{"id":"access-control-defaults-favor-availability-over-security","text":"Access control implementations default toward permissiveness: S3 allows requests when no policy exists (opposite of AWS IAM's default-deny), and Google Drive short-circuits the full permission inheritance walk for owners — both reduce access-denied friction at the cost of security strictness.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[{"type":"SL","antecedents":["s3-policy-default-allow","gdrive-owner-bypasses-permission"],"outlist":[],"label":"Both storage systems optimize for \"access works by default\" rather than \"access requires explicit grant\""}],"dependents":["default-to-permissive-across-security-dimensions"],"metadata":{"last_reviewed":"2026-06-06T06:26:57","review_result":"insufficient"},"created_at":"","updated_at":"","reviewed_at":"","verified_at":"","retracted_at":"","explanation":{"steps":[{"node":"access-control-defaults-favor-availability-over-security","truth_value":"IN","reason":"SL justification valid","antecedents":["s3-policy-default-allow","gdrive-owner-bypasses-permission"],"label":"Both storage systems optimize for \"access works by default\" rather than \"access requires explicit grant\""},{"node":"s3-policy-default-allow","truth_value":"IN","reason":"premise"},{"node":"gdrive-owner-bypasses-permission","truth_value":"IN","reason":"premise"}]}}