Which security design principle enforces that access is denied by default unless explicitly permitted?

Fail-safe defaults, also known as "deny by default," is a security principle where access is denied unless explicitly granted. This minimizes the attack surface by preventing unauthorized access to resources. If a system configuration is incomplete or fails, access will be denied, preventing potential security breaches. Least privilege grants users only the minimum necessary permissions to perform their tasks, but doesn't specifically address the default access state. Economy of mechanism advocates for simple, small, and understandable designs, which can aid security but isn't the core principle of default denial. Complete mediation requires that all access attempts to resources are checked for authorization, which is a related concept but doesn't define the default access posture.