This Unsigned32 decides which access flow's rule wins when multiple access flows sharing one parent interface could match the same frame, the access-flow counterpart to the QoS-flow precedence object described earlier. An admin building a specific deny rule, for example blocking one protocol, must give it higher precedence than a broader allow-everything-else rule so the deny is actually evaluated first. Giving the Telnet-blocking flow a lower precedence number, meaning higher priority, than a general allow-all access flow on the same sub-port illustrates the ordering.