Eric Allman (the author of Sendmail) talks about when to apply the Robustness Principle in ACM Queue.

Link: The Robustness Principle Reconsidered