Australia's high court has vetoed a decision to refuse a refugee a visa due to a negative security assessment.
The ruling said that a regulation not to grant a protection visa to a person deemed a security risk was invalid.
The Sri Lankan man has been detained since he arrived in December 2009. He was judged to be a refugee in 2010.
The ruling may have implications for more than 50 other refugees held in indefinite detention, Australia media reports say.
The group - mostly Sri Lankan nationals - have been given negative security assessments by the Australia Security Intelligence Organisation (ASIO).
They cannot be sent back to where they came from or to another country because of the assessment.
The court said in its ruling that the decision to deny the man a visa ''had not been made according to law''.
The 36-year-old man, identified only as ''M47'' in most media reports, was said to be a Tamil.
In June 2010, he applied for a protection visa. Immigration officials found that he had a valid reason to fear persecution in Sri Lanka and so he was considered a refugee.
However, a visa was not granted because the ASIO had assessed him to be a security risk.
On Friday the man's lawyer, David Manne, called the high court decision a ''significant victory''.
"What should happen now is that the government should urgently process his visa... grant him a refugee visa and grant him his freedom so that he can rebuild his life," Mr Manne told reporters.