Keeping authorization enforced when dependencies fail

Goal

Test the security decision made when a required dependency is unavailable. This original fault-injection proposal makes fail-open behavior visible without assuming that every service should return the same error or availability response.

Prerequisites

Use a disposable application with a replaceable permission dependency and synthetic protected records. Write the expected behavior for dependency timeout, malformed response, and explicit denial before introducing faults.

Steps

1. Run a permitted request and an explicitly denied request with the dependency healthy. Confirm that the fixture exercises the actual policy boundary and that protected data is observable only in the allowed case.

2. Inject one controlled failure at the permission dependency. Record the application decision, returned content, and stored side effects; a successful-looking response may still require inspection of its actual meaning.

3. Repeat with the denied principal rather than only the allowed principal. This distinguishes a general outage response from fallback behavior that accidentally grants authority during the outage.

4. Restore the dependency and repeat the healthy controls. Verify that failure handling has not left a cached grant, stuck bypass flag, or other state that changes subsequent decisions.

5. Repair the affected failure branch and preserve its explicit expected result. Keep error availability requirements separate from the invariant that protected actions require valid authority.

Expected result

The regression should identify the exact fault and principal combination that changes the decision, while proving that normal allowed and denied behavior remains functional afterward.

Limits and test basis

Fault injection belongs in an authorized isolated environment. The method does not prescribe a universal response status or evaluate every dependency; it covers the documented decision boundary and injected failures only. This is an original proposed method; no execution or empirical result is claimed.