<?xml version="1.0" encoding="UTF-8"?>
<Policy
xmlns="http://www.rubix.com/2008/RXSPMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.rubix.com/2008/RXSPMLSchema ../common-scripts/RXSPMLSchema.xsd"
PolicyId="xdomain-select" 
RuleCombiningAlgId="ordered-permit-overrides">

	<Description>
		Allow domain2 user restricted select access to domain2 table. 
		Only see rows with pay_grade less than 10 
		The organization field will be set to "US Government"
		Rows selected will be audited including the name column
	</Description>

	<Target>
	  <Subjects> <Subject>
	      <SubjectMatch MatchId="equal">
	         <AttributeValue DataType="label">C Baker</AttributeValue>
		    <SubjectAttributeDesignator AttributeId="session-label"/>
	      </SubjectMatch>	
    </Subject> </Subjects>
	  <Actions> <Action>
	  	<ActionMatch MatchId="equal">
			<AttributeValue DataType="string">row-select</AttributeValue>
		<ActionAttributeDesignator AttributeId="action-id"/>
	  	</ActionMatch>	
	  </Action> </Actions> 
	</Target>

	<Rule RuleId="allow-select" Effect="Permit">
	   <Target/>
	   <Condition>
	      <Apply FunctionId="less-than">
					<AttributeSelector RequestContextPath="db.cat.sch.tab.pay_grade" DataType="integer"/>
					<AttributeValue DataType="integer">10</AttributeValue>
        </Apply>
	   </Condition>
	</Rule>

	<Obligations>

	   <Obligation FulfillOn="Permit" ObligationId="set-field">
	      <AttributeValue DataType="string">db.cat.sch.tab.organization</AttributeValue>
	      <AttributeValue DataType="string">US Government</AttributeValue>
           </Obligation>

	   <Obligation FulfillOn="Permit" ObligationId="audit">
	      <AttributeSelector RequestContextPath="db.cat.sch.tab.name" DataType="string"/>
	   </Obligation>

        </Obligations>

</Policy>
