Your Rego deny rule stopped firing after you moved its check into a helper — why?

## The refactor that quietly disarms a rule You had one long `deny` rule. You factored the field lookup into a helper so three rules could share it. Every test still passes, and a week later an image with no base-image label goes straight through. ``` base_of(img) := name if { name := img.config.Labels["org.opencontainers.image.base.name"] } deny contains msg if { base := base_of(input.image) not base in approved_bases msg := sprintf("base image %q is not approved", [base]) } ``` When the label is absent, the lookup inside `base_of` does not hold, so the function is **undefined** for that argument. It did not return `false`, `null`, or an empty string — it produced no result at all. ### How undefined travels through a call A rule body is a conjunction: every expression in it must hold for the body to hold. An undefined expression does not hold, so: 1. `base := base_of(input.image)` is undefined, 2. therefore the `deny` body is undefined, 3. therefore that definition contributes nothing to the `deny` set, 4. therefore `deny` is empty, 5. therefore the gate, which blocks only when `deny` is non-empty, allows the image. The failure mode is the dangerous direction: **the check disappears rather than firing**. And the inputs that trigger it are exactly the suspicious ones — images built outside the blessed pipeline are the ones with no base-image metadata to read. ### The mirror-image trap The same propagation bites the other way when the call is negated: ``` deny contains msg if { not is_approved_base(input.image) msg := "image is not built from an approved base" } ``` Here `not <undefined>` **succeeds**, so a missing label makes the rule fire. That is the fail-closed direction, which is usually what you want for a security control — but it is the same underlying mechanic, and if the reason for the undefined-ness is a typo in the label key rather than a genuinely missing label, you are now blocking every image in the estate for a reason your message does not explain. Whichever polarity you choose, you should choose it deliberately and know which one you wrote. ### Making a helper total Three tools, and they compose: - **`object.get` with a fallback.** `name := object.get(img, ["config", "Labels", "org.opencontainers.image.base.name"], "")` gives you a value for every input; the empty string then fails the membership test and the deny fires with a message you can read. - **A default definition for the function.** `default base_of(_) := ""` supplies a value whenever no other definition holds. Its arguments must all be wildcards, which is the limitation to remember. - **An explicit deny for missing metadata.** Separate "the base is not approved" from "the image records no base at all" and emit a distinct message for each. The second is the one the platform team needs, because it points at the build, not at the image contents. ### Why the tests were green Because fixtures are written from the happy path. Every sample image in the test data carried the label, so no test ever exercised the branch where the helper is undefined. The habit worth showing in an interview: for every optional field a policy reads, add a fixture where that field is **absent** and assert the decision you actually want. That single test is what distinguishes a policy someone wrote from a policy someone trusts. ### Diagnosing it in the moment When a rule mysteriously does not fire, evaluate the helper on its own with the offending input. A result of "undefined" — as opposed to `false` or an empty set — is the diagnosis, and it points at the exact expression inside the helper that failed to hold. This is far quicker than staring at the deny rule, because the deny rule is not where the problem is. ### The judgment behind the fix The deeper point is about defaults in a control. A gate that cannot evaluate its input has two honest options: block, or record that it could not decide. It has one dishonest option, which is to look identical to a clean pass. A helper that is undefined for missing data silently picks the dishonest one. Making helpers total, and giving "unknown" its own violation message, is how you keep the decision truthful — and it is what lets you tell an auditor what a green result on that gate actually means.