<Policy PolicyId="Default-User-policy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:ordered-permit-overrides">
	<Target>
		<Subjects>
			<AnySubject/>
		</Subjects>
		<Resources>
			<AnyResource/>
		</Resources>
		<Actions>
			<Action>
				<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                     info:escidoc/names:aa:1.0:action:retrieve-container                     info:escidoc/names:aa:1.0:action:retrieve-context                     info:escidoc/names:aa:1.0:action:retrieve-item                     info:escidoc/names:aa:1.0:action:retrieve-content                     info:escidoc/names:aa:1.0:action:retrieve-organizational-unit                     info:escidoc/names:aa:1.0:action:retrieve-children-of-organizational-unit                     info:escidoc/names:aa:1.0:action:retrieve-parents-of-organizational-unit                     info:escidoc/names:aa:1.0:action:retrieve-content-model                     info:escidoc/names:aa:1.0:action:retrieve-content-relation                     info:escidoc/names:aa:1.0:action:unlock-container                     info:escidoc/names:aa:1.0:action:unlock-item                     info:escidoc/names:aa:1.0:action:logout                     info:escidoc/names:aa:1.0:action:retrieve-user-account                     info:escidoc/names:aa:1.0:action:retrieve-current-user-account                     info:escidoc/names:aa:1.0:action:update-user-account                     info:escidoc/names:aa:1.0:action:retrieve-objects-filtered                     info:escidoc/names:aa:1.0:action:retrieve-staging-file                     info:escidoc/names:aa:1.0:action:query-semantic-store                     info:escidoc/names:aa:1.0:action:retrieve-report                     info:escidoc/names:aa:1.0:action:retrieve-set-definition                     info:escidoc/names:aa:1.0:action:get-repository-info                     info:escidoc/names:aa:1.0:action:retrieve-grant                     info:escidoc/names:aa:1.0:action:create-grant                     info:escidoc/names:aa:1.0:action:revoke-grant                     info:escidoc/names:aa:1.0:action:retrieve-user-group-grant                     info:escidoc/names:aa:1.0:action:create-user-group-grant                     info:escidoc/names:aa:1.0:action:revoke-user-group-grant  					info:escidoc/names:aa:1.0:action:retrieve-registered-predicates                    info:escidoc/names:aa:1.0:action:retrieve-content-relation info:escidoc/names:aa:1.0:action:retrieve-role info:escidoc/names:aa:1.0:action:retrieve-user-group </AttributeValue>
					<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</ActionMatch>
			</Action>
		</Actions>
	</Target>
	<Rule RuleId="Default-User-policy-rule-0" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-content-model                         info:escidoc/names:aa:1.0:action:logout                         info:escidoc/names:aa:1.0:action:retrieve-objects-filtered                         info:escidoc/names:aa:1.0:action:retrieve-staging-file                         info:escidoc/names:aa:1.0:action:retrieve-report                         info:escidoc/names:aa:1.0:action:retrieve-set-definition                         info:escidoc/names:aa:1.0:action:get-repository-info 						info:escidoc/names:aa:1.0:action:retrieve-registered-predicates                         info:escidoc/names:aa:1.0:action:retrieve-current-user-account                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-1" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-container                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="info:escidoc/names:aa:1.0:function:string-contains">
			<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">released</AttributeValue>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:container:version-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-2" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-context                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="info:escidoc/names:aa:1.0:function:string-contains">
			<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">opened closed</AttributeValue>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:context:public-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-3" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-item                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="info:escidoc/names:aa:1.0:function:string-contains">
			<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">released</AttributeValue>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:item:version-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-4" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-content                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
						<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:component:item:public-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Apply>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">withdrawn</AttributeValue>
				</Apply>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:component:visibility" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">public</AttributeValue>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:component:item:version-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">released</AttributeValue>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-5" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-organizational-unit                         info:escidoc/names:aa:1.0:action:retrieve-children-of-organizational-unit                         info:escidoc/names:aa:1.0:action:retrieve-parents-of-organizational-unit                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="info:escidoc/names:aa:1.0:function:string-contains">
			<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">opened closed</AttributeValue>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:organizational-unit:public-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-5-1" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-content-relation                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="info:escidoc/names:aa:1.0:function:string-contains">
			<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">released</AttributeValue>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:content-relation:public-status" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-6" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:unlock-container                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:container:lock-owner" DataType="http://www.w3.org/2001/XMLSchema#string"/>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-7" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:unlock-item                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:item:lock-owner" DataType="http://www.w3.org/2001/XMLSchema#string"/>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-8" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-user-account                         info:escidoc/names:aa:1.0:action:retrieve-grant                     info:escidoc/names:aa:1.0:action:update-user-account                   </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="info:escidoc/names:aa:1.0:subject:handle" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="info:escidoc/names:aa:1.0:subject:login-name" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-8-1" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-user-group-grant </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="info:escidoc/names:aa:1.0:subject:group-membership" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-group:grant:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
		</Condition>
	</Rule>
		<Rule RuleId="Default-User-policy-rule-8-1-1" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-user-group </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="info:escidoc/names:aa:1.0:subject:group-membership" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-group:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-8-2" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-grant                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-account:grant:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-9" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:query-semantic-store                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-10" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                             info:escidoc/names:aa:1.0:action:create-grant                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-account:grant:assigned-on:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-account:grant:assigned-on" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-11" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                             info:escidoc/names:aa:1.0:action:create-user-group-grant                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-group:grant:assigned-on:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-12" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                             info:escidoc/names:aa:1.0:action:revoke-grant                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-account:grant:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-13" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                             info:escidoc/names:aa:1.0:action:revoke-user-group-grant                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
				<ResourceAttributeDesignator AttributeId="info:escidoc/names:aa:1.0:resource:user-group:grant:created-by" DataType="http://www.w3.org/2001/XMLSchema#string"/>
			</Apply>
		</Condition>
	</Rule>
	<Rule RuleId="Default-User-policy-rule-14" Effect="Permit">
		<Target>
			<Subjects>
				<AnySubject/>
			</Subjects>
			<Resources>
				<AnyResource/>
			</Resources>
			<Actions>
				<Action>
					<ActionMatch MatchId="info:escidoc/names:aa:1.0:function:string-contains">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">                         info:escidoc/names:aa:1.0:action:retrieve-role                         </AttributeValue>
						<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ActionMatch>
				</Action>
			</Actions>
		</Target>
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
						<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Apply>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
			<Apply FunctionId="info:escidoc/names:aa:1.0:function:string-contains">
				<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">escidoc:role-audience escidoc:role-collaborator-modifier-container-add-remove-any-members escidoc:role-collaborator-modifier-container-add-remove-members escidoc:role-collaborator-modifier-container-update-any-members escidoc:role-collaborator-modifier-container-update-direct-members escidoc:role-user-account-inspector escidoc:role-collaborator-modifier escidoc:role-collaborator escidoc:role-content-relation-manager escidoc:role-content-relation-modifier</AttributeValue>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
		</Condition>
	</Rule>
</Policy>
