<PolicySet PolicySetId="MyGridProvenancePolicySet" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:deny-overrides">
    <Description>
    	Policy set for accessing workflows and workflow runs.
    </Description>
    
    <Target>
      <Subjects>
        <AnySubject/>
      </Subjects>
      <Resources>
        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:regexp-string-match">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:lsid:www.mygrid.org.uk:experimentinstance:*</AttributeValue>
            <ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/>
          </ResourceMatch>
        </Resource>
        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:regexp-string-match">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:lsid:www.mygrid.org.uk:operation:*</AttributeValue>
            <ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/>
          </ResourceMatch>
        </Resource>
      </Resources>
      <Actions>
        <AnyAction/>
      </Actions>
    </Target>
    
    <Policy PolicyId="MyGridProvenanceReadPolicy"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides">
     <Description>
     	Permits reading workflows and workflow runs to:
     	1. supervisors if the runs where executed in the organization they belong to;
     	2. students if the runs where executed by themselves. 
     </Description>
     
     <Target>
      <Subjects>
        <AnySubject/>
      </Subjects>
      <Resources>
        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:regexp-string-match">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:lsid:www.mygrid.org.uk:experimentinstance:*</AttributeValue>
            <ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/>
          </ResourceMatch>
        </Resource>
        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:regexp-string-match">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:lsid:www.mygrid.org.uk:operation:*</AttributeValue>
            <ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/>
          </ResourceMatch>
        </Resource>
      </Resources>
      <Actions>
        <AnyAction/>
      </Actions>
     </Target>
     
     <Rule RuleId="ReadRule" Effect="Permit">
      <Target>
        <Subjects>
          <AnySubject/>
        </Subjects>
        <Resources>
          <AnyResource/>
        </Resources>
        <Actions>
          <Action>
            <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
              <ActionAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"/>
            </ActionMatch>
          </Action>
        </Actions>
      </Target>
      <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
       <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
      	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
        	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          		<SubjectAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="group"/>
        	</Apply>
        	<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">supervisors</AttributeValue>
        </Apply>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
        	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          		<SubjectAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="organization"/>
        	</Apply>
        	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          		<ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="experiment-organization"/>
        	</Apply>
        </Apply>
       </Apply>
       <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
      	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
        	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          		<SubjectAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="group"/>
        	</Apply>
        	<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">students</AttributeValue>
        </Apply>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
        	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          		<SubjectAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="experimenter"/>
        	</Apply>
        	<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          		<ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="experiment-experimenter"/>
        	</Apply>
        </Apply>
       </Apply>
      </Condition>
     </Rule>
	</Policy>

	<Policy PolicyId="MyGridProvenanceDenyPolicy"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
     <Description>
     	Denies read of all metadata to blacklisted experimenters.
     </Description>
     
     <Target>
      <Resources>
        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:regexp-string-match">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:lsid:www.mygrid.org.uk:*</AttributeValue>
            <ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/>
          </ResourceMatch>
        </Resource>
      </Resources>
     </Target>
     
     <Rule RuleId="DenyBadUsers" Effect="Deny">
      <Target>
        <Actions>
          <Action>
            <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
              <ActionAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                         AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"/>
            </ActionMatch>
          </Action>
        </Actions>
      </Target>
      <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          	<SubjectAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
                                      AttributeId="experimenter"/>
        </Apply>
        <!-- blacklisted experimenter -->
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:lsid:www.mygrid.org.uk:person:stu123</AttributeValue>
      </Condition>
     </Rule>
	</Policy>
	
</PolicySet>