against flapping, while the alternative carries the function through the interval the breaker has opened. A breaker with nothing behind it produces a fast, well-controlled failure; an alternative with no breaker in front of it is reached through timeouts, slowly and expensively, every single time.

Finally, Recovery is a trajectory rather than a route: the phased movement of a damaged system back toward a working state, ending somewhere that may or may not be where it began. This prime operates during that trajectory and determines how deep the trough goes, but it is selected at the moment of failure and is not itself the arc of restoration. Substitutability, nearby, is a capability relation — one component can stand in for another without functional loss — and it says nothing about when the substitution happens, who orders it, or what would count as acceptable afterwards. Substitutability makes an alternative possible; the trigger, the ordering, and the floor are what make it a path.

Solution Archetypes

No catalogued solution archetypes reference this prime yet.

References

[1] Avizienis, Algirdas, Jean-Claude Laprie, Brian Randell, and Carl Landwehr. "Basic Concepts and Taxonomy of Dependable and Secure Computing". IEEE Transactions on Dependable and Secure Computing, 2004. Defines fault handling by reconfiguration onto non-failed components, and separately defines degraded modes of service in which the specification names reduced levels — slow service, limited service, emergency service — that the system signals to its users. registry ↩a ↩b ↩c

[2] Randell, Brian. "System structure for software fault tolerance". Proceedings of the International Conference on Reliable Software, ACM, 1975. Specifies the recovery block: an acceptance test that both fixes the activation condition and states the minimum the result must satisfy, a primary followed by an ordered list of alternates, and a defined error exit when the alternates are exhausted. registry ↩a ↩b ↩c

[3] Atlas, Alia, and Alex Zinin, eds. RFC 5286, Basic Specification for IP Fast Reroute: Loop-Free Alternates. IETF, 2008. Specifies precomputed loop-free alternate next-hops installed unilaterally on local failure detection, and the advance determination that for some elements no alternate exists at all. registry ↩a ↩b

[4] Tomlin, Brian. "On the Value of Mitigation and Contingency Strategies for Managing Supply Chain Disruption Risks". Management Science, 2006. Models dual sourcing — a standing allocation of volume to a reliable but costlier supplier — against contingent rerouting that requires the backup to hold ramp-up capacity, and prices the premium each arrangement carries. registry ↩

[5] International Organization for Standardization. ISO 22301:2019, Security and Resilience — Business Continuity Management Systems — Requirements. ISO, 2019. Requires documented continuity plans stating the activation criteria and procedure, the roles and authorities that may invoke them, and the minimum acceptable capacity at which prioritised activities must be resumed. registry ↩a ↩b

[6] Cristian, Flaviu. "Understanding fault-tolerant distributed systems". Communications of the ACM, 1991. Defines failure semantics — the bounded classes of behaviour a server may exhibit — so that a client depends on a specified service contract rather than on an open-ended taxonomy of underlying causes. registry ↩

[7] Strand, John, Angela L. Chiu, and Robert Tkach. "Issues for routing in the optical layer". IEEE Communications Magazine, 2001. Introduces the shared risk link group, showing that fibres disjoint at one layer can share a duct or right of way and fail together, so disjointness does not establish independence of a backup route. registry ↩

[8] EMVCo. EMV Integrated Circuit Card Specifications for Payment Systems, Book 3: Application Specification, Version 4.3. EMVCo, 2011. Specifies terminal risk management with floor limits, terminal action analysis including the default action taken when the terminal cannot go online, and the transaction log by which an offline approval is held for later transmission. registry ↩

[9] EMV Migration Forum and Smart Card Alliance. Merchant Processing During Communications Disruptions, Version 1.0. April 2016. Supports only the loss allocation on the degraded path: the merchant is "responsible for any loss incurred if the authorization is declined by the issuer and the customer is allowed to leave with the merchandise." It is industry guidance rather than a card network's operating rules, and it does not claim that bearing the loss is what disciplines use of the offline route. registry ↩