Default-deny is a security model in which every action, connection, or permission is blocked unless it is explicitly allowed. Instead of starting with broad access and removing risky parts later, the system begins closed and opens only the minimum required paths. This makes it a strong fit for high-risk environments because unknown or unexpected behavior is not trusted by default.
In cyber security, default-deny reduces attack surface and limits damage from misconfiguration, malware, and compromised accounts. It appears in firewalls, identity and access policies, cloud controls, and sandboxed runtimes. In agentic AI systems, a default-deny stance can stop an agent from using tools, reaching data, or triggering workflows unless policy rules approve the action. That matters because prompt injection or a stolen credential should not automatically grant broad access. Default-deny works best with least privilege, logging, and reviewable exceptions.