In the security document for Flow it says:
You might imagine that a voter has to return an abstain vote, if it is not able to give a proper grant or deny vote.
But why is a voter not able to give a proper grand/deny?? Would be nice to know exactly why a voter has to abstain.
Because for the active roles neither grant or deny are configured for the privilege. In that case the voter abstains.
So all roles must say something about all privilage targets?
Yes, unless you want them to abstain. It's part of the concept. Abstain is a "soft" deny. If you really DENY it is denied for all times if you have that role. Abstain can be overruled by GRANT from another role