All current authorization tests are against objects with a single-rule access policy. This does not adequately test that the authorization algorithms:

check all of the access rules, or just the first one¶

look for the greatest access allowed for their set of subjects, or simply the first one encountered¶

look within all of the subjects in an access rule, or just the first one¶

look within all of the permissions in an access rule, or just the first one¶