Software Architect's Handbook

Default deny

Authorization within the application should follow a default deny approach whereby permissions must be granted as opposed to being denied. In other words, access should be denied by default unless it has specifically been granted, as opposed to a user being provided all access except for operations that have been specifically denied. This concept is related to, and complementary with, the idea of being secure by default.