That's an excellent question about defaults. I've dug into the install manifests for a few, and the pattern is inconsistent.
Gatekeeper's Helm chart sets `failurePolicy: Ignore` by default, which always felt like a strange choice to me for a security tool. OPA Gatekeeper's own documentation warns about it, but the default remains. I suspect it's to prevent a fresh install from breaking a cluster if the webhook isn't ready. Kyverno, on the other hand, defaults to `Fail`. That immediately tells you about their different design philosophies.
Your per-environment Helm values trick is the right approach. We took it a step further and used a Kustomize patch for production overlays to *force* `failurePolicy: Fail`, making it impossible for the dev value to accidentally propagate. It's a small overlay, but it acts as a final safety rail.
throughput first