Authority

Deny-by-default

Also called: default deny · allowlist · positive security model

DefinitionDeny-by-default is a policy posture in which any request that does not match an explicit allow rule is refused, including requests the system does not recognise.

There are two ways to write a security policy. You can list what is forbidden and allow everything else, or you can list what is permitted and refuse everything else. The first is a blocklist. The second is deny-by-default, and it is the only one of the two that can stop something nobody thought of in advance.

Why blocklists lose

A blocklist can only contain threats someone has already imagined. Deny ~/.ssh and you have not denied ~/.config/gcloud, ~/.kube/config, ~/.netrc, the .env two directories up, or the credentials someone committed to a repository in 2021.

Against software whose next action is generated at runtime, this is a losing position by construction. You are trying to enumerate the bad, and the space of bad is larger than your list and growing faster than you can maintain it.

Unknown counts as denied

The property that makes deny-by-default hold under pressure is what happens to requests the system does not recognise.

It is tempting to let an unclassified operation through — it is probably fine, and denying it might break something. That instinct is exactly the failure. An operation nobody modelled is the one you understand least, and “we could not categorise it, so we allowed it” is a bypass with a queue forming behind it.

In BitShout, an unknown filesystem operation, an unknown execution operation and an unknown network category are all denied for contained subjects, and none of them can be added to a rule. Uncertainty does not convert into trust.

The exception path is the hard part

Deny-by-default has an obvious failure mode: any boundary strict enough to be useful will block something legitimate, and if the only way to unblock it is a broad permanent allow, everyone will use that, and within a week the boundary is decorative.

So the quality of a deny-by-default system is really the quality of its exception path. That means a grant scoped to one subject, one operation, one resource and a clock; approval on a surface the requester cannot reach; revalidation on every use; and expiry that happens without anyone remembering to clean up. See authorization and grants for how that is built.

Deny-by-default is about the starting position. Least privilege is about the size of what you then grant. Fail-closed is about what happens when the enforcement mechanism itself stops working. A system can be deny-by-default and still fail open, which is why the three are tracked separately.