They are roughly equivalent, but not completely. They differ from
Boolean AND and OR in operating on 4 values - "Permit", "Deny",
"NotApplicable", and "Indeterminate" - rather than on 2 ("True",
"False"). If "Permit" is treated as equivalent to "True", and "Deny" is
treated as equivalent to "False", and if none of the rules or policies
returns "NotApplicable" or "Indeterminate", then I believe they are
equivalent.
Anne
Kuketayev, Argyn (Contractor) wrote:
> Can I say that "deny-overrides" is equal to multiplication ("AND"
> operator) of results of each rule or policy? Subsequently,
> "permit-overrides" is "OR" operator?
>
> Thanks,
> Argyn
--
Anne H. Anderson Email:
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311 Tel: 781/442-0928
Burlington, MA 01803-0902 USA Fax: 781/442-1692
