How to interpret the access policy in XACML

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="1" 
  RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" 
  Version="1.0">
    <Description>My First Policy </Description>
    <Target></Target>
    <Rule Effect="Permit" RuleId="Rule Permit #1">
      <Target>
        <AnyOf>
          <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
              <AttributeValue 
DataType="http://www.w3.org/2001/XMLSchema#string">http://www.defense.gov/area51
              </AttributeValue>
              <AttributeDesignator 
		AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
		Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" 
		DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true">
	      </AttributeDesignator>
            </Match>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue 
                DataType="http://www.w3.org/2001/XMLSchema#string">read
	      </AttributeValue>
              <AttributeDesignator 
		AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
		Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" 
		DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true">
	      </AttributeDesignator>
            </Match>
          </AllOf>
        </AnyOf>
      </Target>
      <Condition>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
            <AttributeValue  
              DataType="http://www.w3.org/2001/XMLSchema#string">fbi 
           </AttributeValue>
	   <AttributeValue 
	      DataType="http://www.w3.org/2001/XMLSchema#string">cia
            </AttributeValue>
          </Apply>
          <AttributeDesignator 
            AttributeId="group" 
	    Category="urn:oasis:names:tc:xacml:3.0:group" 
	    DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true">
          </AttributeDesignator>
        </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="Rule Deny #1"></Rule>
</Policy>