Configurable fail-closed ABAC / policy errors

[blinkerbit]

Source: gitlab-issues-export.md (Issue 11)

Weight: 5

Problem / context

BaseHandler.check_access may allow legacy paths when policy evaluation errors (fail-open). High-risk deployments may want deny-by-default.

Suggested approach / acceptance criteria

• Feature flag or config: abac_fail_closed (off by default for compat).
• When on: PDP exceptions lead to deny with 503/403 and audit log.
• Tests for both modes.

[blinkerbit]

Status update (Jun 2026): ABAC engine shipped in PR #79 (\�bac_engine\ feature flag, policies, tags, PDP). Fail-open on PDP errors still default behavior in \BaseHandler.check_access\ — configurable \�bac_fail_closed\ not yet implemented. This issue remains valid for high-security deployments.