RE: [xacml-users] Combining algorithms and "AND" and "OR"

[<srinivas.sridhara@nokia.com>]

Does "deny-override" mean that the result of combining a set of policies is "deny" no matter what the other policies evaluate to (i.e. Permit, Indeterminate or NotApplicable) as long as one policy evaluates to Deny. Or does Deny-override apply only to those policies which evaluate to permit or deny. A similar thought for Permit-override too!

Srinivas

> -----Original Message-----
> From: ext Anne Anderson [mailto:Anne.Anderson@Sun.COM]
> Sent: Wednesday, April 13, 2005 2:44 PM
> To: Kuketayev, Argyn (Contractor)
> Cc: xacml-users@lists.oasis-open.org
> Subject: Re: [xacml-users] Combining algorithms and "AND" and "OR"
> 
> 
> They are roughly equivalent, but not completely.  They differ from
> Boolean AND and OR in operating on 4 values - "Permit", "Deny",
> "NotApplicable", and "Indeterminate" - rather than on 2 ("True",
> "False").  If "Permit" is treated as equivalent to "True", 
> and "Deny" is
> treated as equivalent to "False", and if none of the rules or policies
> returns "NotApplicable" or "Indeterminate", then I believe they are
> equivalent.
> 
> Anne
> 
> Kuketayev, Argyn (Contractor) wrote:
> > Can I say that "deny-overrides" is equal to multiplication ("AND"
> > operator) of results of each rule or policy? Subsequently,
> > "permit-overrides" is "OR" operator?
> > 
> > Thanks,
> > Argyn
> 
> -- 
> Anne H. Anderson             Email: Anne.Anderson@Sun.COM
> Sun Microsystems Laboratories
> 1 Network Drive,UBUR02-311     Tel: 781/442-0928
> Burlington, MA 01803-0902 USA  Fax: 781/442-1692
> 
>