A design rule: when a security check can’t reach a clear answer (an unknown setting, a timeout, a malformed reply, a missing capability), refuse the action instead of allowing it.