An addition to the Errata for the next release:

p. 135, line 5312-5320 of XACML 2.0 Core Spec: The textual description of the Permit-Overrides PolicyCombiningAlg omits the case where "Deny" is returned. Correct order should be:

IF any child policy evaluates to "Permit", RETURN "Permit" ELSE IF any child policy evaluates to "Deny", RETURN "Deny" ELSE IF any child policy evaluates to "Indeterminate", RETURN "Indeterminate" ELSE RETURN "NotApplicable"

The pseudo-code includes that case.

Regards, Anne