The policy allows or denies all values.
The policy can define specific values that are allowed or denied.