diff --git a/docs/content/comparison-to-other-systems.md b/docs/content/comparison-to-other-systems.md index dc6c3c28f5..95b45cb955 100644 --- a/docs/content/comparison-to-other-systems.md +++ b/docs/content/comparison-to-other-systems.md @@ -362,65 +362,89 @@ allow ## XACML -eXtensible Access Control Markup Language (XACML) was designed to express security policies: allow/deny decisions using attributes of users, resources, actions, and the environment. -The following policy says that users from the organization Curtiss or Packard who are US or GreatBritain nationals and who work on DetailedDesign or Simulation are permitted access to documents about NavigationSystems. +eXtensible Access Control Markup Language (XACML) was designed to express security policies: allow/deny decisions using attributes of users, resources, actions, and the environment. +The following policy says that users from the organization Curtiss or Packard who are US or Great Britain nationals and who work on DetailedDesign or Simulation are permitted access to documents about NavigationSystems. ```xml - + Policy for Business Authorization category TAA-1.1 - - - - - NavigationSystem - - - - - - - + + - - - - - Any - - - + + + + NavigationSystem + + + + + + + + Packard + + + + + + Curtiss + + + + + + + + GB + + + + + + US + + + + + + + + DetailedDesign + + + + + + Simulation + + + + - - - - Curtiss - Packard - - - - - - US - GB - - - - - - DetailedDesign - Simulation - - - - - ``` @@ -431,21 +455,24 @@ roughly the same as for XACML: attributes of users, actions, and resources. ```live:xacml:module:openable package xacml +import future.keywords + +# METADATA +# title: urn:curtiss:ba:taa:taa-1.1 +# description: Policy for Business Authorization category TAA-1.1 +default permit := false permit { # Check that resource has a "NavigationSystem" entry input.resource["NavigationSystem"] - # Check that organization is one of the options (underscore implements "any") - org_options := ["Packard", "Curtiss"] - input.user.organization == org_options[_] + # Check that organization is one of the options + input.user.organization in ["Packard", "Curtiss"] - # Check that nationality is one of the options (underscore implements "any") - nationality_options := ["GB", "US"] - input.user.nationality == nationality_options[_] + # Check that nationality is one of the options + input.user.nationality in ["GB", "US"] - # Check that work_effort is one of the options (underscore implements "any") - work_options := ["DetailedDesign", "Simulation"] - input.user.work_effort == work_options[_] + # Check that work_effort is one of the options + input.user.work_effort in ["DetailedDesign", "Simulation"] } ```