FA-9791 / Configuration / Open access

Access policy decision combination: An explicit deny is overridden by allows · case 01

An explicit deny is overridden by allows.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The implementation substitutes if 'deny' in effects: return True for if 'deny' in effects: return False, so an explicit deny is overridden by allows.

VERIFIED REPAIR

Explicit deny dominates applicable allows.

Unsuccessful approach: The attempted repair substitutes if 'deny' in effects and 'allow' not in effects: return False. Fixture 4 still yields True instead of False.

Case contract

Return deny if any applicable explicit deny, allow if at least one applicable allow, otherwise the provided default. Ignore disabled and nonmatching rules. Unknown effects do not grant access.

Why this case matters

An offline model of access policy decision combination, suitable for testing build and release tooling without external services.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects: return True
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`True`	`False`	Failed
fixture 5	`True`	`True`	Passed
fixture 6	`False`	`False`	Passed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / 10393481b0b7c2b37425338d2276a29829ebbf07d244d4015cf96c2dc16bdb62

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects and 'allow' not in effects: return False
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`True`	`False`	Failed
fixture 5	`True`	`True`	Passed
fixture 6	`False`	`False`	Passed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / ff3edb48b0bdc7771d5363d0a79bb1cd5adef687dc0e7430a8ecb072a5a8d9fa

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`False`	`False`	Passed
fixture 5	`True`	`True`	Passed
fixture 6	`False`	`False`	Passed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / 0f3886ac8993dc06cf67098e74d07e6725a84047428149241f03533f9290d603

Verification & scope

This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:33.040560+00:00.

Case digest / e239bc16b2f5ee6f6bd6a90df419bbcdad013f4e1b0eaaf6cb0e9f3d5ceaf671