Title: RE: [xacml] New issue#1 from "Boolean Policy resolution"
While I understand that you are proposing that "n/a" is effectively ignored, I can't agree with it.
The question being asked is should access be granted. In this case, the policy administrator has written a rule that implies that both predicates must allow access before the requester is granted access; however, policy administrator has referenced policy that does not apply. In security and access control system, it is better to error on the side of caution and not grant access if there is any uncertainty.
t AND n/a = n/a
t AND n/a = f
James
