“CBAC”的版本间的差异

来自智能法律合约
跳到导航 跳到搜索
第2行： 第2行：
 
<meta property="mw:pageNamespace" content="0" />
 
<meta property="mw:pageNamespace" content="0" />
  
−
<meta property="mw:revisionSHA1" content="256a4cfa7999ae45eb97cc5690cc00c9c38a6705" />
+
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" />
−
<meta property="dc:modified" content="2026-08-30T23:08:30.000Z" />
+
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" />
 
<meta property="mw:html:version" content="2.1.0" />
 
<meta property="mw:html:version" content="2.1.0" />
 
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
 
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
 
<meta http-equiv="content-language" content="zh-cn" />
 
<meta http-equiv="content-language" content="zh-cn" />
 
<meta http-equiv="vary" content="Accept" />
 
<meta http-equiv="vary" content="Accept" />
−
= 概述
+
<meta charset="utf-8" />
 +
 
 +
=  
 
<meta property="mw:pageId" content="75" />
 
<meta property="mw:pageId" content="75" />
 
<meta property="mw:pageNamespace" content="0" />
 
<meta property="mw:pageNamespace" content="0" />
  
−
<meta property="mw:revisionSHA1" content="256a4cfa7999ae45eb97cc5690cc00c9c38a6705" />
+
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" />
−
<meta property="dc:modified" content="2026-08-30T23:08:30.000Z" />
+
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" />
 
<meta property="mw:html:version" content="2.1.0" />
 
<meta property="mw:html:version" content="2.1.0" />
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] =
+
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]顺序 =
 +
 
 +
target term
 +
 
 +
               │ 只做资源级适用性判断，不引用具体 comb
 +
 
 +
               ▼  （编译器自动按 Request::Act.actionId 查找对应 comb；  （无 comb 则找同动作 rule_target））
 +
 
 +
comb term（组合入口，针对一类动作）
 +
 
 +
               │ 在 when 中 evalTerm(rule_target, Request) = Permit
 +
 
 +
               ▼
 +
 
 +
rule_target term（动作、rule级obligation、rule级target、伴随、后置）
 +
 
 +
              │ 在 when 中 evalTerm(rule_condition, Request) = Permit
 +
 
 +
             ▼
 +
 
 +
rule_condition term（condition和返回）
 +
 
 +
 
 +
=例1：sample6=
 +
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
 +
 
 +
说明：多rule合并
 +
==原文：==
 +
<syntaxhighlight lang="xml">
 +
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr"
 +
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
 +
  <Description>Test Or</Description>
 +
  <Target></Target>
 +
  <Rule Effect="Permit" RuleId="primary-group-emps-rule"> 
 +
      <Target>
 +
        <AnyOf>
 +
            <AllOf>
 +
              <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 +
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 +
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
 +
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
 +
              </Match>
 +
            </AllOf>
 +
        </AnyOf>
 +
      </Target>
 +
      <Condition>
 +
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
 +
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string"
 +
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
 +
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
 +
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
 +
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
 +
            </Apply>
 +
        </Apply>
 +
      </Condition>
 +
  </Rule>
 +
  <Rule Effect="Permit" RuleId="primary-user-rule">
 +
      <Condition>
 +
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
 +
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
 +
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
 +
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
 +
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
 +
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
 +
            </Apply>
 +
        </Apply>
 +
      </Condition>
 +
  </Rule>
 +
  <Rule Effect="Deny" RuleId="deny-rule"></Rule>
 +
</Policy>
 +
</syntaxhighlight>
 +
==逻辑结构：==
 +
Policy (组合: first-applicable)
 +
 
 +
├── Target = 空
 +
 
 +
├── Rule1 (Permit)
 +
 
 +
│ ├── Target: action-id = read
 +
 
 +
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集
 +
 
 +
├── Rule2 (Permit)
 +
 
 +
│ ├── Target: 无
 +
 
 +
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集
 +
 
 +
└── Rule3 (Deny) 兜底
 +
 
 +
==原始请求等效json：==
 +
{
 +
  "sub": {
 +
    "subjectId": "anyone",
 +
    "groups": []
 +
  },
 +
  "act": {
 +
    "actionId": "read"
 +
  },
 +
  "obj": {
 +
    "resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"
 +
  }
 +
}
 +
 
 +
==转换版：==
 +
contract Sample6_RoleAccess {
 +
 
 +
    party Platform {
 +
 
 +
        name: String
 +
 
 +
        targetMatch(Request)
 +
 
 +
    }
 +
 
 +
    asset Resource {
 +
 
 +
        resourceId: String
 +
 
 +
    }
 +
 
 +
    addition Request {
 +
 
 +
        Sub: Subject
 +
 
 +
        Obj: Resource
 +
 
 +
        Act: Action
 +
 
 +
    }
 +
 
 +
    ## Type(match)
 +
 
 +
    term policy_target: Platform must targetMatch(Request)
 +
 
 +
        when true
 +
 
 +
        where return Permit
 +
 
 +
 
 +
    ## Type(comb)
 +
 
 +
    term policy_comb: Sub can access Resource
  
−
[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]1、主体
+
        when some of(evalTerm(rule_target_1, Request),
−
<meta property="mw:pageId" content="75" />
 
−
<meta property="mw:pageNamespace" content="0" />
 
  
−
<meta property="mw:revisionSHA1" content="256a4cfa7999ae45eb97cc5690cc00c9c38a6705" />
+
                     evalTerm(rule_target_2, Request)) = Permit
−
<meta property="dc:modified" content="2026-08-30T23:08:30.000Z" />
 
−
<meta property="mw:html:version" content="2.1.0" />
 
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]注册时签[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]主体合约，资源托管时签客体合约；两份合约放入同一个 policySet，按业务场景组合
 
  
−
- policySet 是未签署的组合框架，policy 是一份已签署合约
+
        where return Permit
  
−
- CBAC 是主文档，主体合约 + 客体合约，两份都签署
 
  
−
- SPESC 是执行投影。判决投影管 Permit/Deny，执行投影管付费、分账、违约
+
    term rule_target_1: Sub can read Resource
  
−
- 因为 SPESC 本身只有立约和付款，装不下访问控制和角色派生，CBAC 补这一层
+
        when ATTR(Request::Act, actionId) = "read"
  
−
2、原始 SPESC 格式不能破坏，只能追加：
+
          and evalTerm(rule_condition_1, Request) = Permit
  
−
- party / asset / term 原样保留
+
        where return Permit
  
−
- term 管法律权利义务
 
  
−
- access 管访问控制判决
+
    term rule_condition_1:
  
−
3、关联：
+
        when some g in ATTR(Request::Sub, groups)
  
−
- policy 里的 party / asset 是属性字典，给 access 提供 subject.role、resource.type 这类取值
+
            such that g = "admin_emps" or g = "admin"
  
−
- policySet 里的 request 是统一输入，告诉引擎 subject 对应谁、resource 对应谁
+
        where return Permit
  
−
- 授权/角色派生 SPESC 没有，所以 term 动作带实参，是显式扩展。
 
  
−
- term 的授权动作调用先执行，把角色派生结果交给 access 用
+
    term rule_target_2: Sub can access Resource
  
−
4、找到的xacml没有托管合约下的语义，于是Platform 义务按需补，简单例子就只留 party/asset/term/access。
+
        when evalTerm(rule_condition_2, Request) = Permit
  
−
5、后续使用：
+
        where return Permit
  
−
- 授权中心按 sub/obj 找到两份合约
 
  
−
- 请求只带 Subid / Objid / Act
+
    term rule_condition_2:
  
−
- 判决引擎只读 access和授权动作调用派生的属性，不读 term 的 must / while / where / breach
+
        when ATTR(Request::Obj, resourceId) in {
  
−
- term 的付费、分账、违约留给 SPESC 投影
+
            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",
  
−
- Permit 后生成具体 SPESC，再发 token；资源中心验 token 放行；放行后触发链上具体 SPESC 执行
+
            "<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"
  
−
- 判决和执行读同一份主文档，但读的部分不同，所以视图一致性用双 AST 检查兜底
+
        }
  
−
<meta charset="utf-8" />
+
        where return Permit
−
<title>CBAC</title>
 
  
−
=例1：基础policy，OASIS 规范正式例子的起点=
+
}
−
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096
 
  
−
语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）
+

 +
=例2：OASIS 3-4=
 +
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502
 +
 
 +
语法：双target，有obligation
 
==原文：==
 
==原文：==
 
<syntaxhighlight lang="xml">
 
<syntaxhighlight lang="xml">
−
<?xml version="1.0" encoding="UTF-8"?>
+
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
−
<Policy
+
    PolicyId="copyright-approve"
−
  xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
+
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
−
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+
    Version="1">
−
  xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17
+
    <Description>Example copyright material policy</Description>
−
  http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"
+
 
−
  PolicyId="urn:oasis:names:tc:xacml:3.0:example:SimplePolicy1"
+
    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
−
  Version="1.0"
 
−
  RuleCombiningAlgId="identifier:rule-combining-algorithm:deny-overrides">
 
−
  <Description>
 
−
    Medi Corp access control policy
 
−
  </Description>
 
−
  <Target/>
 
−
  <Rule
 
−
    RuleId="urn:oasis:names:tc:xacml:3.0:example:SimpleRule1"
 
−
    Effect="Permit">
 
−
    <Description>
 
−
      Any subject with an e-mail name in the med.example.com domain
 
−
      can perform any action on any resource.
 
−
    </Description>
 
 
     <Target>
 
     <Target>
−
      <AnyOf>
+
        <AnyOf>
−
        <AllOf>
+
            <AllOf>
−
          <Match
+
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
−
            MatchId="urn:oasis:names:tc:xacml:1.0:function:rfc822Name-match">
+
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
−
            <AttributeValue
+
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
−
              DataType="http://www.w3.org/2001/XMLSchema#string"
+
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
−
              >med.example.com</AttributeValue>
+
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
−
            <AttributeDesignator
+
                </Match>
−
              MustBePresent="false"
+
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
−
              Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
+
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
−
              AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
+
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
−
              DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name"/>
+
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
−
          </Match>
+
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
−
        </AllOf>
+
                </Match>
−
      </AnyOf>
+
            </AllOf>
 +
        </AnyOf>
 
     </Target>
 
     </Target>
−
  </Rule>
+
 
 +
    <!-- 规则级 Target：资源 ip-owner = Acme -->
 +
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
 +
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
 +
        <Target>
 +
            <AnyOf>
 +
                <AllOf>
 +
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 +
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 +
                    </Match>
 +
                </AllOf>
 +
            </AnyOf>
 +
        </Target>
 +
 
 +
        <!-- Condition：以下 5 个条件全部成立才 Permit -->
 +
        <Condition>
 +
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
 +
                <!-- ① 请求方组织 = Wiley Corp -->
 +
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 +
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
 +
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 +
                    </Apply>
 +
                </Apply>
 +
                <!-- ② 主体协议号 = 资源协议号 -->
 +
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
 +
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 +
                    </Apply>
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 +
                    </Apply>
 +
                </Apply>
 +
                <!-- ③ 资源被许可方 = Wiley Corp -->
 +
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 +
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 +
                    </Apply>
 +
                </Apply>
 +
                <!-- ④ 当前时间 >= 生效时间 -->
 +
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
 +
                    </Apply>
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
 +
                    </Apply>
 +
                </Apply>
 +
                <!-- ⑤ 当前时间 < 过期时间 -->
 +
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
 +
                    </Apply>
 +
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
 +
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
 +
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
 +
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
 +
                    </Apply>
 +
                </Apply>
 +
            </Apply>
 +
        </Condition>
 +
    </Rule>
 +
 
 +
    <!-- Permit 时要求 PEP：加标记 + 加密 -->
 +
    <ObligationExpressions>
 +
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
 +
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
 +
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
 +
            </AttributeAssignmentExpression>
 +
        </ObligationExpression>
 +
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
 +
    </ObligationExpressions>
 
</Policy>
 
</Policy>
 
</syntaxhighlight>
 
</syntaxhighlight>
 
==逻辑结构：==
 
==逻辑结构：==
−
Policy SimplePolicy1 (deny-overrides)  
+
Policy copyright-approve (deny-overrides)  
  
−
├── Target = 空（适用于所有请求）
+
├── Target: resource:copyright = true
  
−
└── Rule SimpleRule1 (Permit)
+
│           AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki>
  
−
├── 描述：med.example.com 域内的邮箱主体可以对任意资源执行任意动作
+
└── Rule "Right to use copyrighted material match" (Permit)
−
 
 
−
└── Target: subject-id (rfc822Name) 匹配 "med.example.com"
 
−
==属性表：==
 
−
| `subject-id` | access-subject | `rfc822Name`  |
 
  
−
==原始请求等效json：==
+
|   ├── Target: resource:ip-owner = "Acme"
−
{
+
 
−
"sub": {
+
|   └── Condition (AND):
−
    "subjectId": "bart.simpson@med.example.com"
+
 
−
  },
+
|       ├── subject:organization = "Wiley Corp"
−
  "obj": {
+
 
−
    "resourceId": "file://example/med/record/patient/BartSimpson"
+
|       ├── subject:agreement-id = resource:agreement-id
−
  },
+
 
−
  "act": {
+
|       ├── resource:ip-licensee = "Wiley Corp"
−
    "actionId": "read"
+
 
−
  }
+
|       ├── current-dateTime >= resource:effective-date
−
}
 
−
==转换版说明：==
 
−
- 原例是单一企业内部访问策略，不是本课题“平台托管双合约”场景。为自圆其说，将其置于“Medi Corp 内部医疗资源平台”语境：
 
  
−
-- Platform 承担身份/角色管理、核心业务授权、安全合规、生命周期治理义务；
+
|       └── current-dateTime 小于 resource:expiration-date
  
−
- 原 XACML 只有主体域约束，因此本文件只含一份 policy，不强行拆两份合约。
+
└── Obligations (Permit):
  
−
- 映射：  rfc822Name-match("med.example.com", subject-id) -> subject.subjectId endsWith "@med.example.com"
+
    ├── marking(text = "Copyright 2011 Acme")
  
−
- 原始请求之外需要获取的其它信息：
+
    └── encrypt
−
==转换版：==
 
−
policySet "OASIS3_5_MediCorpAccess" {
 
  
−
    // CBAC 追加：请求模型（判决引擎统一输入）
+
==原始请求等效json： ==
 +
  {
 +
  "sub": {
 +
    "organization": "Wiley Corp",
 +
    "agreementId": "A-001"
 +
  },
 +
  "obj": {
 +
    "copyright": true,
 +
    "ipOwner": "Acme",
 +
    "ipLicensee": "Wiley Corp",
 +
    "agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",
 +
    "agreementId": "A-001",
 +
    "effectiveDate": "2020-01-01T00:00:00",
 +
    "expirationDate": "2030-01-01T00:00:00"
 +
  },
 +
  "act": {
 +
    "actionId": "use"
 +
  },
 +
  "env": {
 +
    "currentDateTime": "2024-06-01T12:00:00"
 +
  }
 +
}
  
−
    request AuthorizationRequest {
+
==转换版：==
  
−
        subject: Subject
 
  
−
        resource: Resource
+
contract CopyrightApprove {
  
−
        action: Action
+
    party Owner {
  
−
        environment: Environment
+
        name: String
  
 
    }
 
    }
  
−
    combine denyOverrides         //    XACML 上层组合逻辑
+
    party Platform {
  
−
    policy "MediCorpInternalAccess" signedBy [Subject, Platform] {
+
        name: String
  
−
        party Subject {         // SPESC 原生参与方 ----
+
        targetMatch(Request)
  
−
            subjectId: rfc822Name
+
        marking(text: String)
  
−
            name: String
+
        encrypt()
 +
 
 +
    }
  
−
            department: String
+
    asset Resource {
  
−
            employmentStatus: String
+
        resourceId: String
  
−
        }
+
        copyright: Boolean
  
−
        party Platform { // Platform 的“系统设计义务”，由 SPESC term 声明。
+
        agreementType: String
  
−
            account: String
+
        ipOwner: String
  
−
            authorize(role: String, subjectId: String)   // 身份/角色管理
+
        ipLicensee: String
  
−
            audit(actionId: String, subjectId: String)   // 安全/合规执行
+
        agreementId: String
  
−
            suspend(subjectId: String)                   // 治理/处罚
+
        effectiveDate: dateTime
  
−
            revoke(subjectId: String)                    // 生命周期终止
+
        expirationDate: dateTime
  
−
        }
+
    }
  
−
        // ---- SPESC 原生：资产 ----
+
    addition Request {
  
−
        asset Resource {
+
        Sub: Subject
  
−
            info {
+
        Obj: Resource
  
−
                resourceId: String
+
        Act: Action
  
−
                resourceType: String
+
    }
  
−
                department: String
+
    addition fn {
  
−
            }
+
        fn::string::oneAndOnly(x: String): String
  
−
            right { }
+
        fn::dateTime::oneAndOnly(x: dateTime): dateTime
  
−
        }
+
    }
  
−
        // ---- SPESC term：法律/义务声明（不参与 Permit/Deny）---
 
  
−
        // 身份与角色管理：平台有义务为域内用户派生 internal-user 角色
+
    ## Type(match)
  
−
        term IdentityRoleManagement: Platform must authorize("internal-user", Subject::subjectId)
+
    term policy_target: Platform must targetMatch(Request)
  
−
            when Subject::subjectId endsWith "@med.example.com".
+
        when ATTR(Request::Obj, copyright) = true
  
−
        // 安全与合规执行：平台有义务对访问动作审计
+
          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"
  
−
        term SecurityComplianceAudit: Platform must audit(action.actionId, Subject::subjectId)
+
        where return Permit
  
−
            when action.actionId in ["read", "download", "export"].
 
  
−
        // 生命周期治理：员工离岗时平台有义务吊销访问资格
+
    ## Type(comb)
  
−
        term LifecycleRevoke: Platform must revoke(Subject::subjectId)
+
    term policy_comb: Sub can access Resource
  
−
            when Subject::employmentStatus = "terminated".
+
        when evalTerm(rule_target, Request) = Permit
  
−
        combine permitOverrides //    XACML 下层组合逻辑
+
        where evalTerm(obligation_mark, Request)  AND evalTerm(obligation_encrypt, Request)  return Permit
  
−
        access "AnyMedDomainUserAnyAction" {         // 原始 XACML 规则：域内用户可对任何资源执行任何动作
 
  
−
            target {
+
    term rule_target: Sub can use Resource
  
−
                subject.subjectId endsWith "@med.example.com"
+
        when ATTR(Request::Obj, ipOwner) = "Acme"
  
−
            }
+
          and evalTerm(rule_condition, Request) = Permit
  
−
            effect Permit
+
        where return Permit
  
−
        }
 
  
−
        signature { algorithm "ECDSA"; keyId "medi-subject-template-001"; digest "sha256:..." }
+
    term rule_condition:
  
−
        signature { algorithm "ECDSA"; keyId "medi-platform-001"; digest "sha256:..." }
+
        when ATTR(Request::Sub, organization) = "Wiley Corp"
  
−
    }
+
          and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =
  
−
}
+
              fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))
  
−

+
          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"
−
=例2：rbac组合=
 
−
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096 语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）
 
−
==原文：==
 
−
<syntaxhighlight lang="xml">
 
−
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
 
−
  <Description>Test Or</Description>
 
−
  <Target></Target>
 
−
  <Rule Effect="Permit" RuleId="primary-group-emps-rule">  //Rule1：read + 组命中 admin_emps/admin → 保护接口
 
−
      <Target>
 
−
        <AnyOf>
 
−
            <AllOf>
 
−
              <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 
−
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 
−
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
 
−
              </Match>
 
−
            </AllOf>
 
−
        </AnyOf>
 
−
      </Target>
 
−
      <Condition>
 
−
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
 
−
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
 
−
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
 
−
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
 
−
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
 
−
            </Apply>
 
−
        </Apply>
 
−
      </Condition>
 
−
  </Rule>
 
−
  <Rule Effect="Permit" RuleId="primary-user-rule">  //Rule2：公开版本接口，任何用户
 
−
      <Condition>
 
−
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
 
−
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
 
−
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
 
−
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
 
−
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
 
−
            </Apply>
 
−
        </Apply>
 
−
      </Condition>
 
−
  </Rule>
 
−
  <Rule Effect="Deny" RuleId="deny-rule"></Rule>
 
−
</Policy>
 
−
</syntaxhighlight>
 
−
==逻辑结构：==
 
−
Policy (组合: first-applicable)
 
  
−
├── Target = 空
+
          and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))
  
−
├── Rule1 (Permit)  
+
          and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))
  
−
│  ├── Target: action-id = read 
+
        where return Permit
  
−
│    └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集
 
  
−
├── Rule2 (Permit)  
+
    term obligation_mark: Platform must marking("Copyright 2011 Acme")
  
−
│ ├── Target: 无
+
         when true
  
−
│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集
 
  
−
└── Rule3 (Deny) 兜底
+
    term obligation_encrypt: Platform must encrypt()
−
==属性表：==
 
−
| `action-id`  | `action`          | string |
 
  
−
| `group`      | `group`          | string |
+
        when true
  
−
| `resource-id` | `resource`        | string |
 
−
==原始请求等效json： ==
 
−
{
 
−
  "sub": {
 
−
    "subjectId": "alice",
 
−
    "groups": ["admin"]
 
−
  },
 
−
  "obj": {
 
−
    "resourceId": "http://localhost:8280/services/Customers/getVersion1"
 
−
  },
 
−
  "act": {
 
−
    "actionId": "read"
 
−
  }
 
−
}
 
−
==转换版说明：==
 
−
把原策略的 3 条 Rule 直接翻成 3 条 access，没有加任何 Platform 义务
 
−
==转换版：==
 
−
policySet "WSO2_Sample6_TestOr" {
 
−
    request AuthorizationRequest {
 
−
        subject: Subject
 
−
        resource: Resource
 
−
        action: Action
 
−
        environment: Environment
 
−
    }
 
−
    type Action {
 
−
        actionId: string
 
−
    }
 
−
    type Environment {
 
−
        currentTime: dateTime
 
−
    }
 
−
    combine firstApplicable
 
−
    policy "testOr" {
 
−
        party Subject {
 
−
            subjectId: string
 
−
            groups: string[]              // 原 XACML 的 group category
 
−
            readResource()                // 动作声明
 
−
        }
 
−
        asset Resource {
 
−
            info {
 
−
                resourceId: string
 
−
            }
 
−
            right { }
 
−
        }
 
−
        term PublicVersionRead: Subject can readResource
 
−
            when Resource::resourceId in [
 
−
                "http://localhost:8280/services/Customers/getVersion1",
 
−
                "http://localhost:8280/services/Customers/getVersion2"
 
−
            ].
 
−
        combine firstApplicable
 
−
        access "PrimaryGroupEmpsRule" {
 
−
            target {
 
−
                action.actionId = "read"
 
−
            }
 
−
            condition {
 
−
                some g in subject.groups
 
−
                    such that g in ["admin_emps", "admin"]
 
−
            }
 
−
            effect Permit
 
−
        }
 
−
        access "PrimaryUserRule" {
 
−
            condition {
 
−
                resource.resourceId in [
 
−
                    "http://localhost:8280/services/Customers/getVersion1",
 
−
                    "http://localhost:8280/services/Customers/getVersion2"
 
−
                ]
 
−
            }
 
−
            effect Permit
 
−
        }
 
−
        access "DenyRule" {
 
−
            effect Deny
 
−
        }
 
−
    }
 
 
}
 
}
 +
 
*
 
*

2026年9月3日 (四) 02:47的版本

<meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /> <meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [1][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] <meta http-equiv="content-language" content="zh-cn" /> <meta http-equiv="vary" content="Accept" /> <meta charset="utf-8" />

= <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /> <meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [2]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]顺序 =

target term

    │ 只做资源级适用性判断，不引用具体 comb

    ▼ （编译器自动按 Request::Act.actionId 查找对应 comb；  （无 comb 则找同动作 rule_target））

comb term（组合入口，针对一类动作）

    │ 在 when 中 evalTerm(rule_target, Request) = Permit

    ▼

rule_target term（动作、rule级obligation、rule级target、伴随、后置）

    │ 在 when 中 evalTerm(rule_condition, Request) = Permit

  ▼

rule_condition term（condition和返回）


例1：sample6

来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/

说明：多rule合并

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" 
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Test Or</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-emps-rule">  
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" 
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="primary-user-rule"> 
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>

逻辑结构：

Policy (组合: first-applicable)

├── Target = 空

├── Rule1 (Permit)

│ ├── Target: action-id = read

│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集

├── Rule2 (Permit)

│ ├── Target: 无

│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集

└── Rule3 (Deny) 兜底

原始请求等效json：

{
  "sub": {
    "subjectId": "anyone",
    "groups": []
  },
  "act": {
    "actionId": "read"
  },
  "obj": {
    "resourceId": "http://localhost:8280/services/Customers/getVersion1"
  }
}

转换版：

contract Sample6_RoleAccess {

    party Platform {

        name: String

        targetMatch(Request)

    }

    asset Resource {

        resourceId: String

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    ## Type(match)

    term policy_target: Platform must targetMatch(Request)

        when true

        where return Permit


    ## Type(comb)

    term policy_comb: Sub can access Resource

        when some of(evalTerm(rule_target_1, Request),

                     evalTerm(rule_target_2, Request)) = Permit

        where return Permit


    term rule_target_1: Sub can read Resource

        when ATTR(Request::Act, actionId) = "read"

          and evalTerm(rule_condition_1, Request) = Permit

        where return Permit


    term rule_condition_1:

        when some g in ATTR(Request::Sub, groups)

            such that g = "admin_emps" or g = "admin"

        where return Permit


    term rule_target_2: Sub can access Resource

        when evalTerm(rule_condition_2, Request) = Permit

        where return Permit


    term rule_condition_2:

        when ATTR(Request::Obj, resourceId) in {

            "http://localhost:8280/services/Customers/getVersion1",

            "http://localhost:8280/services/Customers/getVersion2"

        }

        where return Permit

}



例2：OASIS 3-4

来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502

语法：双target，有obligation

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="copyright-approve"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
    Version="1">
    <Description>Example copyright material policy</Description>

    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
    <Target>
        <AnyOf>
            <AllOf>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
                </Match>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
                </Match>
            </AllOf>
        </AnyOf>
    </Target>

    <!-- 规则级 Target：资源 ip-owner = Acme -->
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
        <Target>
            <AnyOf>
                <AllOf>
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Match>
                </AllOf>
            </AnyOf>
        </Target>

        <!-- Condition：以下 5 个条件全部成立才 Permit -->
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <!-- ① 请求方组织 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ② 主体协议号 = 资源协议号 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ③ 资源被许可方 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ④ 当前时间 >= 生效时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ⑤ 当前时间 < 过期时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>

    <!-- Permit 时要求 PEP：加标记 + 加密 -->
    <ObligationExpressions>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
            </AttributeAssignmentExpression>
        </ObligationExpression>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
    </ObligationExpressions>
</Policy>

逻辑结构：

Policy copyright-approve (deny-overrides)

├── Target: resource:copyright = true

│           AND resource:agreement-type = urn:...:copyright-grant

└── Rule "Right to use copyrighted material match" (Permit)

|   ├── Target: resource:ip-owner = "Acme"

|   └── Condition (AND):

|       ├── subject:organization = "Wiley Corp"

|       ├── subject:agreement-id = resource:agreement-id

|       ├── resource:ip-licensee = "Wiley Corp"

|       ├── current-dateTime >= resource:effective-date

|       └── current-dateTime 小于 resource:expiration-date

└── Obligations (Permit):

    ├── marking(text = "Copyright 2011 Acme")

    └── encrypt

原始请求等效json：

 {
  "sub": {
    "organization": "Wiley Corp",
    "agreementId": "A-001"
  },
  "obj": {
    "copyright": true,
    "ipOwner": "Acme",
    "ipLicensee": "Wiley Corp",
    "agreementType": "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant",
    "agreementId": "A-001",
    "effectiveDate": "2020-01-01T00:00:00",
    "expirationDate": "2030-01-01T00:00:00"
  },
  "act": {
    "actionId": "use"
  },
  "env": {
    "currentDateTime": "2024-06-01T12:00:00"
  }
}

转换版：

contract CopyrightApprove {

    party Owner {

        name: String

    }

    party Platform {

        name: String

        targetMatch(Request)

        marking(text: String)

        encrypt()

    }

    asset Resource {

        resourceId: String

        copyright: Boolean

        agreementType: String

        ipOwner: String

        ipLicensee: String

        agreementId: String

        effectiveDate: dateTime

        expirationDate: dateTime

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        fn::string::oneAndOnly(x: String): String

        fn::dateTime::oneAndOnly(x: dateTime): dateTime

    }


    ## Type(match)

    term policy_target: Platform must targetMatch(Request)

        when ATTR(Request::Obj, copyright) = true

          and ATTR(Request::Obj, agreementType) = "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant"

        where return Permit


    ## Type(comb)

    term policy_comb: Sub can access Resource

        when evalTerm(rule_target, Request) = Permit

        where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request) return Permit


    term rule_target: Sub can use Resource

        when ATTR(Request::Obj, ipOwner) = "Acme"

          and evalTerm(rule_condition, Request) = Permit

        where return Permit


    term rule_condition:

        when ATTR(Request::Sub, organization) = "Wiley Corp"

          and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =

              fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))

          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"

          and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))

          and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))

        where return Permit


    term obligation_mark: Platform must marking("Copyright 2011 Acme")

        when true


    term obligation_encrypt: Platform must encrypt()

        when true

}

取自“https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&oldid=542”