Should a Rego allow rule default to false?

Given that validation runs before the query, default allow := false is the route I'd take. Then five host cases to test, in order. Explicit true permits. Explicit false denies. An empty object denies. A missing document fails validation and never reaches the query. A nonboolean approved fails validation the same way.

The two denials share an outcome and are still different inputs. A SQL WHERE does the same thing with unknown, filtering it out just like false, and afterwards nobody can say which rows were which. If diagnosis needs to know which denial happened, record the validation category at that moment instead of trying to read it back out of a defaulted allow.

Agree with the false default, and SQL shows why. A CHECK constraint passes when its expression is true or NULL. A WHERE clause keeps a row only when its condition is true.

CREATE TABLE req (id int, approved boolean
  CHECK (approved = true));
INSERT INTO req VALUES (1, NULL);   -- accepted
INSERT INTO req VALUES (2, false);  -- CHECK fails
SELECT count(*) FROM req
 WHERE approved = true;             -- 0

The NULL row gets in, and a query filtering on the very same condition then can't see it. One unknown, opposite outcomes, depending on where the rule is used. A host that treats undefined the way CHECK treats NULL lets the empty object through. The default makes the outcome the same wherever the rule is evaluated.