In AMS, the access rights of a certain domain are expressed by one or more rules. A rule gives an individual user, or all users from a group, the permission to open, download, and/or read all resources of a certain type within a domain. A rule can also deny that permission. A rule contains the following elements:
a user or a group to which the rule applies;
the type of resource;
the permission or denial to access the node;
a priority of access;
an expiration date (optional);
When there is a rule on a certain node (in which case that rule applies to the entire domain of that node), it is also possible to create a rule on a descendant of that node. In this case, there would be two rules applying to the domain of the descendant (the latter created plus the one already applying to the parent node). Depending on the elements of these rules one of them is considered the 'strongest' and enforces its access rights. More on the calculation of the strongest rule as well as other topics can be found in Chapter 3.