Fail secure

When a control fails, it either keeps letting people through or keeps everybody out. Both are defensible; having no answer is not.

A door that unlocks when the power goes is right for a fire exit and wrong for a vault. The same choice exists for firewalls, authentication and policy engines, and it is usually made by accident, by whoever wrote the default. Knowing which way yours fails is worth establishing before the day it fails.