The order that one access rule is checked, goes like that:

1. result=deny
2. If host matches any admit attribute: result=admit
3. If host matches any deny attribute: result=deny
4. return result.