Designing policy engines that fail closed

Notes from building authorization checks for cloud workloads, and why the boring default is the right one.