diff --git a/core/lib/Drupal/Core/PageCache/ChainRequestPolicy.php b/core/lib/Drupal/Core/PageCache/ChainRequestPolicy.php
index 66e4c5f..23dc1d6 100644
--- a/core/lib/Drupal/Core/PageCache/ChainRequestPolicy.php
+++ b/core/lib/Drupal/Core/PageCache/ChainRequestPolicy.php
@@ -18,8 +18,8 @@
  *
  * <ol>
  *   <li>Returns static::DENY if any of the rules evaluated to static::DENY</li>
- *   <li>Returns static::ALLOW if any of the rules evaluated to
- *       static::ALLOW</li>
+ *   <li>Returns static::ALLOW if at least one of the rules evaluated to
+ *       static::ALLOW and none to static::DENY</li>
  *   <li>Otherwise returns NULL</li>
  * </ol>
  */
@@ -40,12 +40,11 @@ public function check(Request $request) {
 
     foreach ($this->rules as $rule) {
       $result = $rule->check($request);
-      if ($result === static::ALLOW) {
-        $final_result = $result;
+      if ($result === static::DENY) {
+        return $result;
       }
-      elseif ($result === static::DENY) {
+      elseif ($result === static::ALLOW) {
         $final_result = $result;
-        break;
       }
       elseif (isset($result)) {
         throw new \UnexpectedValueException('Return value of RequestPolicyInterface::check() must be one of RequestPolicyInterface::ALLOW, RequestPolicyInterface::DENY or NULL');