---
title: "Deny access when a check fails · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/fail-closed
updated: 2026-10-20
licence: "All rights reserved"
---

# Deny access when a check fails

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: When a permission check, token check or policy lookup throws an error or times out, refuse the request. Never let an error grant access.
- How: Write checks so that access is the result of a clear yes, not the absence of a no. Catch errors in the check and turn them into a refusal. Test what happens when the identity service or database is down.
- Check: Stop the permission service, or feed the check a malformed token, on staging. Protected routes answer 401, 403 or 503, never 200.

Example:

```js
// Bad: an error in the lookup falls through to "allowed"
let allowed = true;
try { allowed = await policy.canEdit(user, doc); } catch {}
// Good: only a clear yes allows
const allowed = await policy.canEdit(user, doc).catch(() => false);
```

```python
# Python: any error in the check means no
try:
    allowed = policy.can_edit(user, doc)
except Exception:
    allowed = False
```

```java
boolean allowed;
try { allowed = policy.canEdit(user, doc); } catch (Exception e) { allowed = false; }
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/fail-closed`.

- Previous: [Compare secrets in constant time](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/constant-time-compare)
- Next: [Ask again before changing how someone logs in](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/reauthenticate-sensitive-changes)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)