Fail-closed filtering

When OpenD is unsure whether a reader may see something, it hides it. A mistake in a condition can hide content, but never leak it.

For readers, each of these excludes the content it is on:

a product or feature value the reader's organization does not hold;
a value that is not declared in opend.config.yaml, such as a typo like product="embd", because no reader can hold it;
a release token that does not parse, such as release="next";
any release condition, when the reader's own version does not parse.

Because a typo silently hides content, validation reports undeclared values (undeclared-value) and bad ranges (invalid-release) as errors, and the hosted build refuses to publish them. You find out in the previewer or in CI, before readers do.

Lookups fall back, they don't reveal

The same rule holds wherever content is looked up rather than browsed:

A link to a topic the reader cannot see renders as its authored text, without the target's title.
A context-sensitive help key whose topic is hidden falls back to a parent key or the app's default, never to the hidden topic.
An image is served only when a topic visible to that reader references it.
A PDF publication with nothing visible returns the same 404 as one that does not exist.

A page the reader cannot see returns the same 404 as a page that does not exist, so guessing URLs reveals nothing.

Build attributes are different

audience, platform, otherprops, props and deliveryTarget follow DITAVAL rules at build time instead: a value with no rule is included. Declare them anyway; validation still reports undeclared ones.