Xone exactly one factor 01

A policy from the Compliance corpus. The table gives the source and what the policy shows, in the source's words.

Source	What it shows
xone-exactly-one-factor-01.ttl	odrl:xone: a permission gated on exactly one of three access-factor claims being true, not merely at least one

Policy #

{
  "@context": [
    "http://www.w3.org/ns/odrl.jsonld",
    {
      "case": "https://ds-labs-org.github.io/ds-odrl-compliance-rdf/cases/xone-exactly-one-factor-01#",
      "dsc": "https://ds-labs-org.github.io/ds-odrl-compliance-rdf/ns#",
      "dpv": "https://w3id.org/dpv#",
      "foaf": "http://xmlns.com/foaf/0.1/",
      "vcard": "http://www.w3.org/2006/vcard/ns#"
    }
  ],
  "@graph": [
    {
      "@type": "Set",
      "uid": "case:policy-a",
      "assigner": "did:web:provider.example",
      "permission": [
        {
          "uid": "case:perm-read",
          "target": "case:asset-vault",
          "action": "read",
          "constraint": [
            {
              "xone": [
                {
                  "leftOperand": {
                    "@id": "case:claim-mfaVerified",
                    "@type": "dsc:ClaimKey",
                    "dsc:key": "mfaVerified"
                  },
                  "operator": "eq",
                  "rightOperand": "true"
                },
                {
                  "leftOperand": {
                    "@id": "case:claim-onPremises",
                    "@type": "dsc:ClaimKey",
                    "dsc:key": "onPremises"
                  },
                  "operator": "eq",
                  "rightOperand": "true"
                },
                {
                  "leftOperand": {
                    "@id": "case:claim-vpnConnected",
                    "@type": "dsc:ClaimKey",
                    "dsc:key": "vpnConnected"
                  },
                  "operator": "eq",
                  "rightOperand": "true"
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}

Reading #

The sentences OdrlProse writes for this policy, without a profile.

Policy set case:policy-a

A set of rules from did:web:provider.example (assigner).

Anyone may read asset-vault, as permitted by the assigner did:web:provider.example.
Applies only if:
- exactly one of the following holds:
  - the claim mfa verified is equal to "true"
  - the claim on premises is equal to "true"
  - the claim vpn connected is equal to "true"

The renderer raised no warning for this policy.

Back to the Compliance corpus or the catalog.