If a resource type does have an accessControlPolicyIDs attribute definition , but the ( optional ) accessControlPolicyIDs attribute value is not set in a resource instance , then the Hosting CSE shall apply the concept of the default access policy . The default policy shall provide unrestricted access only to the Originator of the successful resource creation request . All other entities shall be denied to access the resource . For that purpose , the Hosting CSE shall keep that Originator information of the resource . Note that how to keep that information is implementation specific . The default access policy is not applied to a resource which has a value assigned to the accessControlPolicyIDs 　 attribute .