code: protected void evaluateFinalAuthentication(final AuthenticationBuilder builder,
                                                 final AuthenticationTransaction transaction,
                                                 final Set<AuthenticationHandler> authenticationHandlers) throws AuthenticationException {
          if (builder.getSuccesses().isEmpty()) {
              publishEvent(new CasAuthenticationTransactionFailureEvent(this, builder.getFailures(), transaction.getCredentials()));
              throw new AuthenticationException(builder.getFailures(), builder.getSuccesses());
          }
  
          val authentication = builder.build();
          val failures = evaluateAuthenticationPolicies(authentication, transaction, authenticationHandlers);
          if (!failures.getKey()) {
              publishEvent(new CasAuthenticationPolicyFailureEvent(this, builder.getFailures(), transaction, authentication));
              failures.getValue().forEach(e -> handleAuthenticationException(e, e.getClass().getSimpleName(), builder));
              throw new AuthenticationException(builder.getFailures(), builder.getSuccesses());
          }
      }
docs: Evaluate produced authentication context.
  We apply an implicit security policy of at least one successful authentication.
  Then, we apply the configured security policy.
  
  @param builder                the builder
  @param transaction            the transaction
  @param authenticationHandlers the authentication handlers
  @throws AuthenticationException the authentication exception