# Allow, Hold or Deny

> Apply the policy in the correct order.

[Canonical HTML page](https://trustcyber.ca/research/allow-hold-deny/lessons/04-policy-decisions/)

- Author: Junior Williams
- Type: Research companion addition

## Learning objective

Apply the policy in the correct order.

- [Original paper: §III.A · page 2](https://trustcyber.ca/research/allow-hold-deny/original.pdf#page=2)
Source pages: 2
## Read the rule before the action

**Allow** requires established authority and satisfied prerequisites. A prerequisite is a condition that must be true before permission applies. **Hold** applies when a relevant condition is missing, unresolved or unmet and no express prohibition governs the action. **Deny** applies when the rule expressly prohibits it. A prohibition takes precedence.

## A worked decision

A rule permits reading formulas in an authorized workbook without changing values or refreshing external links. The facts establish read-only handling but do not establish authorization for this workbook. Under the reviewed reading, that missing condition requires Hold. Read-only handling alone does not establish permission.

Use the activity below to establish the missing prerequisite. Hold becomes Allow when authority and prerequisites are both established. Then add an express prohibition: the decision becomes Deny.

<details><summary>Go deeper: a simplified decision tree</summary><p>First ask whether an express prohibition applies. If yes, Deny. Otherwise ask whether authority and every required condition are established. If yes, Allow; otherwise Hold. The browser example receives booleans already established by the reader. It does not interpret natural-language policy or verify outside facts.</p></details>

## Browser teaching tools

The canonical HTML page provides interactive controls. Its chapter explains their evidence, arithmetic, and limitations.
- [policy](https://trustcyber.ca/research/allow-hold-deny/lessons/04-policy-decisions/#explore-policy): Set prerequisites to Yes and watch Hold become Allow. Then set express prohibition to Yes and observe Deny.

## Interactive activities

Use the canonical HTML page for controls, live results and reset buttons.

## Check your understanding (optional)

Authority and prerequisites are established, but an express prohibition applies. Which decision follows?
- Deny: Correct. The policy gives express prohibition precedence.
- Allow: Meeting prerequisites does not override a prohibition.
- Hold: An established prohibition calls for Deny, rather than an unresolved condition.

## Take this forward

Next, see how the experiment turned written situations into a reviewed case bank.

## Reference material

- [policy](https://trustcyber.ca/research/allow-hold-deny/policy/index.md)

## Lesson navigation

- [Previous: Ideas behind the experiment](https://trustcyber.ca/research/allow-hold-deny/lessons/03-related-ideas/index.md)
- [Next: Build a reviewed case bank](https://trustcyber.ca/research/allow-hold-deny/lessons/05-cases-and-reference/index.md)

## Companion navigation

- [Overview](https://trustcyber.ca/research/allow-hold-deny/index.md)
- [Both authorization studies](https://trustcyber.ca/research/authorization/index.md)