Measured Behaviour
Published
An allowlist has a fail-closed reputation, earned against an unknown entry rather than an unread option. In a rights system the missing value is not the empty set - a licence with no territory list is a worldwide licence. We measured both halves of a licence term and both halves of its territory grant, and all four failed open.
A term, a territory grant and forty-eight usages
We built a synchronisation licence the way one is really shaped: a term running from day 120 to day 300 with a thirty-day holdback at the front, four granted territories with Germany carved back out, two granted media out of four, an exclusive grant, and a cue sheet of forty-eight usages spread deliberately across and outside the term.
The correct run clears five usages and refuses forty-three: nine before the window opens, thirteen after it closes, nine in territories that were never granted, four in the carve-out, six in media the licence does not carry and two under a second licensee's reference. Fees billed: 29,050.00. The licensor's rule passes.
Protected with default settings on all five profiles the output was byte-identical. The failures below required member renaming to reach names on the licence object or on the usage records.
A window is two names, and each one removes a different wall
The library defaults windowStartDay to zero and windowEndDay to no end at all. Both are the only defensible defaults: a library shown a licence with no dates cannot invent them, and refusing exploitation the licensor may well have granted is worse than permitting it.
Renaming windowStartDay takes the nine before-window refusals to zero. The licence now covers exploitation that predates it, including the holdback period the licensor reserved for its own release. Cleared usages go from five to seven and fees from 29,050.00 to 38,600.00.
Renaming windowEndDay takes the thirteen after-window refusals to zero. The licence now never expires. Cleared usages go to six and fees to 37,850.00.
Rename both and there is not a single date-based refusal left in the report: eight cleared, 47,400.00 billed, and a clearance run that reads as entirely successful over a licence with no term at all. The two halves fail in opposite temporal directions and neither produces anything to investigate, because a cleared usage is not an error.
The allowlist that fails open
territoriesGranted is an allowlist of four territories. Rules of thumb about allowlists say they fail closed - an entry that is not on the list is refused. That reputation is earned against an UNKNOWN ENTRY, not against an unread option, and it depends entirely on what the library substitutes when it cannot read the list.
In a rights system that substitute is the world. A licence with no territory list is a worldwide licence, universally, because that is what silence means in a grant. Renaming the option took the nine territory-not-granted refusals to zero, cleared usages from five to eight and fees from 29,050.00 to 47,400.00 - and the configuration line printed territorys=world in plain sight.
The carve-out fails open too. excludedTerritories is a denylist and its default is the empty set, so renaming it takes the four carved-out refusals to zero and bills 42,050.00. Rename both lists and ten usages clear for 60,400.00 with no territory reason left in the report at all.
So both a permissions list and a prohibitions list failed in the same direction here. What decides the direction is not whether the list enumerates permissions or prohibitions; it is what the library substitutes when the option is unreadable. Get that answer from the library's documentation, not from a rule of thumb.
The single largest move was the media grant
mediaGranted lists two media out of the four that appear on the cue sheet, and its default is null - all media. Renaming it cleared eleven usages instead of five and billed 86,450.00 instead of 29,050.00, very nearly triple.
That is the licensor's exposure rather than the licensee's: every one of those usages is exploitation in a medium the licence never granted, cleared by the licensor's own clearance system, with a fee note issued for it. A fee note is the document that makes it look authorised.
Where the record fields land
Renaming usageDay, territory or medium on the usage records fails closed and completely: nothing clears, fees are 0.00, and every one of the forty-eight usages is refused. Losing the value is loud.
licenseeRef is the exception and it pairs exactly with an option. Renaming the field, or renaming the exclusivity option, both clear seven usages and bill 48,950.00 - the two usages carrying a second licensee's reference are cleared under an exclusive grant. Same answer from either side of the boundary.
holdbackDays was inert in this run. Every usage the holdback would have released is refused for a territory or media reason anyway, so the arm is an honest negative about this cue sheet rather than evidence about the name. It becomes observable on the first usage that has nothing else wrong with it.
What we are not claiming
Protection with default settings did not change a single clearance decision on any of the five profiles. Everything above required member renaming pointed at names that cross into the unprotected clearance library, or at the usage records themselves.
The mitigation is scoping plus one assertion. Keep MemberRegexp off third-party options literals - the mechanics are in Protect Members - and have the clearance engine report the term and territory list it actually read, then assert them against the licence record before the first usage is cleared. A run that reports a worldwide grant on a four-territory licence has told you everything, provided somebody compares the two.
If you are shipping a rights-gated player or paywall, Protect Paywalled and Subscription Content JavaScript covers the surrounding configuration.
Frequently asked questions
Does obfuscation break rights clearance?
Not on its own. Protected with default settings on five profiles - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - the clearance run was byte-identical. The failures required member renaming to reach names on the licence object.
What happens when a licence window loses one of its bounds?
It loses that wall. Renaming the start day took nine before-window refusals to zero and cleared exploitation predating the licence; renaming the end day took thirteen after-window refusals to zero and made the licence never expire. Fees billed rose from 29,050.00 to 38,600.00 and 37,850.00 respectively.
Doesn't an allowlist fail closed?
Only against an unknown entry. Against an unread option it fails whichever way the library's default points, and in a rights system a missing territory list means worldwide rather than nowhere. Renaming the granted-territory list cleared eight usages instead of five and billed 47,400.00.
Which option moved the most money?
The media grant. Its default is all media, so renaming it cleared eleven usages instead of five and billed 86,450.00 against a correct 29,050.00 - nearly triple, all of it exploitation in media the licence never carried.
Do the usage records fail the same way?
No, and the contrast is useful. Renaming the usage day, territory or medium refuses all forty-eight usages and bills nothing - loud and immediate. Only the licensee reference behaves like an option, and it produces the same result as renaming the exclusivity setting.
Would a clearance report show anything unusual?
The configuration line reads territorys=world instead of a count of four, and the refusal breakdown loses a whole category. Both are visible and neither is an error, which is why a report that clears more than it should reads as a good day.
What is the mitigation?
Scope MemberRegexp away from third-party options literals, and have the engine report the term and territory list it actually read so you can assert them against the licence record before clearing anything. See Protect Members.
Related reading