What order or in what way are the resource authorization policies applied?

I understand what RAP/CAP are and how they work and I know that the CAP are applied according to the order. The RAPs are not linked to a specific CAP. My question is how are the RAPs applied. You can obviously have a group or a nested group in one or more RAPs. So does the connection attempt (after it gets by the CAP) get compared to all the RAPs before it is denied? I have been searching for hours and have not been able to find anything on how the RAPs are applied. I have both server 2012 GWs and server 2008 R2.

Thanks,