Skip to content
deedglassdocs

default_allow

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: warning

defaults.decision is allow, so every action no rule matches runs, including tools added after you wrote the policy. The policy is accepted, but enforcing it needs an explicit acknowledgement.

deedglass: policy/v1
name: refunds
defaults:
  decision: allow
rules:
  - id: block-refunds
    match: { tool: stripe.create_refund }
    decision: deny
    reason: Refunds are never made by agents.
○ policy.yaml:4:13 · default_allow
  defaults.decision: allow lets every unmatched action run.
  hint: Deedglass recommends deny. Enforcing this policy will need an explicit acknowledgement.

Fix: deny by default, and allow what you need with rules.

defaults:
  decision: deny
  reason: No rule allows this action. Add a rule in Console › Policies to allow it.
Section titled “Related”