@Override
    public Boolean apply(final RegisteredServiceAccessStrategyRequest request) {
        if ((this.rejectedAttributes == null || this.rejectedAttributes.isEmpty())
            && (this.requiredAttributes == null || this.requiredAttributes.isEmpty())) {
            LOGGER.trace("Skipping access strategy policy, since no attributes rules are defined");
            return true;
        }
        if (!enoughAttributesAvailableToProcess(request)) {
            LOGGER.debug("Access is denied. There are not enough attributes available to satisfy requirements");
            return false;
        }
        if (doRejectedAttributesRefusePrincipalAccess(request)) {
            LOGGER.debug("Access is denied. The principal carries attributes that would reject service access");
            return false;
        }
        if (!doRequiredAttributesAllowPrincipalAccess(request, this.requiredAttributes)) {
            LOGGER.debug("Access is denied. The principal does not have the required attributes [{}]", this.requiredAttributes);
            return false;
        }
        return true;
    }
Defines the attribute aggregation behavior when checking for required attributes.
Default requires that all attributes be present and match the principal's.
core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/util/RegisteredServiceAccessStrategyEvaluator.java