
<Policy xmlns="urn:oasis:names:tc:xacml:1.0:policy" PolicyId="noObjectEditbyUserAndRole" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">  
          <Description>This is an object-specific policy. It could be stored inside the digital object in the POLICY datastream OR in the directory for object-specific policies. (The directory location is set in the Authorization module configuration in the Fedora server configuration file (fedora.fcfg). By using multiple policy Rules, this policy shows how to deny access to all raw datastreams in the object except to particular users (e.g., the object owners). It also shows how to deny access to a particular disseminations to selected user roles.</Description>  
          <Target> 
            <Subjects> 
              <AnySubject></AnySubject> 
            </Subjects>  
            <Resources> 
              <AnyResource></AnyResource> 
            </Resources>  
            <Actions> 
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-ingest</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-modifyDatastreamByReference</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-modifyDatastreamByValue</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-modifyDisseminator</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-modifyDisseminator</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-purgeObject</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action>      
           <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-purgeDatastream</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-purgeDisseminator</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-setDatastreamState</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-setDisseminatorState</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-setDatastreamVersionable</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-addDatastream</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action>  
              <Action> 
                <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-addDisseminator</AttributeValue>  
                  <ActionAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:action:id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator> 
                </ActionMatch> 
              </Action> 
            </Actions> 
          </Target>  
          <Rule Effect="Deny" RuleId="denyapi-except-to-user"> 
            <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:not"> 
              <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
                  <SubjectAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:subject:loginId" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"></SubjectAttributeDesignator>  
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">fedoraAdmin</AttributeValue>  
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">speare</AttributeValue> 
                  </Apply> 
                </Apply>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
                  <SubjectAttributeDesignator AttributeId="fedoraRole" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"></SubjectAttributeDesignator>  
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">administrator</AttributeValue>  
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Path Micro</AttributeValue> 
                  </Apply> 
                </Apply>
              </Apply>
            </Condition> 
          </Rule>  
          <Rule Effect="Permit" RuleId="3"></Rule> 
        </Policy>
