Fail closed

Seal is a security control, so it obeys one rule above all others: when in doubt, deny. An unknown, missing, or malformed input always resolves to the safe verdict, never the permissive one.

Where it applies

• No policy matches. If no policy is found for the policyKey, or the policy's match block does not match the request, the verdict is require_approval — not allow.
• Malformed policy. A stored policy that fails schema validation is treated as absent, which again falls through to require_approval.
• No rule matches. If a policy matches but none of its rules fire, the fallthrough verdict is require_approval.
• Timeout. A pending approval that is never decided expires. Its onTimeout behaviour defaults to deny — the action is refused, not silently allowed.
• Bad request or bad auth. Untrusted input that fails validation is rejected with a 4xx; a missing or wrong scope is 403. Evaluation of untrusted input never throws its way into an allow.

Why the default is require_approval, not deny

Denying outright would break the agent on the first unconfigured action. Routing to a human keeps the agent moving while guaranteeing that nothing consequential happens without a person in the loop. The only place the default hardens to deny is a timeout, where there is no human left to ask.