Glossary: Security Monitoring and Automation

deny by default

Also written: default deny

Refusing every action that isn't explicitly allowed. guardrail.py's last `else` refuses unknown actions such as delete_logs, because nobody can predict everything an agent might invent.