Everything consequential is denied by default. So a boundary isn't a rule that forbids an action — it's a grant that permits one, under conditions. The action you never thought to write down stays closed. Omission is safe by construction.
Build Intuitively · Design Absolutely
Author your prohibitions. Enumerate the disasters.
The one you forgot is wide open.
default: ALLOW · omission → EXPOSED
Author your permissions. Name what's allowed.
The one you forgot is denied.
default: REFUSE · omission → SAFE
The dangerous direction — forgetting — is the safe one, by construction.
Put any action to /admit with no matching grant on file and it is refused, fail-closed — "not a live boundary." You never write "don't delete prod table." You write when deleting one is allowed — and if you write nothing, it stays denied. Prohibitions aren't authored. They're the default, and defaults are free.
# you author this — a grant, under conditions "A DBA may delete a table with a change_ticket during maintenance_window" → signed by the steward → live # you never author this — it is simply the default delete prod table, no grant on file → DENIED (fail-closed)
This is why the compiler never needed a word for "may not." There is nothing to express: prohibition is the ground state, permission is the only thing you say.
Once an action reaches /admit: fail-closed. No grant → refused. The action arriving without a permission on file is denied, full stop. That's the given.
You protect everything by granting nothing — and then granting only what you mean.The honest caveat: an action only gets adjudicated if it reaches the wedge. That's the adapter's job — intercept and propose. The MCP universal plug is how you route an agent's whole consequential surface through it.
What you route, you protect by default. Route more, default-protect more.A customer doesn't stare at an empty editor enumerating every catastrophe. They get starter grant templates — refunds, deploys, data-deletes — each a pre-shaped permission with sensible evidence and limits. Their steward adopts and signs the ones they want and tunes the conditions. Still one human authority point (authority_effect = 0 until their steward binds it); still fail-closed on everything they never granted. The job shrinks to writing what you want to allow — the entire universe of what you forbid is one default.
It's the same law as free refusals: the safe outcome costs nothing and is the default, while the consequential one — a grant, an admission, an enforce — is what a human has to author and sign. A governance layer that made you enumerate your dangers would fail the day you forgot one. This one fails the day you forgot one too — closed. That is what it means to design absolutely.