<policy-set combine="first-matching-target">
<policy combine="first-applicable"><rule effect="deny"></rule></policy>
</policy-set>
