Novell ACCESS MANAGER 3.1 SP2 - POLICY GUIDE 2010 Manual page 71

The first rule in such a policy for the sales application would look similar to the following.
Rule 1 Granting Access
Figure 3-3
The conditions in Rule 1 are ANDed, which requires the user to match both conditions before they
are granted access to the resource. The priority is set to 1, so this rule is the first rule that the Access
Gateway processes. The J2EE authorization policies use the same logic.
The second rule would look similar to the following.
Rule 2 Denying Access
Figure 3-4
Because this rule has no conditions, any user who does not match the first rule does match this rule
and is denied access. The priority of this rule is set lower than the Permit rule so that the Permit rule
is processed first.
Creating Authorization Policies 71