Empty Is Not Clean: Five Fail-Open Bugs in an AI Agent

A policy said deny anything under /etc. A Bash call read /etc/shadow and came back {allow, rule: 'trust-bash'}. No human in the loop. The deny rule was still there, still first in the list, still scop