<?xml version="1.0" encoding="UTF-8"?>
<Policy xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" urn:oasis:names:tc:xacml:2.0:policy:schema:os http://docs.oasis-open.org/xacml/access_control-xacml-2.0-policy-schema-os.xsd" xmlns:md="http://www.med.example.com/schemas/record.xsd" PolicyId="urn:oasis:names:tc:xacml:2.0:example:policyid:1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
	<PolicyDefaults>
		<XPathVersion>http://www.w3.org/TR/1999/Rec-xpath-19991116</XPathVersion>
	</PolicyDefaults>
	<Target/>
	<VariableDefinition VariableId="17590034">
		<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:example:attribute:patient-number" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<AttributeSelector RequestContextPath="//xacml-context:Resource/xacml-context:ResourceContent/md:record/md:patient/md:patient-number/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Apply>
	</VariableDefinition>
	<Rule RuleId="urn:oasis:names:tc:xacml:2.0:example:ruleid:1" Effect="Permit">
		<Description>
    A person may read any medical record in the
    http://www.med.example.com/schemas/record.xsd namespace
    for which he or she is the designated patient
  		</Description>
		<Target>
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
        http://www.med.example.com/schemas/record.xsd
      </AttributeValue>
						<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:resource:target-namespace" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:xpath-node-match">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
        /md:record
      </AttributeValue>
						<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:xpath" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
        read
      </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition>
			<VariableReference VariableId="17590034"/>
		</Condition>
	</Rule>
</Policy>

