How export policies control client access to volumes or qtrees

Export policies contain one or more export rules that process each client access request. The result of the process determines whether the client is denied or granted access and what level of access. An export policy with export rules must exist on a Vserver for clients to access data.

You associate exactly one export policy with each volume or qtree to configure client access to the volume or qtree. A Vserver can contain multiple export policies. This enables you to do the following for Vservers with multiple volumes or qtrees:

•	Assign different export policies to each volume or qtree of a Vserver for individual client access control to each volume or qtree in the Vserver.

•	Assign the same export policy to multiple volumes or qtrees of a Vserver for identical client access control without having to create a new export policy for each volume or qtree.

If a client makes an access request that is not permitted by the applicable export policy, the request fails with a permission-denied message. If a client does not match any rule in the export policy, then access is denied. If an export policy is empty, then all accesses are implicitly denied.

You can modify an export policy dynamically on a system running Data ONTAP.