<?xml version="1.0" encoding="UTF-8"?>
<!--                                                                                                       -->
<!-- TNC MAP Content Authorization                                                                         -->
<!-- Suggested Authorization Policy for General Metadata                                                   -->
<!--                                                                                                       -->
<!-- 3 August 2014                                                                                         -->
<!--                                                                                                       -->
<!-- CONTACT: admin@trustedcomputinggroup.org                                                              -->
<!--                                                                                                       -->
<!-- Copyright (c) TCG 2014                                                                                -->
<!--                                                                                                       -->
<!--                                                                                                       -->
<!-- Licenses and Notices                                                                                  -->
<!--                                                                                                       -->
<!-- Definition: "source code" means this entire XML document, including the associated comments.          -->
<!--                                                                                                       -->
<!-- 1. Copyright Licenses:                                                                                -->
<!--                                                                                                       -->
<!-- Trusted Computing Group (TCG) grants to the user of this source code (the                             -->
<!-- "Source Code") a worldwide, irrevocable, nonexclusive, royalty free, copyright license to             -->
<!-- reproduce, create derivative works, distribute, display and perform the Policy and                    -->
<!-- derivative works thereof, and to grant others the rights granted herein.                              -->
<!--                                                                                                       -->
<!-- 2. Source Code Distribution Conditions:                                                               -->
<!--                                                                                                       -->
<!-- Redistributions of Source Code must retain the above copyright licenses, this list of conditions      -->
<!-- and the following disclaimers.                                                                        -->
<!--                                                                                                       -->
<!-- Redistributions in binary form must reproduce the above copyright licenses, this list of              -->
<!-- conditions and the following disclaimers in the documentation and/or other materials provided         -->
<!-- with the distribution.                                                                                -->
<!--                                                                                                       -->
<!-- 3. Disclaimers:                                                                                       -->
<!--                                                                                                       -->
<!-- THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF LICENSE OR                        -->
<!-- WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH RESPECT TO PATENT RIGHTS                   -->
<!-- HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES) THAT MAY BE NECESSARY TO IMPLEMENT                       -->
<!-- THIS SOURCE CODE OR OTHERWISE. Contact TCG Administration                                             -->
<!-- (admin@trustedcomputinggroup.org) for information on specification licensing                          -->
<!-- rights available through TCG membership agreements.                                                   -->
<!--                                                                                                       -->
<!-- THIS SOURCE CODE IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED WARRANTIES                            -->
<!-- WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A                                -->
<!-- PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR NONINFRINGEMENT OF INTELLECTUAL                        -->
<!-- PROPERTY RIGHTS, OR ANY WARRANTY OTHERWISE ARISING OUT OF ANY PROPOSAL,                               -->
<!-- SPECIFICATION OR SAMPLE.                                                                              -->
<!--                                                                                                       -->
<!-- Without limitation, TCG and its members and licensors disclaim all liability, including liability for -->
<!-- infringement of any proprietary rights, relating to use of information in this Source Code and to     -->
<!-- the implementation of this Source Code, and TCG disclaims all liability for cost of procurement       -->
<!-- of substitute goods or services, lost profits, loss of use, loss of data or any incidental,           -->
<!-- consequential, direct, indirect, or special damages, whether under contract, tort, warranty or        -->
<!-- otherwise, arising in any way out of use or reliance upon this Source Code or any information         -->
<!-- herein.                                                                                               -->
<!--                                                                                                       -->
<!-- Any marks and brands contained herein are the property of their respective owner.                     -->
<!--                                                                                                       -->
<!-- ***************************************************************************************************** -->
<!--                                                                         -->
<!-- This suggested General Policy permits the access that all foreseen use  -->
<!-- use cases require.                                                      -->

<Policy
  xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17
    http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"
  PolicyId="urn:oasis:names:tc:xacml:3.0:if-map:content:Policy:General"
  Version="1.0.1"
  RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides">

  <Target>
    <!-- 
         CUSTOMIZATION POINT: 

         To make this Policy apply only to a dry-run decision request,
         activate the <AnyOf> element that follows. To make this Policy
         apply only to a real and not a dry-run decision request,
         activate the <AnyOf> element and change its true to false. Either way,
         give the Policy a PolicyId that belongs to you.
     -->
    <!--
    <AnyOf>
      <AllOf>
        <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean"
            >true</AttributeValue>
          <AttributeDesignator 
            MustBePresent="false" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" 
            AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:environment:dry-run" 
            DataType="http://www.w3.org/2001/XMLSchema#boolean"/>
        </Match>
      </AllOf>
    </AnyOf>
     -->
  </Target>

  <!-- all-readers may read any metadata item. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:Unfettered:read"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >ifmap:all-reader</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:subject:role"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>

          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >read</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
              AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>


  <!-- all-writers may read and write any metadata item. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:Unfettered:write"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >ifmap:all-writer</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:subject:role"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>

  <!-- A MAP Client may purge its own metadata. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:purgePublisher:Permit"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >purgePublisher</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:action:request-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>

          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean"
              >true</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:action:purge-own-metadata"
              DataType="http://www.w3.org/2001/XMLSchema#boolean"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>

  <!-- CUSTOMIZATION POINT: If a MAP Client whose credentials were not individually
       entered into the MAP Server goes out of commission, it may not be
       reasonable for an Administrator to manually remove its metadata using
       the MAP Server's GUI or other administrative interface. Rather,
       for administrative efficiency, it may be preferable 
       for another MAP Client to purge the metadata. 

       In that case, add a Permit rule to permit a
       custom role to do purgePublisher even if purge-own-metadata is false.
    -->

  <!-- Any other purgePublisher request is denied. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:purgePublisher:Deny"
    Effect="Deny">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >purgePublisher</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:action:request-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>

  <!-- A client may read server-capability metadata -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:server-capability"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/IFMAP-SERVER/1#server-capability</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <VariableReference VariableId="read"/>
    </Condition>
  </Rule>

  <!-- A client may attach client-time metadata to a device identifier -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:operational-metadata:client-time"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2012/IFMAP-OPERATIONAL-METADATA/1#client-time</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="device-identifier"/>
        <VariableReference VariableId="not-link"/>
      </Apply>
    </Condition>        
  </Rule>

  <!-- A MAP Client may read and write device-characteristic on a link
       between its self identifier and the ifmap-client-catalog identifier.
       The discovery-method attribute must be "self-discovered". -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:NetworkSecurity:device-characteristic:self"
    Effect="Permit">

    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2#device-characteristic</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="is-self-identifier"/>
        <VariableReference VariableId="ifmap-client-catalog-identifier"/>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
            >self-discovered</AttributeValue>
          <AttributeDesignator
            MustBePresent="true"
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
            AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-attribute:discovery-method"
            DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </Apply>
      </Apply>
    </Condition>
  </Rule>

  <!-- A Client Role Administrator may read device-characteristic on a link
       adjacent to the ifmap-client-catalog identifier. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:NetworkSecurity:device-characteristic:client-role-administrator"
    Effect="Permit">

    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2#device-characteristic</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="read"/>
        <VariableReference VariableId="client-role-administrator"/>
        <VariableReference VariableId="ifmap-client-catalog-identifier"/>
      </Apply>
    </Condition>
  </Rule>

  <!-- Client Role Administrators may read and write ifmap-client-has-role metadata.
    -->

  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:MapContentAuthorization:client-role-administrator:role"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-has-role</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>

          <!-- One identifier must be a MAP client role-->
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-role</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:identifier-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="is-ifmap-client-identifier"/>
        <VariableReference VariableId="client-role-administrator-role"/>
      </Apply>
    </Condition>
  </Rule>

  <!-- A MAP Client may read ifmap-client-has-role metadata on a link adjacent
       to its self identifier. Thus it may learn its own roles. -->

  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:MapContentAuthorization:self"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-has-role</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="read"/>
        <VariableReference VariableId="is-self-identifier"/>
      </Apply>
    </Condition>
  </Rule>


  <!-- Client Role Administrators may read and write ifmap-client-has-task metadata.
    -->

  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:MapContentAuthorization:client-role-administrator:task"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-has-task</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="is-ifmap-client-identifier"/>
        <VariableReference VariableId="client-role-administrator-role"/>

        <!-- It must be applied to a link, but we don't specify what's at
             at the other end of the link. -->
        <AttributeDesignator
          MustBePresent="false"
          Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
          AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:on-link"
          DataType="http://www.w3.org/2001/XMLSchema#boolean"/>

      </Apply>
    </Condition>
  </Rule>

  <!-- A MAP Client may read ifmap-client-has-task metadata on a link adjacent
       to its self identifier. Thus it may learn its own tasks. -->

  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:MapContentAuthorization:task:self"
    Effect="Permit">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-has-task</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>

    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <VariableReference VariableId="read"/>
        <VariableReference VariableId="is-self-identifier"/>
      </Apply>
    </Condition>
  </Rule>

  <!-- All other attempts to access metadata from the 
       MAP Content Authorization 1.0 schema are denied. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:MapContentAuthorization:NamespaceDeny"
    Effect="Deny">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:3.0:function:string-starts-with">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>

  <!-- All other attempts to access operational metadata are denied. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:operational-metadata:NamespaceDeny"
    Effect="Deny">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:3.0:function:string-starts-with">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2012/IFMAP-OPERATIONAL-METADATA/1#</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>

  <!-- All other attempts to access metadata from the MAP Server schema are denied. -->
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:if-map:content:Rule:IFMAP-SERVER:NamespaceDeny"
    Effect="Deny">
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:3.0:function:string-starts-with">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
              >http://www.trustedcomputinggroup.org/2013/IFMAP-SERVER/1#</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:metadata-type"
              DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>

  <!-- Is the subject client an IF-MAP client role administrator? -->
  <VariableDefinition VariableId="client-role-administrator-role">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
        >tcg:client-role-administrator</AttributeValue>
      <AttributeDesignator
        MustBePresent="false"
        Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
        AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:subject:role"
        DataType="http://www.w3.org/2001/XMLSchema#string"/>
    </Apply>
  </VariableDefinition>

  <!-- Does the XACML request mention the ifmap-client-catalog identifier? -->
  <VariableDefinition VariableId="ifmap-client-catalog-identifier">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
          >http://www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-catalog</AttributeValue>
        <AttributeDesignator
          MustBePresent="false"
          Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
          AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:identifier-type"
          DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </Apply>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
          ></AttributeValue>
        <AttributeDesignator
          MustBePresent="true"
          Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
          AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:http%3A//www.trustedcomputinggroup.org/2013/MAP-CONTENT-AUTHORIZATION/1#ifmap-client-catalog:administrative-domain"
          DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </Apply>
    </Apply>
  </VariableDefinition>

  <!-- Does the XACML request mention a device identifier? -->
  <VariableDefinition VariableId="device-identifier">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
        >device</AttributeValue>
      <AttributeDesignator
        MustBePresent="false"
        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
        AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:identifier-type"
        DataType="http://www.w3.org/2001/XMLSchema#string"/>
    </Apply>
  </VariableDefinition>

  <!-- Does the XACML request mention the subject client's self identifier? -->
  <VariableDefinition VariableId="is-self-identifier">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:boolean-is-in">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean"
        >true</AttributeValue>
      <AttributeDesignator
        MustBePresent="false"
        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
        AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:is-self-identifier"
        DataType="http://www.w3.org/2001/XMLSchema#boolean"/>
    </Apply>
  </VariableDefinition>

  <!-- Does the XACML request mention a client identifier? -->
  <VariableDefinition VariableId="is-ifmap-client-identifier">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
          >identity</AttributeValue>
        <AttributeDesignator
          MustBePresent="false"
          Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
          AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:identifier-type"
          DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </Apply>

      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
          >ifmap:client</AttributeValue>
        <AttributeDesignator
          MustBePresent="true"
          Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
          AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:identity:attribute:administrative-domain"
          DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </Apply>
    </Apply>
  </VariableDefinition>

  <!-- Does the XACML request apply to an identifier (as against a link)? -->
  <VariableDefinition VariableId="not-link">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
      <AttributeDesignator
        MustBePresent="false"
        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
        AttributeId="urn:oasis:names:tc:xacml:3.0:if-map:content:resource:on-link"
        DataType="http://www.w3.org/2001/XMLSchema#boolean"/>
    </Apply>
  </VariableDefinition>

  <!-- Is this a read request? -->
  <VariableDefinition VariableId="read">
    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
        >read</AttributeValue>
      <AttributeDesignator
        MustBePresent="false"
        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
        AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
        DataType="http://www.w3.org/2001/XMLSchema#string"/>
    </Apply>
  </VariableDefinition>

</Policy>
