{"abstract":"An explicit deny is overridden by allows.","category":"Configuration","checks":8,"contract":"Return deny if any applicable explicit deny, allow if at least one applicable allow, otherwise the provided default. Ignore disabled and nonmatching rules. Unknown effects do not grant access.","evaluation_group":"xt-policy-combine","failed_approach":"The attempted repair substitutes if 'deny' in effects and 'allow' not in effects: return False. Fixture 4 still yields True instead of False.","family":"xt-policy-combine-deny-precedence","id":"FA-9791","implementations":{"attempt":{"sha256":"ff3edb48b0bdc7771d5363d0a79bb1cd5adef687dc0e7430a8ecb072a5a8d9fa","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(rules, resource, default):\n    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]\n    if 'deny' in effects and 'allow' not in effects: return False\n    if 'allow' in effects: return True\n    return default\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve([], 'a', False), False)\ncheck('fixture 2', solve([], 'a', True), True)\ncheck('fixture 3', solve([('a', 'allow', True)], 'a', False), True)\ncheck('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)\ncheck('fixture 5', solve([('a', 'deny', False)], 'a', True), True)\ncheck('fixture 6', solve([('b', 'allow', True)], 'a', False), False)\ncheck('fixture 7', solve([('*', 'allow', True)], 'a', False), True)\ncheck('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"10393481b0b7c2b37425338d2276a29829ebbf07d244d4015cf96c2dc16bdb62","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(rules, resource, default):\n    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]\n    if 'deny' in effects: return True\n    if 'allow' in effects: return True\n    return default\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve([], 'a', False), False)\ncheck('fixture 2', solve([], 'a', True), True)\ncheck('fixture 3', solve([('a', 'allow', True)], 'a', False), True)\ncheck('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)\ncheck('fixture 5', solve([('a', 'deny', False)], 'a', True), True)\ncheck('fixture 6', solve([('b', 'allow', True)], 'a', False), False)\ncheck('fixture 7', solve([('*', 'allow', True)], 'a', False), True)\ncheck('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"0f3886ac8993dc06cf67098e74d07e6725a84047428149241f03533f9290d603","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(rules, resource, default):\n    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]\n    if 'deny' in effects: return False\n    if 'allow' in effects: return True\n    return default\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve([], 'a', False), False)\ncheck('fixture 2', solve([], 'a', True), True)\ncheck('fixture 3', solve([('a', 'allow', True)], 'a', False), True)\ncheck('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)\ncheck('fixture 5', solve([('a', 'deny', False)], 'a', True), True)\ncheck('fixture 6', solve([('b', 'allow', True)], 'a', False), False)\ncheck('fixture 7', solve([('*', 'allow', True)], 'a', False), True)\ncheck('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":" This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xt-policy-combine-deny-precedence","generated_at":"2026-09-29T14:38:33.040560+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"An offline model of access policy decision combination, suitable for testing build and release tooling without external services.","repair":"Explicit deny dominates applicable allows.","root_cause":"The implementation substitutes if 'deny' in effects: return True for if 'deny' in effects: return False, so an explicit deny is overridden by allows.","sha256":"e239bc16b2f5ee6f6bd6a90df419bbcdad013f4e1b0eaaf6cb0e9f3d5ceaf671","title":"Access policy decision combination: An explicit deny is overridden by allows · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":38.219,"exit_code":1,"observations":[{"actual":false,"check":"fixture 1","expected":false,"passed":true},{"actual":true,"check":"fixture 2","expected":true,"passed":true},{"actual":true,"check":"fixture 3","expected":true,"passed":true},{"actual":true,"check":"fixture 4","expected":false,"passed":false},{"actual":true,"check":"fixture 5","expected":true,"passed":true},{"actual":false,"check":"fixture 6","expected":false,"passed":true},{"actual":true,"check":"fixture 7","expected":true,"passed":true},{"actual":false,"check":"fixture 8","expected":false,"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": true, \"expected\": false, \"passed\": false}, {\"check\": \"fixture 5\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 7\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 8\", \"actual\": false, \"expected\": false, \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":37.713,"exit_code":1,"observations":[{"actual":false,"check":"fixture 1","expected":false,"passed":true},{"actual":true,"check":"fixture 2","expected":true,"passed":true},{"actual":true,"check":"fixture 3","expected":true,"passed":true},{"actual":true,"check":"fixture 4","expected":false,"passed":false},{"actual":true,"check":"fixture 5","expected":true,"passed":true},{"actual":false,"check":"fixture 6","expected":false,"passed":true},{"actual":true,"check":"fixture 7","expected":true,"passed":true},{"actual":false,"check":"fixture 8","expected":false,"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": true, \"expected\": false, \"passed\": false}, {\"check\": \"fixture 5\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 7\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 8\", \"actual\": false, \"expected\": false, \"passed\": true}], \"passed\": false}\n"},"fixed":{"elapsed_ms":39.145,"exit_code":0,"observations":[{"actual":false,"check":"fixture 1","expected":false,"passed":true},{"actual":true,"check":"fixture 2","expected":true,"passed":true},{"actual":true,"check":"fixture 3","expected":true,"passed":true},{"actual":false,"check":"fixture 4","expected":false,"passed":true},{"actual":true,"check":"fixture 5","expected":true,"passed":true},{"actual":false,"check":"fixture 6","expected":false,"passed":true},{"actual":true,"check":"fixture 7","expected":true,"passed":true},{"actual":false,"check":"fixture 8","expected":false,"passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 5\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 7\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 8\", \"actual\": false, \"expected\": false, \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}