RE: [xacml] 7.7 Obligations

>The PDP just collects obligations; it is not responsible for
>enforcing them. The PEP is responsible for enforcing
>obligations. If the PEP does not understand an obligation, it
>should deny access.
DENY?
What if it is using some extra fancy rule and policy recombination algorithm that never returns denies - only PERMIT and NONAPPLICABLE.
Maybe it should be worded such that it is up PEP MUST recognize this, but what to do is up to an implemention?
Daniel