Major Description
Currently we only treat a null incoming resource string as a signal that * access is desired at that level. This causes empty string and "*" to be treated differently. When the policy is for excludes then we should not flip the access for these cases.