Fail closed when authorization is unavailable

When your policy engine, PDP, or permissions service times out, what does the API do? Returning 200 “just this once” so the page keeps working is fail-open. An attacker who can jam or delay that depen