Configurable fail-closed ABAC / policy errors

[blinkerbit]

Source: gitlab-issues-export.md (Issue 11)

Weight: 5

Problem / context

BaseHandler.check_access may allow legacy paths when policy evaluation errors (fail-open). High-risk deployments may want deny-by-default.

Suggested approach / acceptance criteria

• Feature flag or config: abac_fail_closed (off by default for compat).
• When on: PDP exceptions lead to deny with 503/403 and audit log.
• Tests for both modes.