diego gonzalez wrote:
> [...]
> But regarding IIIA014, why do you say "Policy2 Obligations are Permit
> Obligations", here is the list of Obligations (I've removed the
> AttributeAssignment elements)
> [...]
> There are 4 obligations, 2 of them are for Permit and 2 for Deny. Since
> the Policy2 will evaluate as Permit, obligations 3 and 4 must be
> returned.
When Policy2 returns Permit, it also returns only those Obligations that
FulfillOn Permit (in this case, 1 and 2). But the parent PolicySet's
combining algorithm ends up with a decision of Deny. At this point, the
algorithm can only return Obligations with a FulfillOn of Deny. Thus,
the Obligations from Policy2 are not included.
seth
