HIGHCWE-391
PEI-008 Undefined Policy Action Exploitation
Policy Enforcement Integrity: Attacks that bypass policy enforcement via threshold fallbacks, config file injection, or parser error paths that fail open
Description
Tests if an unrecognized action type in policy rules results in implicit allow instead of deny
Remediation
Policy engines must use explicit allowlisting, not denylisting. Any action type not explicitly recognized must be treated as DENY. Unhandled enum values must terminate in DENY.