FA-9801 / Configuration / Open access

Access policy decision combination: No-match decisions ignore the supplied default · case 01

No-match decisions ignore the supplied default.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The implementation substitutes return False for return default, so no-match decisions ignore the supplied default.

VERIFIED REPAIR

Use the configured default when no applicable effect decides.

Unsuccessful approach: The attempted repair substitutes return True. Fixture 1 still yields True instead of False.

Case contract

Return deny if any applicable explicit deny, allow if at least one applicable allow, otherwise the provided default. Ignore disabled and nonmatching rules. Unknown effects do not grant access.

Why this case matters

An offline model of access policy decision combination, suitable for testing build and release tooling without external services.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return False
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`False`	`True`	Failed
fixture 3	`True`	`True`	Passed
fixture 4	`False`	`False`	Passed
fixture 5	`False`	`True`	Failed
fixture 6	`False`	`False`	Passed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / ebcebd6bb276f6cb893226b112ca86453147cacd5e04f99cc10e6aebab14674a

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return True
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`True`	`False`	Failed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`False`	`False`	Passed
fixture 5	`True`	`True`	Passed
fixture 6	`True`	`False`	Failed
fixture 7	`True`	`True`	Passed
fixture 8	`True`	`False`	Failed

SHA-256 / 0758e9d1cf44ca0bbb03e53db5de17ee4590b35ee2404ef86cfbd75aa328b51c

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(rules, resource, default):
    effects = [effect for pattern, effect, enabled in rules if enabled and pattern in [resource, '*']]
    if 'deny' in effects: return False
    if 'allow' in effects: return True
    return default
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve([], 'a', False), False)
check('fixture 2', solve([], 'a', True), True)
check('fixture 3', solve([('a', 'allow', True)], 'a', False), True)
check('fixture 4', solve([('a', 'deny', True), ('a', 'allow', True)], 'a', True), False)
check('fixture 5', solve([('a', 'deny', False)], 'a', True), True)
check('fixture 6', solve([('b', 'allow', True)], 'a', False), False)
check('fixture 7', solve([('*', 'allow', True)], 'a', False), True)
check('fixture 8', solve([('a', 'unknown', True)], 'a', False), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 1	`False`	`False`	Passed
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`True`	Passed
fixture 4	`False`	`False`	Passed
fixture 5	`True`	`True`	Passed
fixture 6	`False`	`False`	Passed
fixture 7	`True`	`True`	Passed
fixture 8	`False`	`False`	Passed

SHA-256 / 0f3886ac8993dc06cf67098e74d07e6725a84047428149241f03533f9290d603

Verification & scope

This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:33.242105+00:00.

Case digest / e7f931ee1b6fafd97757cbc577ec7e6caf6741b95897d451316639c1cdce4544