So I'm working on this patch, and I'm unsure what we should do in case of fallback actions. If the policy layer denies the action, and supplies a fallback, when it comes to Puppet should we consider that enabled or not enabled?