<policy-set> <!-- deny-overrides are default -->
<policy><rule></rule></policy> <!-- permit is default -->
</policy-set>
