A small authorisation is taken the first time that a debit card is used for TfL PAYG.
10p, to be precise, on first use and also if the card hasn't been seen in a while.
I can't recall whether it's taken before the card is accepted and the barriers are opened,
It's not, that would take 10-30 seconds rather than the maximum of half a second for the gates to open

The 10p authorisation will be made usually within 5-30 minutes of the touch in.
but if not, then by the end of the journey the card would be blocked if that authorisation failed,
Yes, but...
so you wouldn't be able to touch out.
not quite. The system will allow you to touch out even if the authorisation has failed, so that the actual journey made is known, but that card will thereafter no longer be accepted until the cardholder has resolved the unpaid journey, such as via the TfL call centre.
Of course, if one had enough balance on the debit card for the authorisation but then not enough for the journey - or you 'froze' the card to prevent further charges after the authorisation
I
think the transaction would still go through in the latter case as a preauthorisation has been established, but I would have to test it.
- then it would be possible to make the journey for 'free' this one time. But the card would be blocked from further use until the debt was paid off.
To be exact, if the 10p authorisation goes through, that card will be able to be used on the network for the rest of that service day, not just for the one journey. When the final total is billed to the card overnight, if that declines for whatever reason, the card will then be blocked until the debt is resolved.