As per the description, ConsensusBased policy of accessDecisionManager counts votes (grant and deny) for the user, and the final decision is based on what prevails.

So if the user has only ADMIN role and

<authorizationPolicy id="consensusBasedAdminPolicy" access="ROLE_ADMIN, ROLE_ADMIN1, ROLE_ADMIN2"

user should be denied (1 pro, 2 against).
But in fact, the user is granted access.

For details see SpringSecurityITCase test of tnb-test, for the time being, branch

CSB-4.x-CSB-1359

.