<?xml version="1.0" encoding="UTF-8"?>
<!-- which role has access to which type of contact how long if no other restriction is done by the citizen -->
<Policy PolicyId="urn:elga:bes:2013:1.2.3.3.1.102.1" 
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
    <Target/>
    <Rule RuleId="urn:elga:bes:2013:1.2.3.3.1.102.1.2.1" Effect="Permit">
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                        <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" 
                            DataType="http://www.w3.org/2001/XMLSchema#double"/>
                    </Apply>
                    <!-- value in seconds - 28 days -->
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">2419200</AttributeValue>
                </Apply>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                    <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" 
                        DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                        <!-- Arzt -->
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">700</AttributeValue>
                        <!-- Zahnarzt -->
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">701</AttributeValue>
                        <!-- Krankenanstalt -->
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">702</AttributeValue>
                    </Apply>
                </Apply>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                    <SubjectAttributeDesignator AttributeId="urn:elga:bes:kbtype" 
                        DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
                            K101</AttributeValue>
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
                            K103</AttributeValue>
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
                            K102</AttributeValue>
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
                            K104</AttributeValue>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>
    <!-- the role 'Apotheke' has only limited permission to contact type 'AmbulanterKontakt' for 2 hours -->
    <Rule RuleId="urn:elga:bes:2013:1.2.3.3.1.102.1.2.2" Effect="Permit">
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                        <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" 
                            DataType="http://www.w3.org/2001/XMLSchema#double"/>
                    </Apply>
                    <!-- value in seconds - 2 hours -->
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">7200</AttributeValue>
                </Apply>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                    <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" 
                        DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                        <!-- Apotheke -->
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">704</AttributeValue>
                    </Apply>
                </Apply>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                    <SubjectAttributeDesignator AttributeId="urn:elga:bes:kbtype" 
                        DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
                            K102</AttributeValue>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>
    <Rule RuleId="denyAll" Effect="Deny"/>
</Policy>
