A rule container may contain multiple rules which themselves consist of multiple conditions. The search therefore needs to follow a precise logic.
Search for valid rules
The rules are checked in the order in which they are entered in the rule container. The check determines whether the rule applies to the object (file or job variable) to be accessed. The name of the object which is to be accessed is successively compared with the object names in the 1st, 2nd ... nth rule in the rule container until a matching name is found or no further rules remain to be checked.
If a matching rule is found, the search in the rule container is discontinued. The corresponding default values are assigned. If the default value *BY-SYSTEM-STANDARD is specified for an attribute, the way in which the search is continued depends on the type of container in which the rule was found:
If the container is a user-specific rule container, the search for rule container continues with stage 2.
If the container is a pubset-global rule container then the usual system default value is assigned.
If no matching rule is located, the object is assigned the usual system default values.
Check of user ID list (system administration)
A rule in pubset-global rule containers can reference a user ID list (guard of the type DEFPUID). Two conditions must be met in this case for a rule to be recognized as suitable:
The object name of the rule must fit the name of the object to which defaults are to apply.
AND
The referenced user ID list must either contain a user ID that agrees with the user ID of the object to which defaults are to apply, or the referenced user ID list must contain a group ID for a group to which the user ID of the object to which defaults are to apply belongs.
If the user ID list is not accessible, the search is terminated with an error.
The following applies to the determination of the default values for protection attributes:
If the guard referenced in the identified rule is not available the search is aborted with an error.
The diagram below indicates the search strategy for the determination of default values:
Figure 20: Logic for determining default values using default protection