ALFA (XACML)

	namespace exampleBoolean{
		policy article{
			target clause userRole == "editor" and actionId == "edit" and itemType=="article"
			apply firstApplicable
			rule publishedArticles{
				target clause published == true
				permit
			}
		}
	}

	attribute userBlacklistedResources{
		category = subjectCat
		id = "userBlacklistedResources"
		type = string
	}
	
	rule allowProfileAccess{
		target clause url == "http://<host>:<port>/profile/":anyURI
		permit
	}

	namespace example{
		policy article{
			target clause itemType=="article"
			apply firstApplicable
			rule editArticle{
				target clause actionId == "edit" and userRole == "editor"
				permit
				condition userId == owner
			}
		}
	}

	namespace exampleTime{
		policy checkTimeAccess {
			apply firstApplicable
		  	rule checkNightAccess {
	   			target clause role == "supervisor" and document = "medicalrecord"
	   			condition timeInRange(timeOneAndOnly(currentTime), "22:00:00":time, "06:00:00":time)
				permit
			}
	  	}
	}

namespace com.axiomatics{
	namespace example{
		/**
		 * A policy about what managers can do. It is linked to from the
		 * documents policy set.
		 */
		policy managers{
			target clause role == "manager"
			apply firstApplicable
			rule allowSameDepartment{
				condition user.department == document.department
				permit
			}
		}
	}
	
	/**
	 * The main policy. It references the managers policy
	 */
	policyset documents{
		target clause resourceType == "document"
		apply firstApplicable
		// The following is a policy reference
		example.managers
	}
}

namespace com.axiomatics.examples{
	
	import Attributes.*
	
	obligation breakTheGlass = "com.axiomatics.examples.breakTheGlass"
	obligation auditLog = "com.axiomatics.examples.auditLog"
	
	namespace user{
		attribute role{
			category = subjectCat
			id = "com.axiomatics.examples.user.role"
			type = string
		}
		attribute identifier{
			category = subjectCat
			id = "com.axiomatics.examples.user.identifier"
			type = string
		}
	}
	namespace patient{
		attribute assignedDoctor{
			category = resourceCat
			id = "com.axiomatics.examples.user.assignedDoctor"
			type = string
		}
	}
	namespace record{
		attribute identifier{
			category = resourceCat
			id = "com.axiomatics.examples.record.identifier"
			type = string
		}
	}
	attribute actionId{
		category = actionCat
		id = "com.axiomatics.examples.actionId"
		type = string
	}
	attribute objectType{
		category = resourceCat
		id = "com.axiomatics.examples.objectType"
		type = string
	}
	attribute isEmergency{
		category = environmentCat
		id = "com.axiomatics.examples.isEmergency"
		type = boolean
	}
	attribute message{
		category = environmentCat
		id = "com.axiomatics.examples.message"
		type = boolean
	}

	/**
	 * Control access to medical records
	 */
	policy accessMedicalRecord{
		target clause actionId == "view" and objectType == "medical record"
		apply firstApplicable
		/**
		 * Doctors can view medical records of patients they are assigned to
		 */
		rule allowRegularAccess{
			target clause user.role == "doctor"
			condition patient.assignedDoctor == user.identifier
			permit
		}
		/**
		 * Doctors can view any medical reason in the case of an emergency
		 */
		rule allowBreakTheGlassAccess{
			target clause isEmergency == true
			permit
			on permit{
				obligation auditLog{
					message = "A doctor has gotten access to a medical record by breaking the glass"
					user.identifier = user.identifier
					record.identifier = record.identifier
					currentDateTime = currentDateTime
				}
				
			}
		}
		/**
		 * Deny other accesses. If access is normally denied, tell doctors how
		 * they can get access by "breaking the glass".
		 */
		rule denyAccess{
			deny
			on deny{
				obligation breakTheGlass{
					message = "You do not have access to this medical record. To be granted access, set the isEmergency flag to true."
					record.identifier = record.identifier
					currentDateTime = currentDateTime
				}
			}
		}
	}
}

rule allowAfter5pm{		
	permit
	condition currentTime > "17:00:00":time
}

	/*
	 * Access Control Based on Category of Action
	 * URL: http://wiki.hl7.org/index.php?title=Security_and_Privacy_Ontology_Use_Cases#Access_Control_Based_on_Category_of_Action
	 * Access to progress notes
	 */
	policy progressNotes{
		target clause objectType=="progress note"
		apply firstApplicable
		/*
		 * A primary physician can create a patient's progress note
		 */
		rule createNote{
			target clause role=="physician" and action=="create"	
			condition primaryPhysician==requestorId
			permit
		}
		/*
		 * A physician can update a patient's progress note he/she wrote themselves
		 */
		rule updateNote{
			target clause role=="physician" and action=="update"
			condition author==requestorId
			permit
		}
		/*
		 * Safety rule to explicitly deny access unless one of the matching rules above has been matched
		 */
		rule safetyHarness{
			deny
		}
	}