Slide 26 of 57
Notes:
Can sometimes change -ve authorisation to +ve authorisation by changing the constraint
Default negative is generally recommended - particularly for networked environments
Default positive or permissive can be used in closed trusted environments - home computers