## TL;DR
The agent lacked the Graph permission to read the policy, got an error, and treated it as a pass. Fail closed on check errors, preflight the required permissions, and alert loudly on any check failure.

## The query
```text
agent's conditional-access check failed open: missing graph api permission
```

## Use this when
- access checks pass with no data
- Graph permission errors in the log
- the check never denies anyone

## Not for
- conditional access policy misconfiguration
- user-facing access denials
- MFA policy design

## Steps
1. Find the Graph permission error the check swallowed. Expected output: the missing permission is named.
2. Grant the least-privilege permission the check actually needs. Expected output: the check can read the policy.
3. Change the check to fail closed: any error denies or escalates, never passes. Expected output: errors become visible denials.
4. Add a preflight that verifies permissions before the run starts. Expected output: missing permissions block the run early.
5. Alert on every check failure so silent passes are impossible. Expected output: failures page someone.

## Applies to
Microsoft Graph API, Entra ID conditional access, access-check agents.

## Variant phrasings
### Check passes for some users only
Partial permissions or scoped consent; verify the grant covers all targets.

### Permission granted but still fails
Admin consent may be missing; consent explicitly in Entra ID.

## Why it happens
Fail-open is the most dangerous default in an access check. A permission error looks like 'no policy applies' unless the code distinguishes error from empty.

## Edge cases
- Security checks must fail closed; convenience checks may fail open, but label them.
- Test the check with permissions revoked to see the failure path.
- Review Graph permission grants quarterly; they drift.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IrbjHcHKSmDOWU5iiqoOIg