The enforcement mechanism should deny all access by default, requiring explicit grants to specific users and roles for access to every page. This is done to prevent from :

The deny-by-default approach prevents Failure to Restrict URL Access by ensuring no page is accessible without explicit authorization. This is a defense-in-depth strategy where developers must explicitly grant access rather than accidentally leave pages unprotected. It prevents attackers from accessing unprotected pages through URL manipulation.