<?xml version="1.0" encoding="UTF-8"?>
<PolicySet
      xmlns="urn:oasis:names:tc:xacml:1.0:policy"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="urn:oasis:names:tc:xacml:1.0:policy
        cs-xacml-schema-policy-01.xsd"
      PolicySetId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:policyset"
      PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:first-applicable">
    <Description>
        PolicySet for Conformance Test IID022.
    </Description>
    <Target>
        <Subjects>
            <AnySubject/>
        </Subjects>
        <Resources>
            <AnyResource/>
        </Resources>
        <Actions>
            <AnyAction/>
        </Actions>
    </Target>
    <Policy
          PolicyId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:policy1"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
        <Description>
            Policy1 for Conformance Test IID022.
        </Description>
        <Target>
            <Subjects>
                <AnySubject/>
            </Subjects>
            <Resources>
                <AnyResource/>
            </Resources>
            <Actions>
                <AnyAction/>
            </Actions>
        </Target>
        <Rule
              RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:rule1"
              Effect="Deny">
            <Description>
                A subject whose name is J. Hibbert may not
                read Bart Simpson's medical record.  NOTAPPLICABLE
            </Description>
            <Target>
                <Subjects>
                    <Subject>
                        <SubjectMatch
                              MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue
                                  DataType="http://www.w3.org/2001/XMLSchema#string">J. Hibbert</AttributeValue>
                            <SubjectAttributeDesignator
                                  AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
                                  DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        </SubjectMatch>
                    </Subject>
                </Subjects>
                <Resources>
                    <AnyResource/>
                </Resources>
                <Actions>
                    <AnyAction/>
                </Actions>
            </Target>
        </Rule>
    </Policy>
    <Policy
          PolicyId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:policy2"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
        <Description>
            Policy2 for Conformance Test IID022.
        </Description>
        <Target>
            <Subjects>
                <AnySubject/>
            </Subjects>
            <Resources>
                <AnyResource/>
            </Resources>
            <Actions>
                <AnyAction/>
            </Actions>
        </Target>
        <Rule
              RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:rule2"
              Effect="Deny">
            <Description>
                A subject whose name is Julius Hibbert may not
                perform any action on any resource.  DENY.
            </Description>
            <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                    <SubjectAttributeDesignator
                          AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
                          DataType="http://www.w3.org/2001/XMLSchema#string"/>
                </Apply>
                <AttributeValue
                      DataType="http://www.w3.org/2001/XMLSchema#string">Julius Hibbert</AttributeValue>
            </Condition>
        </Rule>
    </Policy>
    <Policy
          PolicyId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:policy3"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
        <Description>
            Policy3 for Conformance Test IID022.
        </Description>
        <Target>
            <Subjects>
                <AnySubject/>
            </Subjects>
            <Resources>
                <AnyResource/>
            </Resources>
            <Actions>
                <AnyAction/>
            </Actions>
        </Target>
        <Rule
              RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:rule3"
              Effect="Permit">
            <Description>
                A subject whose "bogus" attribute is "Zaphod Beeblebrox"
                may perform any action on any resource.  INDETERMINATE.
            </Description>
            <Target>
                <Subjects>
                    <Subject>
                        <SubjectMatch
                              MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue
                                  DataType="http://www.w3.org/2001/XMLSchema#string">Zaphod Beeblebrox</AttributeValue>
                            <SubjectAttributeDesignator
                                  AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-tests:bogus"
                                  MustBePresent="true"
                                  DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        </SubjectMatch>
                    </Subject>
                </Subjects>
                <Resources>
                    <AnyResource/>
                </Resources>
                <Actions>
                    <AnyAction/>
                </Actions>
            </Target>
        </Rule>
    </Policy>
    <Policy
          PolicyId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:policy4"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
        <Description>
            Policy4 for Conformance Test IID022.
        </Description>
        <Target>
            <Subjects>
                <AnySubject/>
            </Subjects>
            <Resources>
                <AnyResource/>
            </Resources>
            <Actions>
                <AnyAction/>
            </Actions>
        </Target>
        <Rule
              RuleId="urn:oasis:names:tc:xacml:1.0:conformance-test:IID022:rule4"
              Effect="Permit">
            <Description>
                A subject who is at least 5 years older than Bart
                Simpson may read Bart Simpson's medical record. PERMIT.
            </Description>
            <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than-or-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-subtract">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                        <SubjectAttributeDesignator
                              AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:age"
                              DataType="http://www.w3.org/2001/XMLSchema#integer"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                        <EnvironmentAttributeDesignator
                              AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:bart-simpson-age"
                              DataType="http://www.w3.org/2001/XMLSchema#integer"/>
                    </Apply>
                </Apply>
                <AttributeValue
                      DataType="http://www.w3.org/2001/XMLSchema#integer">5</AttributeValue>
            </Condition>
        </Rule>
    </Policy>
</PolicySet>

