<?xml version="1.0" encoding="UTF-8"?>
<Policy
      xmlns="urn:oasis:names:tc:xacml:1.0:policy"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="urn:oasis:names:tc:xacml:1.0:policy
        cs-xacml-schema-policy-01.xsd"
      PolicyId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID020:policy"
      RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
    <Description>
        Policy for Conformance Test IID020.
    </Description>
    <Target>
        <Subjects>
            <AnySubject/>
        </Subjects>
        <Resources>
            <AnyResource/>
        </Resources>
        <Actions>
            <AnyAction/>
        </Actions>
    </Target>
    <Rule
          RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID020:rule1"
          Effect="Deny">
        <Description>
            A subject whose name is J. Hibbert may not
            read Bart Simpson's medical record.  NOTAPPLICABLE
        </Description>
        <Target>
            <Subjects>
                <Subject>
                    <SubjectMatch
                          MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue
                              DataType="http://www.w3.org/2001/XMLSchema#string">J. Hibbert</AttributeValue>
                        <SubjectAttributeDesignator
                              AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
                              DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </SubjectMatch>
                </Subject>
            </Subjects>
            <Resources>
                <AnyResource/>
            </Resources>
            <Actions>
                <AnyAction/>
            </Actions>
        </Target>
    </Rule>
    <Rule
          RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID020:rule2"
          Effect="Permit">
        <Description>
            A subject who is at least 55 years older than Bart
            Simpson may read Bart Simpson's medical record. NOT-APPLICABLE.
        </Description>
        <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than-or-equal">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-subtract">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                    <SubjectAttributeDesignator
                          AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:age"
                          DataType="http://www.w3.org/2001/XMLSchema#integer"/>
                </Apply>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                    <EnvironmentAttributeDesignator
                          AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:bart-simpson-age"
                          DataType="http://www.w3.org/2001/XMLSchema#integer"/>
                </Apply>
            </Apply>
            <AttributeValue
                  DataType="http://www.w3.org/2001/XMLSchema#integer">55</AttributeValue>
        </Condition>
    </Rule>
    <Rule
          RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID020:rule3"
          Effect="Deny">
        <Description>
            A subject whose "test" attribute is Zaphod Beedlebrox may not
            perform any action on any resource.  INDETERMINATE.
        </Description>
        <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                <SubjectAttributeDesignator
                      AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:test"
                      DataType="http://www.w3.org/2001/XMLSchema#string"/>
            </Apply>
            <AttributeValue
                  DataType="http://www.w3.org/2001/XMLSchema#string">Zaphod Beedlebrox</AttributeValue>
        </Condition>
    </Rule>
</Policy>

