Fail closed when authorization is unavailable

When your policy engine, PDP, or permissions service times out, what does the API do?

Returning 200 “just this once” so the page keeps working is fail-open. An attacker who can jam or delay that dependency suddenly gets a free allow path.

Prefer fail-closed for mutating and sensitive reads:

• If you cannot decide, deny (or return 503 for the protected route).
• Log the dependency failure separately from a normal deny.
• Keep a tiny, carefully reviewed break-glass path if humans must recover the system — do not silently widen every request.

Availability matters. So does not turning every outage into an accidental grant.