Concept - Open and Closed Policies

	Closed policy	Open policy
Rule	only allows accesses that are specifically authorized	allows all accesses except those expressly prohibited
Slide verdict	”most useful and most used"	"useful in some applications”

(s.9)

Also on s.9: administrative policies specify who can add, delete or modify authorization rules and also need access control and other mechanisms to enforce them.

Added context

The closed policy matches the “fail-safe default” idea in your Chapter 1 notes (access based on permission), but the slides do not draw that link.

Related: Concept - Least Privilege, Concept - Access Control. Appears in 04 Access Control - Chunk 01 (s.1-28).