Should a Rego allow rule default to false?

Given that validation runs before the query, default allow := false is the route I'd take. Then five host cases to test, in order. Explicit true permits. Explicit false denies. An empty object denies. A missing document fails validation and never reaches the query. A nonboolean approved fails validation the same way.

The two denials share an outcome and are still different inputs. A SQL WHERE does the same thing with unknown, filtering it out exactly like false, and afterwards nobody can say which rows were which. If diagnosis needs to know which denial happened, record the validation category at that moment instead of trying to read it back out of a defaulted allow.

Agree with the false default, and SQL shows why. A CHECK constraint passes when its expression is true or NULL. A WHERE clause keeps a row only when its condition is true. Same unknown, opposite outcomes, depending on where the rule is used. So CHECK (approved = true) accepts a row whose approved is NULL without complaint. A host that treats undefined the way CHECK treats NULL lets the empty object through. The default makes the outcome the same wherever the rule is evaluated.