I finished looking at the code for WA_Auth_RulePasses($ruleName) in Security Assist.
The function WA_Auth_RulePasses($ruleName) returns WA_Auth_RuleObject_EvaluateRules($ruleName).
WA_Auth_RuleObject_EvaluateRules($ruleName) goes through and checks each statement for a true result and returns true if either of those two statements evaluates to true.
This is an OR operation and I don't see how it could ever work.
Is this a bug in the code or am I getting it wrong somehow?