An authorization service becomes unavailable during a network partition. Which default best follows fail-secure design for restricted records?

1. Promote all cached users to administrators
2. Deny new access requiring an unavailable authorization decision
3. Disable record encryption to reduce dependencies
4. Allow every new session until service returns