// keep track of the first error, regardless of cause
if (firstIndeterminateStatus == null)
firstIndeterminateStatus = match.getStatus();
} else if (match.getResult() == MatchResult.MATCH) {
// now we evaluate the policy
Result result = policy.evaluate(context);
int effect = result.getDecision();
// this is a little different from DenyOverrides...
if (effect == Result.DECISION_PERMIT)