The XACML XML is and'ing the blacklist entities. They should be treated as OR's since the guard query will ask for permit for a single blacklist.