# IAM Policy Evaluation Logic

![](https://40640462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MQ39nPAiP6LTprAFu1T%2F-MSJzDdAW8OhAAKp7Ua2%2F-MSKxWJLo17I7OIT-6WK%2Fimage.png?alt=media\&token=4a8f920d-3531-4e99-be32-23d09245a703)

* The following is a **high-level summary of the AWS evaluation logic on those policies within a single account:**
  * **By default, all requests are implicitly denied**. (Alternatively, **by default, the AWS account root user has full access**.)<br>
  * **An explicit allow** in an identity-based or resource-based policy **overrides this default**.<br>
  * **If a permissions boundary, Organizations SCP, or session policy is present, it might override the allow with an implicit deny**.<br>
  * **An explicit deny in any policy overrides** any allows.
