<?xml version="1.0"?>

<!DOCTYPE policy SYSTEM "policy.dtd">
<policy>
  <!-- ===================================================
  1. The "all" group can read name field.
 =================================================== -->
  <xacl>
    <object href="/personnel_info/entry/name"/>
    <rule>
      <acl>
        <subject>
          <group>all</group>
        </subject>
        <action name="read" permission="grant"/>
      </acl>
    </rule>
  </xacl>
  <!-- ===================================================
  2. People in the personnel department can read any
     elements that are categorized as private, provided
     the access is logged.
 =================================================== -->
  <xacl>
    <object href="/personnel_info/entry/*[@category='private']"/>
    <rule>
      <acl>
        <subject>
          <group>personnel</group>
        </subject>
        <action name="read" permission="grant">
          <provisional_action name="log" timing="before"/>
        </action>
      </acl>
      <!-- ===================================================
  3. Manager in the personnel department can write any
     elements that are categorized as private, provided
     the access is logged.
 =================================================== -->
      <acl>
        <subject>
          <role>Manager</role>
          <group>personnel</group>
        </subject>
        <action name="write" permission="grant">
          <provisional_action name="log" timing="before"/>
        </action>
      </acl>
    </rule>
  </xacl>
</policy>