This question's explanation and your answers so far.
問95
頻出度★★★
S 社の T 営業所では，ID カードによる入室管理システムを導入することになった。T 営業所の施設の種類と管理対象者の区分（以下，対象区分という）を表のように分類し，入室許可の有無の区分（以下，許可区分という）の設定を行う。ここで，表は施設に対して入室を許可する対象区分を“○”，入室を許可しない対象区分を“×”で示す。
表 許可区分の設定
正解The correct answer is ア (①). The setting descriptions are evaluated from the 2nd line onward, from top to bottom; as soon as a line matching the specified combination of facility and target category is found, that line's permission type is applied and the lines below it are not evaluated (the first matching line wins). Here, the sales section manager and the technical section manager belong to the newly created “Section manager” category and at the same time also belong to their original “Sales staff” and “Technical staff” categories. The line 〔Special meeting room DENY Visitor, Sales staff, Technical staff〕 in Figure 1 matches the combination of the special meeting room with the manager's other category (Sales staff / Technical staff), so if the added line 〔Special meeting room ACCEPT Section manager〕 is placed below this DENY line, the evaluation is settled at the DENY line and managers cannot enter the special meeting room. Therefore the ACCEPT Section manager line, which permits entry as an exception, must be inserted before the DENY line, that is, at ①, immediately after the policy line. Even when it is placed at ①, visitors, sales staff, and technical staff who are not section managers do not belong to the “Section manager” category and do not match the added line, so the DENY line right after it applies and they remain unable to enter, just as before. The judgments for the meeting room, office room 1, office room 2, and the reception room are also unaffected.
×Incorrectイ
② is the position immediately after the line 〔Special meeting room DENY Visitor, Sales staff, Technical staff〕. When the sales section manager tries to enter the special meeting room, the evaluation proceeds from the top and reaches this DENY line first. Because the sales section manager also belongs to the “Sales staff” category, the combination of the facility with one of the target categories matches, DENY is applied, and the evaluation ends there. The added ACCEPT Section manager line is never read, so the goal of permitting section managers to enter cannot be achieved.
×Incorrectウ
③ is even further down, after 〔Meeting room DENY Visitor〕, and it is the same as ② in that it lies below the DENY line for the special meeting room. A section manager first matches 〔Special meeting room DENY Visitor, Sales staff, Technical staff〕, so entry is denied at that point and the evaluation never reaches the added line. The further down the line is placed, the more surely it is overtaken by the principle that the first matching line wins.
×Incorrectエ
④ is the end of the list. Because the DENY line concerning the special meeting room is evaluated first, a section manager is always judged DENY there, and the ACCEPT Section manager line at the end is never evaluated. Deciding the default value applied to combinations that match no line is the role of the policy line on the 1st line, and adding a Format 2 line at the end cannot serve as that default.
ここがポイント
Access control rules are evaluated in order from the top; the permission type of the first matching line is applied and the lines after it are not evaluated (the first matching line wins). Therefore a rule that permits only a subset as an exception must always be written above the broader denial rule that covers it. If the order is reversed, the exception line is never evaluated.
When one managed subject belongs to multiple target categories, a line applies as soon as the combination of the facility with one of those categories matches. Therefore how a person with overlapping categories (a section manager is a manager and also a staff member) is treated depends on the order in which the lines are written. The policy line on the 1st line is the default applied to combinations that match no line, which is a different role from specifying an exception through ordering.