code: private void enforce(ResponseCtx res) {
          @SuppressWarnings("unchecked")
          Set<Result> results = res.getResults();
          for (Result r : results) {
              if (r.getDecision() != Result.DECISION_PERMIT) {
                  if (logger.isDebugEnabled()) {
                      logger.debug("Denying access: " + r.getDecision());
                  }
                  switch (r.getDecision()) {
                      case Result.DECISION_DENY:
                          throw CXFUtility
                                  .getFault(new AuthzDeniedException("Deny"));
  
                      case Result.DECISION_INDETERMINATE:
                          throw CXFUtility
                                  .getFault(new AuthzDeniedException("Indeterminate"));
                      case Result.DECISION_NOT_APPLICABLE:
                          throw CXFUtility
                                  .getFault(new AuthzDeniedException("NotApplicable"));
                      default:
                  }
              }
          }
          if (logger.isDebugEnabled()) {
              logger.debug("Permitting access!");
          }
      }
docs: Method to check a response and enforce any denial. This is achieved by
  throwing an SoapFault.
  
  @param res
  the ResponseCtx