Glossary
Default Deny
A default-deny system starts from 'nothing is permitted' and requires an explicit rule to allow each thing that should work. A default-allow system starts from the opposite assumption and requires an explicit rule to block what shouldn't. The difference matters most for whatever the rule-writer failed to anticipate: under default deny, an unanticipated request is refused; under default allow, it goes through.
Default deny is more work up front, because every legitimate use case has to be explicitly enumerated before it will function. That upfront cost is what buys the safety property that matters later: a gap in the ruleset shows up as something breaking, which gets noticed and fixed, rather than as something silently permitted, which does not.