How do you configure a default deny policy for applications with no policy binding?

[Anaxagoras-bc]

I'm new to authentik, and I would like it so that applications need to explicitly have a policy/group/user assigned, otherwise no one can access it other than a super admin. But i can't seem to figure out how to set this up. I'm actually surprised it's not a default behavior.

[alaincao]

Hi, could you make it work? I have a similar problem here ...
I am trying to - simply, I thought - deny access to "default-authentication-flow" to everyone except users that belong to the "authentik Admins" group, but all I can get is the exact opposite: everyone can use it except "authentik Admins" users ...

as I understand things, the idea is to have a "Deny" stage that has a "group policy", but I think I tried each and every combination of

• Policy engine mode: all | any
• Negate result: checked | unchecked
• Failure result: pass | don't pass

but no luck so far...