Default Deny vs Default Allow for Agents

The default effect is what happens when no policy rule matches an action. Default deny rejects any action without an explicit allow rule. Default allow permits any action without an explicit deny rule. This choice has profound implications for the security posture of your agent system.

Default Deny

With default deny, every permitted action must be explicitly listed in policy. An action with no matching rule is denied. This approach is sometimes called allowlisting.

Advantages: Unknown actions are blocked. New tools, new action types, and novel attack patterns are denied by default. The attack surface is limited to the explicitly allowed action set.

Disadvantages: More policy writing and maintenance. Every new capability requires a policy update. Agents may be blocked from legitimate actions until the policy is updated.

Default Allow

With default allow, every action proceeds unless a rule explicitly blocks it. An action with no matching rule is allowed. This approach is sometimes called blocklisting.

Advantages: Less policy maintenance. New capabilities work immediately. Lower friction for development and testing.

Disadvantages: Unknown actions are permitted. Novel attack patterns succeed unless specifically anticipated. The attack surface is unbounded.

The Clear Winner for Safety

Default deny is the correct choice for any system where safety matters. The reason is asymmetry: a missed deny rule in a default-allow system creates a vulnerability, while a missed allow rule in a default-deny system creates a false positive. False positives cause inconvenience. Vulnerabilities cause harm.

Practical Implementation

Authensor uses default deny. Every policy starts with default_effect: "deny". Policy authors must explicitly create allow rules for each permitted action.

default_effect: "deny"
rules:
  - action: "search.web"
    effect: "allow"
  - action: "file.read"
    resources: ["public/*"]
    effect: "allow"
  # Everything else is denied

Transitioning from Default Allow

If your system currently uses default allow, transition gradually. Enable audit logging to identify all actions that agents perform. Create allow rules for each legitimate action. Switch to default deny. Monitor for unexpected denials and add rules as needed.

Default deny is more work. It is also the only defensible choice for production safety.