The Algorithm

This section specifies the complete AccessCheck evaluation algorithm. The feature sections describe what each feature does. This section describes how they compose.

§10.10.1 Pipeline overview #

The complete evaluation runs in this order:

0. Session validity gate. If the token's logon session is marked dead, deny immediately.
1. Impersonation level gate. If the token is an impersonation token at Identification level, deny immediately. Anonymous tokens proceed through the full pipeline.
2. Input validation. Reject null SDs, SDs without owner or group, and malformed object type lists.
3. Generic mapping. Map generic bits in the desired mask to object-specific bits. Strip MAXIMUM_ALLOWED.
4. Effective privileges. Clear backup/restore bits when the corresponding intent flag is absent.
5. Privilege grants. Resolve ACCESS_SYSTEM_SECURITY, backup, and restore. Seed decided, granted, and privilege_granted.
6. Pre-SACL walk. Extract the mandatory integrity label, PIP trust label, resource attributes, and scoped policy IDs from the SACL. Enforce MIC and PIP.
7. Virtual group injection. Inject S-1-3-4 and S-1-5-10 as virtual groups if the caller is the owner or matches the object's principal.
8. Tree initialization. Copy scalar decided/granted to each tree node.
9. Normal DACL evaluation. Owner implicit rights, then the DACL walk with token-based SID matching. Resource attributes extracted in step 6 are available to conditional expressions in callback ACEs.
10. Post-DACL privilege override. SeTakeOwnershipPrivilege grants WRITE_OWNER if the DACL did not and mandatory policy (MIC/PIP) did not block it.
11. Restricted token pass. If the token has restricting SIDs, evaluate the DACL again with the restricted SID list and intersect. Privilege-granted bits are restored after intersection.
12. Confinement pass. If the token is confined, evaluate the DACL with confinement SIDs and intersect. No privilege bypass.

Invariant: Steps 11, 12, and 13 are intersections — they can only narrow the granted set. Bits denied by MIC or PIP in step 6 remain denied through all subsequent stages. 13. CAAP (Central Access and Auditing Policy). For each scoped policy, evaluate each applicable rule's DACL using the full per-SD pipeline and intersect. Collect applicable rules' SACLs for the audit walk. 14. Privilege-use auditing. Emit audit events for privileges that contributed to the final result. 15. Audit emission. Walk the object's SACL and any CAAP effective SACLs for audit and alarm ACEs. 16. Result computation. Derive the final granted mask and success/failure verdict.

§10.10.2 EvaluateSecurityDescriptor #

Per-SD evaluation (steps 0--12). Called once for the normal evaluation and once per CAAP rule with a synthetic SD.

EvaluateSecurityDescriptor(
    sd, token, pip_type, pip_trust, desired, mapping,
    object_tree, self_sid, local_claims, privilege_intent
) -> (decided, granted, privilege_granted,
      max_allowed_mode, mapped_desired, resource_attributes,
      policy_sids) | error

    // Step 0: Session validity gate.
    if token.logon_session.dead:
        return ERROR_ACCESS_DENIED

    // Step 1: Impersonation level gate.
    if token.token_type == Impersonation
       and token.impersonation_level == Identification:
        return ERROR_ACCESS_DENIED

    // Step 2: Input validation.
    if sd is null:
        return ERROR_INVALID_PARAMETER
    if sd.owner is null or sd.group is null:
        return ERROR_INVALID_SECURITY_DESCR
    if object_tree is not null:
        validate: non-empty, first node at level 0,
        exactly one level-0 node, no level gaps,
        no duplicate GUIDs

    // Step 3: Generic mapping.
    desired = MapGenericBits(desired, mapping)
    max_allowed_mode = (desired & MAXIMUM_ALLOWED) != 0
    desired = desired & ~MAXIMUM_ALLOWED

    // Step 4: Effective privileges.
    effective_privileges = token.privileges_enabled
    if not (privilege_intent & BACKUP_INTENT):
        effective_privileges &= ~SeBackupPrivilege
    if not (privilege_intent & RESTORE_INTENT):
        effective_privileges &= ~SeRestorePrivilege

    // Step 5: Privilege-based grants.
    decided = 0; granted = 0; privilege_granted = 0

    // ACCESS_SYSTEM_SECURITY: always decided by privilege.
    decided |= ACCESS_SYSTEM_SECURITY
    if (effective_privileges & SeSecurityPrivilege):
        granted |= ACCESS_SYSTEM_SECURITY
        privilege_granted |= ACCESS_SYSTEM_SECURITY

    // Backup: all read-mapped bits.
    if (effective_privileges & SeBackupPrivilege):
        backup_bits = MapGenericBits(GENERIC_READ, mapping)
        decided |= backup_bits
        granted |= backup_bits
        privilege_granted |= backup_bits

    // Restore: all write-mapped bits + metadata rights.
    if (effective_privileges & SeRestorePrivilege):
        restore_bits = MapGenericBits(GENERIC_WRITE, mapping)
                       | WRITE_DAC | WRITE_OWNER | DELETE
                       | ACCESS_SYSTEM_SECURITY
        decided |= restore_bits
        granted |= restore_bits
        privilege_granted |= restore_bits

    // Note: SeRestorePrivilege above includes WRITE_OWNER in
    // restore_bits. If restore is active, WRITE_OWNER is decided
    // here. Step 10 (SeTakeOwnershipPrivilege) is a fallback for
    // when restore is not active and the DACL did not grant it.

    // Step 6: Pre-SACL walk.
    resource_attributes = {}
    policy_sids = []
    // mandatory_decided tracks bits decided by MIC and PIP
    // (mandatory mechanisms). Used at step 10 to prevent
    // SeTakeOwnershipPrivilege from overriding mandatory
    // decisions. Populated by EnforceMIC and EnforcePIP.
    mandatory_decided = 0
    PreSACLWalk(sd, token, pip_type, pip_trust, mapping,
                &decided, &granted, &privilege_granted,
                &mandatory_decided, &resource_attributes,
                &policy_sids)

    // Step 7: Virtual group injection.
    token = EnrichToken(token, sd.owner, self_sid)

    // Step 8: Tree initialization.
    if object_tree is not null:
        for each node in object_tree:
            node.decided = decided
            node.granted = granted

    // Step 9: Normal DACL evaluation.
    EvaluateDACL(sd, token, mapping, object_tree,
                 SidMatchesToken, desired, max_allowed_mode,
                 resource_attributes, local_claims,
                 skip_owner_implicit=false,
                 &decided, &granted)

    // Step 10: Post-DACL WRITE_OWNER override.
    // Deny-proof but respects mandatory decisions (MIC/PIP).
    if (desired & WRITE_OWNER) != 0 or max_allowed_mode:
        if (effective_privileges & SeTakeOwnershipPrivilege):
            if not (mandatory_decided & WRITE_OWNER)
               and not (granted & WRITE_OWNER):
                decided |= WRITE_OWNER
                granted |= WRITE_OWNER
                privilege_granted |= WRITE_OWNER
                if object_tree is not null:
                    for each node:
                        if not (node.granted & WRITE_OWNER):
                            node.decided |= WRITE_OWNER
                            node.granted |= WRITE_OWNER

    // Step 11: Restricted token pass.
    if token.restricted_sids is not empty:
        r_decided = 0; r_granted = 0
        // Build restricted enriched token: inject virtual groups
        // (S-1-3-4 if owner in restricting SIDs, S-1-5-10 if
        // self_sid in restricting SIDs). Swap in restricted
        // device groups for Device_Member_of evaluation.
        // Restricting SIDs are presence-based; attributes ignored.
        r_enriched = EnrichTokenForRestricted(
            token, sd.owner, self_sid,
            token.restricted_sids,
            token.restricted_device_groups)
        // Fresh tree: same structure, zeroed decided/granted.
        r_tree = null
        if object_tree is not null:
            r_tree = copy_tree_structure(object_tree)
            for each node in r_tree:
                node.decided = 0; node.granted = 0
        EvaluateDACL(sd, r_enriched, mapping, r_tree,
                     SidInRestrictingSids, desired,
                     max_allowed_mode, resource_attributes,
                     local_claims, skip_owner_implicit=false,
                     &r_decided, &r_granted)
        // Scalar merge: intersection.
        if token.write_restricted:
            write_bits = MapGenericBits(GENERIC_WRITE, mapping)
            granted = (granted & ~write_bits)
                    | (granted & r_granted & write_bits)
        else:
            granted = granted & r_granted
        // Privilege-granted bits bypass the restricted pass.
        granted |= privilege_granted
        // Tree merge: same intersection per node.
        if object_tree is not null:
            for i in 0..len(object_tree):
                if token.write_restricted:
                    object_tree[i].granted =
                        (object_tree[i].granted & ~write_bits)
                        | (object_tree[i].granted
                           & r_tree[i].granted & write_bits)
                else:
                    object_tree[i].granted =
                        object_tree[i].granted & r_tree[i].granted
                object_tree[i].granted |= privilege_granted

    // Step 12: Confinement pass.
    if token.confinement_sid is not null
       and not token.confinement_exempt:
        c_decided = 0; c_granted = 0
        // Build confinement SID set:
        // - confinement_sid
        // - confinement_capabilities (presence-based; attributes ignored)
        // Inject virtual groups:
        // - S-1-3-4 if owner SID is in the confinement SID set
        // - S-1-5-10 if self_sid is in the confinement SID set
        // Build confinement token view for conditional expressions:
        // - Member_of/Member_of_Any and device variants evaluate
        //   against the confinement SID set (not real groups)
        // - Non-membership operators (Exists, ==, Contains, etc.)
        //   see the real token's user_claims and device_claims
        // Fresh tree: same structure, zeroed decided/granted.
        c_tree = null
        if object_tree is not null:
            c_tree = copy_tree_structure(object_tree)
            for each node in c_tree:
                node.decided = 0; node.granted = 0
        EvaluateDACL(sd, token, mapping, c_tree,
                     SidInConfinementSids, desired,
                     max_allowed_mode, resource_attributes,
                     local_claims, skip_owner_implicit=true,
                     membership_sids=confinement_sids,
                     &c_decided, &c_granted)
        // Absolute intersection. No privilege bypass.
        granted = granted & c_granted
        // Tree merge: absolute intersection per node.
        if object_tree is not null:
            for i in 0..len(object_tree):
                object_tree[i].granted =
                    object_tree[i].granted & c_tree[i].granted

    return (decided, granted, privilege_granted,
            max_allowed_mode, desired, resource_attributes,
            policy_sids)

§10.10.3 AccessCheckCore #

Orchestrator. Calls EvaluateSecurityDescriptor, then evaluates CAAPs, emits privilege-use audits, and walks the SACL (plus CAAP SACLs) for audit ACEs.

AccessCheckCore(
    sd, token, pip_type, pip_trust, desired, mapping,
    object_tree, self_sid, local_claims,
    object_audit_context, privilege_intent
) -> (decided, granted, privilege_granted,
      max_allowed_mode, mapped_desired,
      continuous_audit_mask, staging_mismatch) | error

    // Steps 0-12: per-SD evaluation.
    (decided, granted, privilege_granted,
     max_allowed_mode, mapped_desired,
     resource_attributes, policy_sids
    ) = EvaluateSecurityDescriptor(
        sd, token, pip_type, pip_trust, desired, mapping,
        object_tree, self_sid, local_claims, privilege_intent)

    // Step 13: CAAP (Central Access and Auditing Policy).
    caap_sacls = []          // Effective SACLs from applicable rules.
    staged_caap_sacls = []   // Staged SACLs (or effective as fallback).
    staged_dacl_total = granted  // Staged DACL running total.
    staged_tree_total = null
    if object_tree is not null:
        staged_tree_total = []
        for each node in object_tree:
            staged_tree_total.append(node.granted)
    staging_mismatch = false
    if len(policy_sids) > 0:
        for caap_sid in policy_sids:
            policy = LookupCAAP(caap_sid)
            if policy is null:
                policy = RECOVERY_POLICY
            for rule in policy.rules:
                if rule.applies_to is not null:
                    cond_result = EvaluateConditionalExpression(
                                     rule.applies_to, token,
                                     resource_attributes,
                                     local_claims, for_allow=false)
                    if cond_result != TRUE:
                        continue
                // DACL component: build synthetic SD, evaluate,
                // intersect with running total.
                rule_sd = synthetic_sd(sd, rule.effective_dacl)
                rule_tree = copy_tree_structure(object_tree)
                rule_result = EvaluateSecurityDescriptor(
                    rule_sd, token, pip_type, pip_trust,
                    desired, mapping, rule_tree, self_sid,
                    local_claims, 0)
                if rule_result is error:
                    // DACL error: deny all except privileges.
                    granted &= privilege_granted
                    if object_tree is not null:
                        for i in 0..len(object_tree):
                            object_tree[i].granted &= privilege_granted
                else:
                    granted &= rule_result.granted
                    if object_tree is not null:
                        for i in 0..len(object_tree):
                            object_tree[i].granted &=
                                rule_tree[i].granted
                // SACL component: collect for audit walk.
                // SACL errors are logged and the rule's audit
                // contribution is skipped (not fail-closed).
                if rule.effective_sacl is not null:
                    caap_sacls.append(rule.effective_sacl)

                // Staged DACL evaluation (parallel, no access effect).
                if rule.staged_dacl is not null:
                    stg_sd = synthetic_sd(sd, rule.staged_dacl)
                    stg_tree = copy_tree_structure(object_tree)
                    stg_result = EvaluateSecurityDescriptor(
                        stg_sd, token, pip_type, pip_trust,
                        desired, mapping, stg_tree, self_sid,
                        local_claims, 0)
                    stg_granted = stg_result.granted
                        if stg_result is not error else 0
                else:
                    stg_granted = rule_result.granted
                        if rule_result is not error
                        else privilege_granted
                staged_dacl_total &= stg_granted
                if object_tree is not null:
                    for i in 0..len(object_tree):
                        if rule.staged_dacl is not null:
                            stg_node_granted =
                                stg_tree[i].granted
                                if stg_result is not error
                                else privilege_granted
                        else:
                            stg_node_granted =
                                rule_tree[i].granted
                                if rule_result is not error
                                else privilege_granted
                        staged_tree_total[i] &=
                            stg_node_granted

                // Staged SACL: collect for staged audit walk.
                if rule.staged_sacl is not null:
                    staged_caap_sacls.append(rule.staged_sacl)
                else if rule.effective_sacl is not null:
                    // No staged SACL: contribute effective to both.
                    staged_caap_sacls.append(rule.effective_sacl)

        // After all policies: compare staged vs effective.
        if staged_dacl_total != granted:
            staging_mismatch = true
            // Log: effective_granted, staged_dacl_total, policy_sids.
        if object_tree is not null:
            for i in 0..len(object_tree):
                if staged_tree_total[i] != object_tree[i].granted:
                    staging_mismatch = true
                    break
            // In result-list mode, any per-node staged/effective
            // grant delta sets staging_mismatch.

    // Step 14: Privilege-use auditing.
    // Only for explicit requests, not MAXIMUM_ALLOWED probing.
    // For each privilege tracked by a provenance mask
    // (security_granted, backup_granted, restore_granted,
    // take_ownership_granted, relabel_granted):
    //
    // success_bits = provenance_var & mapped_desired & granted
    // failure_bits = provenance_var & mapped_desired & ~granted
    //
    // In scalar AccessCheck, compare against scalar final granted.
    // In AccessCheckResultList, compare against the final per-node
    // granted list: a privilege-use success occurs if contributed
    // requested bits survive on any node; a privilege-use failure
    // occurs only if contributed requested bits survive on no node.
    //
    // If success_bits != 0, the privilege was actually necessary
    // for the final result:
    // - call mark_used on the token
    // - emit a PrivilegeUseEvent with success=true if the token's
    //   audit_policy has PRIVILEGE_USE_SUCCESS (0x04)
    //
    // Else if failure_bits != 0, the privilege was exercised but
    // did not survive to the final granted result:
    // - do NOT call mark_used on the token
    // - emit a PrivilegeUseEvent with success=false if the token's
    //   audit_policy has PRIVILEGE_USE_FAILURE (0x08)
    //
    // If both are zero, the privilege did not contribute to the
    // requested access and no privilege-use event is emitted.
    //
    // The object_audit_context is included in emitted events so
    // the audit trail identifies which object the privilege was
    // exercised on.

    // Step 15: Audit emission.
    audit_events = []
    continuous_audit_mask = 0
    // Walk the object's own SACL.
    if sd.sacl is not null:
        EvaluateSACL(sd.sacl, token, sd.owner, self_sid,
                     object_tree, mapped_desired, granted, mapping,
                     resource_attributes, local_claims,
                     &audit_events, &continuous_audit_mask)
    // Walk each CAAP effective SACL collected in step 13.
    // Same evaluation rules as the object's own SACL.
    for caap_sacl in caap_sacls:
        EvaluateSACL(caap_sacl, token, sd.owner, self_sid,
                     object_tree, mapped_desired, granted, mapping,
                     resource_attributes, local_claims,
                     &audit_events, &continuous_audit_mask)
    // continuous_audit_mask is the OR of all matching alarm
    // ACE masks across the object SACL and all CAAP SACLs.
    // audit_events contains all matching audit ACEs.
    // Read-only — does not modify granted.

    // Staged SACL comparison: walk staged SACLs in parallel,
    // compare audit event sets. Does not affect real auditing.
    // Any audit delta sets staging_mismatch in both scalar and
    // result-list modes.
    if len(staged_caap_sacls) > 0:
        staged_audit_events = []
        staged_continuous = 0
        if sd.sacl is not null:
            EvaluateSACL(sd.sacl, token, sd.owner, self_sid,
                         object_tree, mapped_desired, granted, mapping,
                         resource_attributes, local_claims,
                         &staged_audit_events, &staged_continuous)
        for stg_sacl in staged_caap_sacls:
            EvaluateSACL(stg_sacl, token, sd.owner, self_sid,
                         object_tree, mapped_desired, granted, mapping,
                         resource_attributes, local_claims,
                         &staged_audit_events, &staged_continuous)
        if staged_audit_events != audit_events
           or staged_continuous != continuous_audit_mask:
            staging_mismatch = true
            // Log: audit delta between effective and staged SACLs.

    // Step 15b: Token audit_policy forced auditing.
    // If the token's audit_policy has OBJECT_ACCESS_SUCCESS (0x01)
    // and the access succeeded, emit an audit event regardless
    // of whether the SACL matched. Similarly for
    // OBJECT_ACCESS_FAILURE (0x02) on failure. These are additive
    // — they force audit events that the SACL alone would not
    // have generated.
    success = (granted & mapped_desired) == mapped_desired
              or mapped_desired == 0
    if success and (token.audit_policy & 0x01):
        audit_events.append(AuditEvent(
            policy_forced=true, mapped_desired, granted, true))
    if not success and (token.audit_policy & 0x02):
        audit_events.append(AuditEvent(
            policy_forced=true, mapped_desired, granted, false))

    // Step 16: Result computation.
    return (decided, granted, privilege_granted,
            max_allowed_mode, mapped_desired,
            continuous_audit_mask, staging_mismatch)

§10.10.4 AccessCheck wrapper #

AccessCheck(...) -> (granted, allowed,
                     continuous_audit_mask,
                     staging_mismatch) | error

    (decided, granted, privilege_granted,
     max_allowed_mode, mapped_desired,
     continuous_audit_mask,
     staging_mismatch) = AccessCheckCore(...)

    // When a tree is present, root.granted reflects the
    // whole object (ancestor propagation ensures this).
    if object_tree is not null:
        granted = object_tree[0].granted

    // All comparisons use mapped_desired.
    if mapped_desired == 0:
        allowed = true
    else:
        allowed = (granted & mapped_desired) == mapped_desired

    return (granted, allowed, continuous_audit_mask,
            staging_mismatch)

§10.10.5 AccessCheckResultList wrapper #

AccessCheckResultList(...) -> (granted_list, status_list,
                               continuous_audit_mask,
                               staging_mismatch) | error

    // Requires object_tree.
    (decided, granted, privilege_granted,
     max_allowed_mode, mapped_desired,
     continuous_audit_mask,
     staging_mismatch) = AccessCheckCore(...)

    for each node in object_tree:
        if mapped_desired == 0:
            node_status = OK
        else if (node.granted & mapped_desired) == mapped_desired:
            node_status = OK
        else:
            node_status = ACCESS_DENIED
        granted_list.append(node.granted or 0)
        status_list.append(node_status)

    return (granted_list, status_list, continuous_audit_mask,
            staging_mismatch)

§10.10.6 Key helper functions #

SidMatchesToken(sid, token, for_allow) -> bool
    if sid == token.user_sid:
        if for_allow and token.user_deny_only:
            return false
        return true
    for group in token.groups:
        if not group.enabled and not group.deny_only:
            continue
        if for_allow and group.deny_only:
            continue
        if sid == group.sid:
            return true
    return false

EnrichToken(token, owner_sid, self_sid) -> Token
    // Idempotent. Returns a view — original not modified.
    if SidMatchesToken(owner_sid, token, for_allow=true):
        add S-1-3-4 as virtual group
    if self_sid is not null:
        if SidMatchesToken(self_sid, token, for_allow=true):
            add S-1-5-10 as virtual group
        else if SidMatchesToken(self_sid, token, for_allow=false):
            add S-1-5-10 as virtual group (deny-only)
    return token

MapGenericBits(mask, mapping) -> ACCESS_MASK
    if mask & GENERIC_READ:
        mask = (mask & ~GENERIC_READ) | mapping.read
    if mask & GENERIC_WRITE:
        mask = (mask & ~GENERIC_WRITE) | mapping.write
    if mask & GENERIC_EXECUTE:
        mask = (mask & ~GENERIC_EXECUTE) | mapping.execute
    if mask & GENERIC_ALL:
        mask = (mask & ~GENERIC_ALL) | mapping.all
    return mask

EvaluateSACL(sacl, token, owner, self_sid,
             object_tree, mapped_desired, granted, mapping,
             resource_attributes, local_claims,
             &audit_events, &continuous_audit_mask)

    enriched = EnrichToken(token, owner, self_sid)

    for ace in sacl.aces:
        if ace.flags & INHERIT_ONLY_ACE:
            continue
        ace_mask = MapGenericBits(ace.mask, mapping)

        if ace.type == SYSTEM_AUDIT_ACE
           or ace.type == SYSTEM_AUDIT_OBJECT_ACE:
            if not enriched_sid_matches(ace.sid, enriched,
                                        for_allow=false):
                continue
            // Object ACE GUID scoping: if the ACE has an
            // ObjectType GUID and an object_tree is present,
            // the ACE only fires if the GUID matches a node.
            if ace.has_object_type() and object_tree is not null:
                if FindNode(object_tree, ace.object_type) is null:
                    continue
            if (ace_mask & mapped_desired) == 0:
                continue
            success = (granted & mapped_desired) == mapped_desired
                      or mapped_desired == 0
            if success and (ace.flags & SUCCESSFUL_ACCESS_ACE_FLAG):
                audit_events.append(AuditEvent(
                    ace, mapped_desired, granted, true))
            if not success and (ace.flags & FAILED_ACCESS_ACE_FLAG):
                audit_events.append(AuditEvent(
                    ace, mapped_desired, granted, false))

        if ace.type == SYSTEM_AUDIT_CALLBACK_ACE
           or ace.type == SYSTEM_AUDIT_CALLBACK_OBJECT_ACE:
            if not enriched_sid_matches(ace.sid, enriched,
                                        for_allow=false):
                continue
            // Object ACE GUID scoping (same as above).
            if ace.has_object_type() and object_tree is not null:
                if FindNode(object_tree, ace.object_type) is null:
                    continue
            // Condition must be TRUE or UNKNOWN to fire.
            cond = EvaluateConditionalExpression(
                ace.condition, enriched, resource_attributes,
                local_claims, for_allow=false)
            if cond == FALSE:
                continue
            if (ace_mask & mapped_desired) == 0:
                continue
            success = (granted & mapped_desired) == mapped_desired
                      or mapped_desired == 0
            if success and (ace.flags & SUCCESSFUL_ACCESS_ACE_FLAG):
                audit_events.append(AuditEvent(
                    ace, mapped_desired, granted, true))
            if not success and (ace.flags & FAILED_ACCESS_ACE_FLAG):
                audit_events.append(AuditEvent(
                    ace, mapped_desired, granted, false))

        if ace.type == SYSTEM_ALARM_ACE
           or ace.type == SYSTEM_ALARM_OBJECT_ACE:
            if enriched_sid_matches(ace.sid, enriched,
                                    for_allow=false):
                if ace.has_object_type() and object_tree is not null:
                    if FindNode(object_tree, ace.object_type) is null:
                        continue
                continuous_audit_mask |= ace_mask

        if ace.type == SYSTEM_ALARM_CALLBACK_ACE
           or ace.type == SYSTEM_ALARM_CALLBACK_OBJECT_ACE:
            if enriched_sid_matches(ace.sid, enriched,
                                    for_allow=false):
                if ace.has_object_type() and object_tree is not null:
                    if FindNode(object_tree, ace.object_type) is null:
                        continue
                cond = EvaluateConditionalExpression(
                    ace.condition, enriched, resource_attributes,
                    local_claims, for_allow=false)
                if cond == FALSE:
                    continue
                continuous_audit_mask |= ace_mask

§10.10.7 Undefined helper functions #

The following functions are called in the pseudocode above but defined in other spec sections:

§10.10.7.1 Privilege provenance tracking #

Step 14 references per-privilege provenance masks. These are tracked throughout the pipeline as additional scalar variables:

Each variable records which bits that privilege contributed. At step 14, for each privilege, compare the provenance mask against the mapped requested mask and the final result. In scalar AccessCheck, the comparison uses scalar final granted. In AccessCheckResultList, the comparison uses the final per-node granted list: if contributed requested bits survive on any node, the privilege was "actually necessary" — call mark_used and emit a successful PrivilegeUseEvent if the token's audit_policy has PRIVILEGE_USE_SUCCESS (0x04). If contributed requested bits were exercised but survive on no node, emit a failure PrivilegeUseEvent if the token's audit_policy has PRIVILEGE_USE_FAILURE (0x08), but do not call mark_used.