Glossary / Default Deny

Default Deny

A security posture where anything not explicitly permitted is refused — the opposite of allowing everything except a list of known-bad things.

Default deny (also called an allow-list or whitelist model) means the system enumerates what is permitted and rejects everything else. Default allow — the deny-list model — enumerates what is forbidden and permits the rest, which means every threat nobody thought of in advance is permitted by construction.

The distinction matters most where the set of possible inputs is effectively unbounded. A remote-management platform that accepts an arbitrary script body is default-allow no matter how much filtering sits in front of it; one that accepts only a fixed set of registered capabilities, each with a validated argument schema, is default-deny and stays that way as the threat landscape changes.

The cost of default deny is friction: adding a legitimate new action becomes a deliberate change rather than a configuration tweak. That friction is the control. If a new capability can be added at runtime, through configuration, or by an operator in a hurry, the allow-list has stopped being one.

How Nexus handles this

The Nexus capability registry is a closed allow-list with no wildcard and no server-supplied executable body — adding a capability is a code and governance change, and each one carries its own recorded approval before it can be issued.

Ready to see it in the platform?

Join the design-partner cohort and we'll show you exactly where this lives.