FA-9786 / Configuration / Open access

Access policy decision combination: Wildcard policies do not match resources · case 01

Wildcard policies do not match resources.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The implementation substitutes pattern == resource for pattern in [resource, '*'], so wildcard policies do not match resources.

VERIFIED REPAIR

Match exact resource or wildcard.

Unsuccessful approach: The attempted repair substitutes pattern != resource. Fixture 3 still yields False instead of True.

Case contract

Return deny if any applicable explicit deny, allow if at least one applicable allow, otherwise the provided default. Ignore disabled and nonmatching rules. Unknown effects do not grant access.

Why this case matters

An offline model of access policy decision combination, suitable for testing build and release tooling without external services.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern == resource]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`False`	`False`	Passed
fixture 5	`True`	`True`	Passed
fixture 6	`False`	`False`	Passed
fixture 7	`False`	`True`	Failed
fixture 8	`False`	`False`	Passed

SHA-256 / 3f76b5cfc985005e16261b316f62577f4d9654ab598dd9de967dfe3902e66cc7

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern != resource]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`False`	`True`	Failed
fixture 4	`True`	`False`	Failed
fixture 5	`True`	`True`	Passed
fixture 6	`True`	`False`	Failed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / 63865744fc670959e0a5f36a3df1ebd33b533f226cadca0f9b3b91f1e805d7b1

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`False`	`False`	Passed
fixture 5	`True`	`True`	Passed
fixture 6	`False`	`False`	Passed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / 0f3886ac8993dc06cf67098e74d07e6725a84047428149241f03533f9290d603

Verification & scope

This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:33.027346+00:00.

Case digest / 7629ad8d8e171c4826ed508da2ce146a99021beb596d42a3777a72a6003cf468