HTTP Cache-Control: What is acceptable default behavior when it's not present?

I'm running into some HTTP caching issues, caused by some downstream apps not putting Cache-Control headers on time-sensitive data. I need to make the case that this is a broken situation.

Is there any succinct statement available online about permissible or common response-handling behaviors by caches and agents when the Cache-Control header is not present for HTTP 1.1? I see RFC2616, but it doesn't seem to include any normative or SHOULD statements about responses without a Cache-Control header.

From stackoverflow

• I think when this directive is missing it is up to the browser to determine what it wants to do. (In this case your server may be the browser)

  This is a pretty good write up of the way various browsers handled the issue:

  http://www.f5.com/pdf/white-papers/browser-behavior-wp.pdf

  Hope that helps.

  Steven Huwig : Well, it's true that my server is the browser, but there are also intermediate caches (firewalls, load balancers, or something) which are apparently caching some results.