[xacml] [schema] PDP response where no policy applies

If absolutely none of its policies applies, then is the PDP
obligated to return Indeterminate(Inapplicable)?

If the PDP wants to return Deny if no policies apply, does it
have to define a base policy with a DenyOverrides rule?

We should spell this sort of behavior out in the spec.

Anne
-- 
Anne H. Anderson             Email: 
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692