Description:

Our use case is to use the SecurityPolicy to define OIDC auth for public routes and we are attaching a SecurityPolicy to any type of Route (HTTPRoute, GRPCRoute)

• If the SecurityPolicy fails for any reason the default behaviour is for the route to have no SecurityPolicy and be public - for us this feels like a security risk.
• Is there a way for use to ensure that if a SecurityPolicy fails the HTTPRoute fails?