PermissionRuleCombining

Permission Rule Combining

activeExtensions for Using Data Elements from FHIR R5 in FHIR R40.1.0complete6 concepts

Codes identifying the rule combining. See XACML Combining algorithms http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-cos01-en.html

Metadata

hl7.org/fhir
Canonical URL
http://hl7.org/fhir/permission-rule-combining
ID
permission-rule-combining
Version
5.0.0
Publisher
Security
Case Sensitive
Yes

Concepts (6)

CodeDisplayDefinition
deny-overridesDeny-overridesThe deny overrides combining algorithm is intended for those cases where a deny decision should have priority over a permit decision.
permit-overridesPermit-overridesThe permit overrides combining algorithm is intended for those cases where a permit decision should have priority over a deny decision.
ordered-deny-overridesOrdered-deny-overridesThe behavior of this algorithm is identical to that of the “Deny-overrides” rule-combining algorithm with one exception. The order in which the collection of rules is evaluated SHALL match the order as listed in the permission.
ordered-permit-overridesOrdered-permit-overridesThe behavior of this algorithm is identical to that of the “Permit-overrides” rule-combining algorithm with one exception. The order in which the collection of rules is evaluated SHALL match the order as listed in the permission.
deny-unless-permitDeny-unless-permitThe “Deny-unless-permit” combining algorithm is intended for those cases where a permit decision should have priority over a deny decision, and an “Indeterminate” or “NotApplicable” must never be the result. It is particularly useful at the top level in a policy structure to ensure that a PDP will always return a definite “Permit” or “Deny” result.
permit-unless-denyPermit-unless-denyThe “Permit-unless-deny” combining algorithm is intended for those cases where a deny decision should have priority over a permit decision, and an “Indeterminate” or “NotApplicable” must never be the result. It is particularly useful at the top level in a policy structure to ensure that a PDP will always return a definite “Permit” or “Deny” result. This algorithm has the following behavior.