.. _security-voters-change-strategy:

Changing theAccessDecision Strategy

Changing the Decision Strategy

decision strategy, which, by default, grants accessif*any* voter grants

access.

you have one voter that checksifthe user is a member of the site and a second

one checking if the user is older than 18.

In this case, choose the ``unanimous`` strategy. Unlike the ``affirmative``

strategy (the default), with the ``unanimous`` strategy, if only one voter

denies access (e.g. the ``ClientIpVoter``), access is not granted to the

end user.

To handle these cases, the access decision manager uses a decision strategy.

You can configure this to suite your needs. There are three strategies

available:

To do that, override the default ``access_decision_manager`` section of your

application configuration file with the following code.

``affirmative`` (default)

This grants access as soon as there is *one* voter granting access;

``consensus``

This grants access if there are more voters granting access than denying;

``unanimous``

This only grants access once *all* voters grant access.

In the above scenario, both voters should grant access in order to grant access

to the user to read the post. In this case, the default strategy is no longer

valid and ``unanimous`` should be used instead. You can set this in the

security configuration:

..configuration-block::

..code-block::xml

..code-block::php

That's it! Now, when deciding whether or not a user should have access,

the new voter will deny access to any user in the list of blacklisted IPs.

Note that the voters are only called, if any access is actually checked. So

you need at least something like

..configuration-block::

..code-block::yaml

..code-block::xml

..code-block::php

..seealso::

For a more advanced usage see:ref:`components-security-access-decision-manager`.