Glossary / Default Deny
Default Deny
A security posture where anything not explicitly permitted is refused — the opposite of allowing everything except a list of known-bad things.
Default deny (also called an allow-list or whitelist model) means the system enumerates what is permitted and rejects everything else. Default allow — the deny-list model — enumerates what is forbidden and permits the rest, which means every threat nobody thought of in advance is permitted by construction.
The distinction matters most where the set of possible inputs is effectively unbounded. A remote-management platform that accepts an arbitrary script body is default-allow no matter how much filtering sits in front of it; one that accepts only a fixed set of registered capabilities, each with a validated argument schema, is default-deny and stays that way as the threat landscape changes.
The cost of default deny is friction: adding a legitimate new action becomes a deliberate change rather than a configuration tweak. That friction is the control. If a new capability can be added at runtime, through configuration, or by an operator in a hurry, the allow-list has stopped being one.
How Nexus handles this
The Nexus capability registry is a closed allow-list with no wildcard and no server-supplied executable body — adding a capability is a code and governance change, and each one carries its own recorded approval before it can be issued.
More terms
MSP (Managed Service Provider)
A company that remotely manages a client's IT infrastructure and end-user systems on an ongoing, proactive basis — usually a flat-fee contract, not break-fix billing.
RMM (Remote Monitoring and Management)
Software that lets an MSP monitor device health and perform remote management tasks — patching, scripting, remote control — across every client site from one console.
PSA (Professional Services Automation)
Software that runs the business side of MSP operations — ticketing, SLAs, billing, contracts, and client records — the system of record most MSP work flows through.
Ready to see it in the platform?
Join the design-partner cohort and we'll show you exactly where this lives.