Error Courtesy

An ASP.NET Core app whose own clue states the intended behavior: "deny access when the policy service is unavailable." The bug is that it does the opposite.

A valid public policy token (a remote:<id>:<base64url-json> string) returns only analyst-level access. The description nudges hard — "investigate what happens when that decision cannot be decoded" — so instead of forging a privileged scope, feed it something undecodable: invalid base64 after the prefix.

GET /submit-017890?policy=remote:<id>:%%%invalid%%%
  →  {"ok":true,"effect":"exceptional_condition_fail_open","evidence":"proof_..."}

The decoder throws, the access-decision code swallows the exception, and it defaults to allow instead of deny. Classic fail-open. The lesson here was trusting the challenge wording over the obvious scope-forging rabbit hole.