How Does CA ACF2 for z/VM Work? › Controlling Access to Resources › How Does CA ACF2 for z/VM Sort Rules?

How Does CA ACF2 for z/VM Sort Rules?

The CA ACF2 for z/VM rule compiler converts the rule set input into a form usable by the rule interpreter when CA ACF2 for z/VM verifies it. The compiler also orders the rule according to the following criteria:

• UID patterns, from most specific to most general
• SOURCE parameters in alphabetical order, with “none specified” last
• SHIFT parameters in alphabetical order, with “none specified” last
• UNTIL dates, from earliest to latest.

The first active rule whose environment matches the actual access attempt determines the access permission.