{
  "resourceType": "CodeSystem",
  "id": "permission-rule-combining",
  "meta": {
    "lastUpdated": "2023-03-26T15:21:02.749+11:00",
    "profile": [
      "http://hl7.org/fhir/StructureDefinition/shareablecodesystem"
    ]
  },
  "text": {
    "status": "generated",
    "div": "\u003cdiv xmlns\u003d\"http://www.w3.org/1999/xhtml\"\u003e\u003cp\u003eThis code system \u003ccode\u003ehttp://hl7.org/fhir/permission-rule-combining\u003c/code\u003e defines the following codes:\u003c/p\u003e\u003ctable class\u003d\"codes\"\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003e\u003cb\u003eCode\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eDisplay\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eDefinition\u003c/b\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003edeny-overrides\u003ca name\u003d\"permission-rule-combining-deny-overrides\"\u003e \u003c/a\u003e\u003c/td\u003e\u003ctd\u003eDeny-overrides\u003c/td\u003e\u003ctd\u003eThe deny overrides combining algorithm is intended for those cases where a deny decision should have priority over a permit decision.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003epermit-overrides\u003ca name\u003d\"permission-rule-combining-permit-overrides\"\u003e \u003c/a\u003e\u003c/td\u003e\u003ctd\u003ePermit-overrides\u003c/td\u003e\u003ctd\u003eThe permit overrides combining algorithm is intended for those cases where a permit decision should have priority over a deny decision.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003eordered-deny-overrides\u003ca name\u003d\"permission-rule-combining-ordered-deny-overrides\"\u003e \u003c/a\u003e\u003c/td\u003e\u003ctd\u003eOrdered-deny-overrides\u003c/td\u003e\u003ctd\u003eThe behavior of this algorithm is identical to that of the “Deny-overrides” rule-combining algorithm with one exception.  The order in which the collection of rules is evaluated SHALL match the order as listed in the permission.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003eordered-permit-overrides\u003ca name\u003d\"permission-rule-combining-ordered-permit-overrides\"\u003e \u003c/a\u003e\u003c/td\u003e\u003ctd\u003eOrdered-permit-overrides\u003c/td\u003e\u003ctd\u003eThe behavior of this algorithm is identical to that of the “Permit-overrides” rule-combining algorithm with one exception.  The order in which the collection of rules is evaluated SHALL match the order as listed in the permission.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003edeny-unless-permit\u003ca name\u003d\"permission-rule-combining-deny-unless-permit\"\u003e \u003c/a\u003e\u003c/td\u003e\u003ctd\u003eDeny-unless-permit\u003c/td\u003e\u003ctd\u003eThe “Deny-unless-permit” combining algorithm is intended for those cases where a permit decision should have priority over a deny decision, and an “Indeterminate” or “NotApplicable” must never be the result. It is particularly useful at the top level in a policy structure to ensure that a PDP will always return a definite “Permit” or “Deny” result.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style\u003d\"white-space:nowrap\"\u003epermit-unless-deny\u003ca name\u003d\"permission-rule-combining-permit-unless-deny\"\u003e \u003c/a\u003e\u003c/td\u003e\u003ctd\u003ePermit-unless-deny\u003c/td\u003e\u003ctd\u003eThe “Permit-unless-deny” combining algorithm is intended for those cases where a deny decision should have priority over a permit decision, and an “Indeterminate” or “NotApplicable” must never be the result. It is particularly useful at the top level in a policy structure to ensure that a PDP will always return a definite “Permit” or “Deny” result. This algorithm has the following behavior.\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/div\u003e"
  },
  "extension": [
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
      "valueCode": "sec"
    },
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status",
      "valueCode": "trial-use"
    },
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-fmm",
      "valueInteger": 0
    }
  ],
  "url": "http://hl7.org/fhir/permission-rule-combining",
  "identifier": [
    {
      "system": "urn:ietf:rfc:3986",
      "value": "urn:oid:2.16.840.1.113883.4.642.4.2070"
    }
  ],
  "version": "5.0.0",
  "name": "PermissionRuleCombining",
  "title": "Permission Rule Combining",
  "status": "active",
  "experimental": false,
  "date": "2022-08-05T10:01:24+11:00",
  "publisher": "HL7 (FHIR Project)",
  "contact": [
    {
      "telecom": [
        {
          "system": "url",
          "value": "http://hl7.org/fhir"
        },
        {
          "system": "email",
          "value": "fhir@lists.hl7.org"
        }
      ]
    }
  ],
  "description": "Codes identifying the rule combining. See XACML Combining algorithms  http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-cos01-en.html",
  "jurisdiction": [
    {
      "coding": [
        {
          "system": "http://unstats.un.org/unsd/methods/m49/m49.htm",
          "code": "001",
          "display": "World"
        }
      ]
    }
  ],
  "caseSensitive": true,
  "content": "complete",
  "concept": [
    {
      "code": "deny-overrides",
      "display": "Deny-overrides",
      "definition": "The deny overrides combining algorithm is intended for those cases where a deny decision should have priority over a permit decision."
    },
    {
      "code": "permit-overrides",
      "display": "Permit-overrides",
      "definition": "The permit overrides combining algorithm is intended for those cases where a permit decision should have priority over a deny decision."
    },
    {
      "code": "ordered-deny-overrides",
      "display": "Ordered-deny-overrides",
      "definition": "The behavior of this algorithm is identical to that of the “Deny-overrides” rule-combining algorithm with one exception.  The order in which the collection of rules is evaluated SHALL match the order as listed in the permission."
    },
    {
      "code": "ordered-permit-overrides",
      "display": "Ordered-permit-overrides",
      "definition": "The behavior of this algorithm is identical to that of the “Permit-overrides” rule-combining algorithm with one exception.  The order in which the collection of rules is evaluated SHALL match the order as listed in the permission."
    },
    {
      "code": "deny-unless-permit",
      "display": "Deny-unless-permit",
      "definition": "The “Deny-unless-permit” combining algorithm is intended for those cases where a permit decision should have priority over a deny decision, and an “Indeterminate” or “NotApplicable” must never be the result. It is particularly useful at the top level in a policy structure to ensure that a PDP will always return a definite “Permit” or “Deny” result."
    },
    {
      "code": "permit-unless-deny",
      "display": "Permit-unless-deny",
      "definition": "The “Permit-unless-deny” combining algorithm is intended for those cases where a deny decision should have priority over a permit decision, and an “Indeterminate” or “NotApplicable” must never be the result. It is particularly useful at the top level in a policy structure to ensure that a PDP will always return a definite “Permit” or “Deny” result. This algorithm has the following behavior."
    }
  ]
}