The framework supports almost any type of access control model. The model combination in ADF requires a metapolicy, which restrictively decides in cases of contradiction between model decisions.
Through the Runtime Module Registration facility (REG), decision modules as well as system calls or persistent generic lists can be added or removed at runtime, e.g. from a Loadable Kernel Module (LKM).
As a very important part, there is also a powerful logging system. Whether a decision is to be logged depends upon the request type and the decision, the user ID, the program running and the object that shall be accessed. Logging can be done with pseudonyms, thus providing some user privacy.