If ever the packet matches the first line for the ACL, the appropriate "permit" or "deny" action is steered.
Some controls are simply located in the wrong place - for instance, Every.11.7 Mobile computing and teleworking is present in section A.11 access control.