diff --git a/scripts/public-repo-guard/body-policy.sh b/scripts/public-repo-guard/body-policy.sh
index f8afe10..b7e9f37 100755
--- a/scripts/public-repo-guard/body-policy.sh
+++ b/scripts/public-repo-guard/body-policy.sh
@@ -60,12 +60,22 @@ check() {
   # Filter with rg, not grep: BSD/macOS grep has no -P, so a `grep -P` allowlist
   # silently errors out locally while working on GNU/CI — the gate would then
   # disagree with itself depending on where it ran. rg is already required above.
-  local matches
+  local matches filter_rc
   matches="$(printf '%s' "$raw" \
-    | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' || true)"
+    | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]')"
+  filter_rc=$?
+  if (( filter_rc >= 2 )); then
+    echo "::error title=public-repo-guard ($name)::ripgrep failed (exit $filter_rc) filtering allowlisted lines for rule '$name' — failing closed."
+    exit 2
+  fi
   if [[ "$exempt" == "about-exempt" ]]; then
     matches="$(printf '%s' "$matches" \
-      | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
+      | rg -vNiP -- "$ABOUT_THE_CONTROL")"
+    filter_rc=$?
+    if (( filter_rc >= 2 )); then
+      echo "::error title=public-repo-guard ($name)::ripgrep failed (exit $filter_rc) filtering control references for rule '$name' — failing closed."
+      exit 2
+    fi
   fi
   [[ -z "$matches" ]] && return 0
   local count; count="$(printf '%s\n' "$matches" | grep -c '')"