Fail Closed at Authorization Boundaries
An application can have carefully designed roles and permissions and still expose protected actions through one small mistake: treating an authorization error as permission to continue. This problem appears when access control depends on code, policy data, or another service that can fail. A timeout, malformed response, missing record, or unexpected exception creates uncertainty. If the application converts that uncertainty into allow, a reliability failure becomes an access-control failure. A useful defensive rule is to fail closed at an authorization boundary. In plain language, perform the protected action only when the system has enough trustworthy information to make an explicit allow decision. If it cannot establish that decision, do not grant the access.