If absolutely none of its policies applies, then is the PDP obligated to return Indeterminate(Inapplicable)? If the PDP wants to return Deny if no policies apply, does it have to define a base policy with a DenyOverrides rule? We should spell this sort of behavior out in the spec. Anne -- Anne H. Anderson Email:
Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692