Does "deny-override" mean that the result of combining a set of policies is "deny" no matter what the other policies evaluate to (i.e. Permit, Indeterminate or NotApplicable) as long as one policy evaluates to Deny. Or does Deny-override apply only to those policies which evaluate to permit or deny. A similar thought for Permit-override too!
Srinivas
> -----Original Message-----
> From: ext Anne Anderson [mailto:]
> Sent: Wednesday, April 13, 2005 2:44 PM
> To: Kuketayev, Argyn (Contractor)
> Cc:
> Subject: Re: [xacml-users] Combining algorithms and "AND" and "OR"
>
>
> They are roughly equivalent, but not completely. They differ from
> Boolean AND and OR in operating on 4 values - "Permit", "Deny",
> "NotApplicable", and "Indeterminate" - rather than on 2 ("True",
> "False"). If "Permit" is treated as equivalent to "True",
> and "Deny" is
> treated as equivalent to "False", and if none of the rules or policies
> returns "NotApplicable" or "Indeterminate", then I believe they are
> equivalent.
>
> Anne
>
> Kuketayev, Argyn (Contractor) wrote:
> > Can I say that "deny-overrides" is equal to multiplication ("AND"
> > operator) of results of each rule or policy? Subsequently,
> > "permit-overrides" is "OR" operator?
> >
> > Thanks,
> > Argyn
>
> --
> Anne H. Anderson Email:
> Sun Microsystems Laboratories
> 1 Network Drive,UBUR02-311 Tel: 781/442-0928
> Burlington, MA 01803-0902 USA Fax: 781/442-1692
>
>
