xacml-dev message

Subject: Deny-override

From: "Panayiotis Periorellis" <Panayiotis.Periorellis@newcastle.ac.uk>
To: <xacml-dev@lists.oasis-open.org>
Date: Mon, 23 May 2005 16:59:41 +0100

I have been reading through the 2.0 specification and I came across an
issues which is unclear regarding the deny-overrides and
ordered-denyoverrides cobmining algorithms.

The ordered-deny-overrides is speficied as :=20

"The behavior of this algorithm is identical to that of the
Deny-overrides rule-combining algorithm with one exception. 
The order in
which the collection of rules is evaluated SHALL match the order as
listed in the policy."

What is the difference from the standard deny-overrides and what
difference does the ordering make?

Looking forward to your replies.

panos