On a deny decision, the code block never reaches the downstream system. Kastra returns a structured denial with the policy id, the rule that fired, and the reason. The attempt is recorded in the evidence vault with the full request context and cryptographic proof of the decision.