<?xml version="1.0"?>
<!--

    *******************************************************************************
    * Copyright © Temenos Headquarters SA 2021. All rights reserved.
    *******************************************************************************

-->
<PolicySet xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" Version="1.0" PolicySetId="LegalEntity" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-unless-permit">
	<Description/>
	<Target>
		<AnyOf>
			<AllOf>
				<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ADMIN</AttributeValue>
					<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:roleId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:subject" MustBePresent="true"/>
				</Match>
			</AllOf>
		</AnyOf>
	</Target>
	<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="permit-getServiceReqConfig" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
		<Description/>
		<PolicyDefaults>
			<XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
		</PolicyDefaults>
		<Target>
			<AnyOf>
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SERVICEREQUEST</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceManagerId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ServiceRequestConfiguration</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ENTITY</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceType" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
				</AllOf>
			</AnyOf>
		</Target>
		<Rule RuleId="rule-3P" Effect="Permit">
			<Description/>
			<Condition>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
						<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
							<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getServiceReqConfigV.*</AttributeValue>
							<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
								<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:OperationId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
							</Apply>
						</Apply>
					</Apply>
				</Apply>
			</Condition>
		</Rule>
		<ObligationExpressions>
			<ObligationExpression FulfillOn="Permit" ObligationId="filter-accounts">
				<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:1.0:action:combiningOperator" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Logical_OR</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:Operation" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">filter_in</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="legalEntityId" Issuer="issuer">
					<AttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:companyid"/>
				</AttributeAssignmentExpression>
			</ObligationExpression>
		</ObligationExpressions>
	</Policy>
	<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="permit-getRequestDetails" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
		<Description/>
		<PolicyDefaults>
			<XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
		</PolicyDefaults>
		<Target>
			<AnyOf>
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SERVICEREQUEST</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceManagerId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ServiceRequest</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ENTITY</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceType" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
				</AllOf>
			</AnyOf>
		</Target>
		<Rule RuleId="rule-3P" Effect="Permit">
			<Description/>
			<Condition>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
						<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
							<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getRequestDetailsV.*</AttributeValue>
							<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
								<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:OperationId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
							</Apply>
						</Apply>
					</Apply>
				</Apply>
			</Condition>
		</Rule>
		<ObligationExpressions>
			<ObligationExpression FulfillOn="Permit" ObligationId="filter-accounts">
				<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:1.0:action:combiningOperator" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Logical_OR</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:Operation" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">filter_in</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="legalEntityId" Issuer="issuer">
					<AttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:companyid"/>
				</AttributeAssignmentExpression>
			</ObligationExpression>
		</ObligationExpressions>
	</Policy>
	<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="permit-getAllRequestDetailsByRequestId" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
		<Description/>
		<PolicyDefaults>
			<XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
		</PolicyDefaults>
		<Target>
			<AnyOf>
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SERVICEREQUEST</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceManagerId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ServiceRequest</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ENTITY</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceType" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
				</AllOf>
			</AnyOf>
		</Target>
		<Rule RuleId="rule-3P" Effect="Permit">
			<Description/>
			<Condition>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
						<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
							<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getAllRequestDetailsByRequestIdV.*</AttributeValue>
							<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
								<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:OperationId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
							</Apply>
						</Apply>
					</Apply>
				</Apply>
			</Condition>
		</Rule>
		<ObligationExpressions>
			<ObligationExpression FulfillOn="Permit" ObligationId="filter-accounts">
				<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:1.0:action:combiningOperator" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Logical_OR</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:Operation" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">filter_in</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="legalEntityId" Issuer="issuer">
					<AttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:companyid"/>
				</AttributeAssignmentExpression>
			</ObligationExpression>
		</ObligationExpressions>
	</Policy>
	<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="permit-getServiceRequestBasedOnCriteria" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
		<Description/>
		<PolicyDefaults>
			<XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
		</PolicyDefaults>
		<Target>
			<AnyOf>
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SERVICEREQUEST</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceManagerId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ServiceRequest</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ENTITY</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceType" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
				</AllOf>
			</AnyOf>
		</Target>
		<Rule RuleId="rule-3P" Effect="Permit">
			<Description/>
			<Condition>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
						<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
							<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getServiceRequestBasedOnCriteriaV.*</AttributeValue>
							<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
								<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:OperationId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
							</Apply>
						</Apply>
					</Apply>
				</Apply>
			</Condition>
		</Rule>
		<ObligationExpressions>
			<ObligationExpression FulfillOn="Permit" ObligationId="filter-accounts">
				<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:1.0:action:combiningOperator" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Logical_OR</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:Operation" Issuer="issuer">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">filter_in</AttributeValue>
				</AttributeAssignmentExpression>
				<AttributeAssignmentExpression Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="legalEntityId" Issuer="issuer">
					<AttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:companyid"/>
				</AttributeAssignmentExpression>
			</ObligationExpression>
		</ObligationExpressions>
	</Policy>
</PolicySet>


