onPolicyFailure

How a policy-resolver failure (a policy-store outage or misconfiguration) is handled. Defaults to ResolverErrorMode.MASK_ALL — mask the whole resource fail-closed ({}, still 200). ResolverErrorMode.FAIL_REQUEST instead lets the error surface as a 500, so an outage is not silent (only the resolver-error path; a missing principal still masks). See ADR 0011.