Minor fixes. For granting access at least ONE rule need to evaluate to TRUE instead of all.