How is "Deny Unless" Different From "Allow If" for Access Controls (ACLs)?

[G24]

The Certified Application Developer (CAD) Delta Exam Study Guide here discusses two different "Decision Types" for Access Controls (ACLs), as follows:

But I must be missing something, because these seem like exactly the same thing to me.  Example:

I am going to DENY you dessert UNLESS you eat your vegetables.

I am going to ALLOW you to have dessert IF you eat your vegetables.

What is the difference?  I don't get it.  Documentation here 

[Robbie]

Hi @G24,

I always find a step back (and grabbing a coffee) helps with these types of questions.

Essentially it's all about the default behaviour.

Whilst they seem similar at first glance, "Deny Unless" is more restrictive by default, denying access unless specific conditions are met, while "Allow If" is more permissive, granting access only if conditions are satisfied.

To help others (and for me to gain recognition for my efforts), please mark this response correct by clicking on Accept as Solution and/or Kudos.



Thanks, Robbie

[G24]

.

[AshishKM]

Thanks for this post @G24 , i was searching the doc and try to reach some conclusion before you reply @Robbie , thanks for explanation, it really helps to get the crux of words.

[TodT]

This first thing to understand is that the ACL engine will not grant access unless there is an Allow-If.

Second, Deny-Unless will be evaluated first. This means before all Allow-Ifs.

Third, anyone that does not satisfy the Deny-Unless will be denied, end of story.

Fourth, if I satisfy the Deny-Unless, it means I will not be denied. This does NOT mean I will be given access. It simply means I will not be denied by this rule. I would also need an allow-if to be granted access.

For your example,

I will not stop you from eating desert, if you have eaten all your vegetables.

I will give you desert, when you finish your vegetables.

Hopes this helps.