Documentation / Platform glossary / Deny-by-Default
Deny-by-default means access is refused unless something explicitly permits it. The alternative — allow unless a rule forbids it — requires anticipating every way access could be misused, which is not achievable. Denial as the baseline makes omissions safe instead of dangerous.
The principle concerns what happens in the absence of a matching rule. Under deny-by-default the answer is no; under allow-by-default the answer is yes. That difference determines how the system behaves when someone forgets something.
Consider a new resource type added to a product. Under deny-by-default, nobody can reach it until a permission is granted — the failure is a support request. Under allow-by-default, everybody can reach it until someone writes a rule — the failure is an exposure nobody noticed. Both are omissions; only one is recoverable.
The same reasoning applies across layers. Network policy that permits only known traffic; API authorization that rejects requests without an explicit grant; database access scoped to the tenant unless broadened deliberately. In each case the default is the control, and the explicit rules are the exceptions.
Deny-by-default is closely related to least privilege but distinct from it. Least privilege concerns how much a granted permission covers; deny-by-default concerns whether anything is granted at all when no rule applies.
Most access-control incidents are omissions rather than mistakes: a permission never restricted, a resource added without a rule, an endpoint deployed before its authorization check. Deny-by-default converts that class of error from a silent exposure into a visible failure.
It has a real cost. Legitimate access breaks until granted, which produces friction during onboarding and rollout. That friction is the mechanism working, and it is why exceptions should be documented rather than resolved by loosening the default.
QueryTek treats denial as the baseline for access decisions, and combines it with tenant scoping so that a grant cannot extend beyond the customer environment it was issued in. Exceptions are recorded as decisions. Specific policy detail is not published.
