SYSTEM xidbox;
---------CONDITION ATTRIBUTE BLOCK----------------
CONDITION_ATTRIBUTE CONTROL_OBJECT_UUID TYPE simple;
CONDITION_ATTRIBUTE ROLE_TECH_NAME TYPE simple;
CONDITION_ATTRIBUTE USER_CARD_UUID_CERT TYPE simple;
CONDITION_ATTRIBUTE ORDR_TYPE TYPE simple;
CONDITION_ATTRIBUTE CONTROL_OBJECT_SYSTEMS TYPE simpleArray;
CONDITION_ATTRIBUTE USER_SYSTEMS TYPE simpleArray;
CONDITION_ATTRIBUTE SYSTEM TYPE simple;
CONDITION_ATTRIBUTE USER_PROFILE_CARD_UUID TYPE simple;
CONDITION_ATTRIBUTE USER_CARD_UUID TYPE simple;
CONDITION_ATTRIBUTE ROLE_SYSTEM TYPE simple;
CONDITION_ATTRIBUTE USER_PROFILE_ORGANIZATION_STATE TYPE simple;
CONDITION_ATTRIBUTE USER_PROFILE_SYSTEMS TYPE simple;
CONDITION_ATTRIBUTE AUTHOR_UUID TYPE simple;
CONDITION_ATTRIBUTE current_user.uuid TYPE simple DYNAMIC;
CONDITION_ATTRIBUTE current_user_profile.uuid TYPE simple DYNAMIC;
CONDITION_ATTRIBUTE controlled_system TYPE simple DYNAMIC;
------TODO current_organizations, current_user_profiles
CONDITION_ATTRIBUTE current_organizations TYPE objectArray DYNAMIC;
CONDITION_ATTRIBUTE current_user_profiles TYPE objectArray DYNAMIC;
----------RESOURCE BLOCK------------------
RESOURCE certification_authority                    RESOURCE_TYPE certification_authorities_type;
RESOURCE certification_authorities                  RESOURCE_TYPE certification_authorities_type;
RESOURCE decision                                   RESOURCE_TYPE decision_type;
RESOURCE ordr_types_dictionary                      RESOURCE_TYPE dictionary_type;
RESOURCE ordr_states_dictionary                     RESOURCE_TYPE dictionary_type;
RESOURCE info_systems_controlled                    RESOURCE_TYPE info_systems_controlled_type;
RESOURCE info_systems_to_filter_roles               RESOURCE_TYPE info_systems_filter_roles_type;
RESOURCE info_systems_to_filter_orders              RESOURCE_TYPE info_systems_filter_orders_type;
RESOURCE info_systems_to_filter_user_profiles       RESOURCE_TYPE info_systems_to_filter_user_profiles_type;
RESOURCE info_systems_to_export_role_politics       RESOURCE_TYPE info_systems_export_role_politics_type;
RESOURCE info_systems_possible                      RESOURCE_TYPE info_systems_possible_type;
RESOURCE info_systems                               RESOURCE_TYPE info_systems_type;
RESOURCE info_system_card                           RESOURCE_TYPE info_system_card_type;
RESOURCE info_system_cards                          RESOURCE_TYPE info_system_cards_type;
RESOURCE info_system_card_via_order                 RESOURCE_TYPE info_system_card_via_order_type;
RESOURCE info_system_authn_types_dictionary         RESOURCE_TYPE info_system_authn_types_dictionary_type;
RESOURCE mail_template                              RESOURCE_TYPE mail_template_type;
RESOURCE mail_template_via_order                    RESOURCE_TYPE mail_template_via_order_type;
RESOURCE mail_templates                             RESOURCE_TYPE mail_template_type;
RESOURCE ordr_card                                  RESOURCE_TYPE ordr_card_type;
RESOURCE ordr_cards                                 RESOURCE_TYPE ordr_cards_type;
RESOURCE ordr_report                                RESOURCE_TYPE ordr_report_type;
RESOURCE role_card                                  RESOURCE_TYPE role_card_type;
RESOURCE role_combinings                            RESOURCE_TYPE role_card_type;
RESOURCE role_combinations                          RESOURCE_TYPE role_card_type;
RESOURCE role_card_via_order                        RESOURCE_TYPE role_card_via_order_type;
RESOURCE role_cards                                 RESOURCE_TYPE role_cards_type;
RESOURCE role_politics                              RESOURCE_TYPE role_politics_type;
RESOURCE role_politics_via_order                    RESOURCE_TYPE role_politics_via_order_type;
RESOURCE roles_to_filter_user_profiles              RESOURCE_TYPE roles_to_filter_user_profiles_type;
RESOURCE roles_to_filter_orders                     RESOURCE_TYPE roles_to_filter_orders_type;
RESOURCE role_groups_to_filter_roles                RESOURCE_TYPE role_groups_to_filter_roles_type;
RESOURCE roles                                      RESOURCE_TYPE roles_type;
RESOURCE role_states_dictionary                     RESOURCE_TYPE dictionary_type;
RESOURCE role_attributes                            RESOURCE_TYPE roles_type;
RESOURCE security_settings                          RESOURCE_TYPE security_settings_type;
RESOURCE security_settings_via_order                RESOURCE_TYPE security_settings_via_order_type;
RESOURCE security_settings_signature                RESOURCE_TYPE security_settings_signature_type;
RESOURCE security_settings_addition                 RESOURCE_TYPE security_settings_addition_type;
RESOURCE user_card                                  RESOURCE_TYPE user_card_type;
RESOURCE user_dynamic_fields                        RESOURCE_TYPE user_card_type;
RESOURCE user_dynamic_fields_storage                RESOURCE_TYPE user_card_type;
RESOURCE user_core_fields                           RESOURCE_TYPE user_card_type;
RESOURCE user_core_fields_storage                   RESOURCE_TYPE user_card_type;
RESOURCE user_card_via_order                        RESOURCE_TYPE user_card_via_order_type;
RESOURCE user_oauth_consent_via_order               RESOURCE_TYPE user_card_via_order_type;
RESOURCE user_password_via_order                    RESOURCE_TYPE user_password_via_order_type;
RESOURCE user_cards                                 RESOURCE_TYPE user_cards_type;
RESOURCE user_cards_via_order                       RESOURCE_TYPE user_cards_via_order_type;
RESOURCE user_cert                                  RESOURCE_TYPE user_cert_type;
RESOURCE user_cert_via_order                        RESOURCE_TYPE user_cert_via_order_type;
RESOURCE user_login                                 RESOURCE_TYPE user_login_type;
RESOURCE user_email                                 RESOURCE_TYPE user_login_type;
RESOURCE user_states_dictionary                     RESOURCE_TYPE user_states_dictionary_type;
RESOURCE user_authn_info                            RESOURCE_TYPE user_authn_info_type;
RESOURCE user_state_info                            RESOURCE_TYPE user_state_info_type;
RESOURCE user_profile_states_dictionary             RESOURCE_TYPE user_profile_states_dictionary_type;
RESOURCE user_profile_role_states_dictionary        RESOURCE_TYPE user_profile_role_states_dictionary_type;
RESOURCE user_profile_card                          RESOURCE_TYPE user_profile_card_type;
RESOURCE user_profile_core_fields                   RESOURCE_TYPE user_profile_card_type;
RESOURCE user_profile_core_fields_storage           RESOURCE_TYPE user_profile_card_type;
RESOURCE user_profile_dynamic_fields                RESOURCE_TYPE user_profile_card_type;
RESOURCE user_profile_dynamic_fields_storage        RESOURCE_TYPE user_profile_card_type;
RESOURCE user_profile_state_info                    RESOURCE_TYPE user_profile_card_type;
RESOURCE user_profile_card_via_order                RESOURCE_TYPE user_profile_card_via_order_type;
RESOURCE user_profile_card_user_info                RESOURCE_TYPE user_profile_card_user_info_type;
RESOURCE user_profile_cards_via_order               RESOURCE_TYPE user_profile_cards_via_order_type;
RESOURCE user_profile_cards                         RESOURCE_TYPE user_profile_cards_type;
RESOURCE user_profile_cards_for_user_card           RESOURCE_TYPE user_profile_cards_for_user_card_type;
RESOURCE user_profile_cards_for_organization_card   RESOURCE_TYPE user_profile_cards_for_organization_card_type;
RESOURCE user_profile_role_possible                 RESOURCE_TYPE user_profile_role_possible_type;
RESOURCE user_profile_role                          RESOURCE_TYPE user_profile_role_type;
RESOURCE user_profile_role_via_order                RESOURCE_TYPE user_profile_role_via_order_type;
RESOURCE user_profile_role_file_via_order           RESOURCE_TYPE user_profile_role_file_via_order_type;
RESOURCE user_profile_roles_file_via_order          RESOURCE_TYPE user_profile_roles_file_via_order_type;
RESOURCE user_profile_roles_possible                RESOURCE_TYPE user_profile_roles_possible_type;
RESOURCE user_profile_roles                         RESOURCE_TYPE user_profile_roles_type;
RESOURCE user_profile_roles_via_order               RESOURCE_TYPE user_profile_roles_via_order_type;
RESOURCE user_profile_position                      RESOURCE_TYPE user_profile_position_type;
RESOURCE user_profile_positions                     RESOURCE_TYPE user_profile_positions_type;
RESOURCE user_profile_position_via_order            RESOURCE_TYPE user_profile_position_via_order_type;
RESOURCE user_profile_positions_via_order           RESOURCE_TYPE user_profile_positions_via_order_type;
RESOURCE user_profile_session_history               RESOURCE_TYPE user_profile_session_history_type;
RESOURCE organization_card                          RESOURCE_TYPE organization_card_type;
RESOURCE organization_core_fields                   RESOURCE_TYPE organization_card_type;
RESOURCE organization_core_fields_storage           RESOURCE_TYPE organization_card_type;
RESOURCE organization_dynamic_fields                RESOURCE_TYPE organization_card_type;
RESOURCE organization_dynamic_fields_storage        RESOURCE_TYPE organization_card_type;
RESOURCE sub_organization_card                      RESOURCE_TYPE organization_card_type;
RESOURCE sub_organization_cards                     RESOURCE_TYPE organization_card_type;
RESOURCE organization_cards                         RESOURCE_TYPE organization_cards_type;
RESOURCE organization_to_create_user_profile        RESOURCE_TYPE organization_to_create_user_profile_type;
RESOURCE organization_types_dictionary              RESOURCE_TYPE organization_dictionary_type;
RESOURCE organization_states_dictionary             RESOURCE_TYPE organization_dictionary_type;
RESOURCE sub_organization_rules                     RESOURCE_TYPE sub_organization_rules_type;
RESOURCE token_to_verify_user_email                 RESOURCE_TYPE token_to_verify_user_email_type;
RESOURCE token_to_verify_user_profile_email         RESOURCE_TYPE token_to_verify_user_profile_email_type;
RESOURCE organizational_structure_departments       RESOURCE_TYPE organizational_structure_departments_type;
RESOURCE organizational_structure_positions         RESOURCE_TYPE organizational_structure_positions_type;
RESOURCE user_sessions                              RESOURCE_TYPE user_sessions_type;
RESOURCE user_sessions_via_order                    RESOURCE_TYPE user_sessions_via_order_type;
-------------------------------------------
-------------CONDITIONAL BLOCK-------------
CONDITION full_access                                       VALUE true;
CONDITION current_user_is_owner                             VALUE current_user.uuid.equals(USER_CARD_UUID);
CONDITION current_user_is_cert_owner                        VALUE USER_CARD_UUID_CERT == null || current_user.uuid.equals(USER_CARD_UUID_CERT);
CONDITION current_user_is_not_owner                         VALUE !current_user.uuid.equals(USER_CARD_UUID);
CONDITION current_user_belongs_to_organizations             VALUE current_organizations.stream().anyMatch(#predicate('entity.uuid.equals(ORGANIZATION_CARD_UUID)', attributes));
--CONDITION current_user_is_owner_role_is_not_xidbox          VALUE current_user.uuid.equals(USER_CARD_UUID) && !ROLE_SYSTEM.equals('xidbox');
--CONDITION current_user_is_owner_system_is_not_xidbox        VALUE current_user.uuid.equals(USER_CARD_UUID) && !SYSTEM.equals('xidbox');
CONDITION is_control_object                                 VALUE current_user.uuid.equals(CONTROL_OBJECT_UUID) || current_user_profile.uuid.equals(CONTROL_OBJECT_UUID);
CONDITION user_systems_contains_controlled_system           VALUE USER_SYSTEMS.contains(controlled_system);
CONDITION control_object_from_controlled_system             VALUE CONTROL_OBJECT_SYSTEMS.contains(controlled_system);
CONDITION role_system_is_xidbox_and_not_user                VALUE ROLE_SYSTEM.equals('xidbox') && !ROLE_TECH_NAME.equals('user');
CONDITION role_system_is_not_xidbox                         VALUE !ROLE_SYSTEM.equals('xidbox');
CONDITION role_system_is_controlled_system                  VALUE ROLE_SYSTEM.equals(controlled_system);
CONDITION ordr_type_is_usr_reg                              VALUE ORDR_TYPE.equals('usr_reg');
CONDITION ordr_type_is_change_account_data                  VALUE ORDR_TYPE.equals('change_account_data');
CONDITION ordr_type_is_change_user_profile_positions        VALUE ORDR_TYPE.equals('change_user_profile_positions');
CONDITION system_is_xidbox                                  VALUE SYSTEM.equals('xidbox');
CONDITION system_is_not_xidbox                              VALUE !SYSTEM.equals('xidbox');
CONDITION system_is_controlled_system                       VALUE SYSTEM.equals(controlled_system);
CONDITION current_profile_is_owner                          VALUE current_user_profile.uuid.equals(USER_PROFILE_CARD_UUID);
CONDITION current_profile_is_owner_role_is_not_xidbox       VALUE current_user_profile.uuid.equals(USER_PROFILE_CARD_UUID) && !ROLE_SYSTEM.equals('xidbox');
CONDITION current_profile_is_owner_system_is_not_xidbox     VALUE current_user_profile.uuid.equals(USER_PROFILE_CARD_UUID) && !SYSTEM.equals('xidbox');
CONDITION current_user_is_own_profile                       VALUE current_user_profiles.stream().anyMatch(#predicate('entity.uuid.equals(USER_PROFILE_CARD_UUID)', attributes));
CONDITION current_user_is_not_own_profile                   VALUE current_user_profiles.stream().noneMatch(#predicate('entity.uuid.equals(USER_PROFILE_CARD_UUID)', attributes));
CONDITION current_user_is_not_own_profile_org_is_active     VALUE current_user_profiles.stream().noneMatch(#predicate('entity.uuid.equals(USER_PROFILE_CARD_UUID)', attributes)) && USER_PROFILE_ORGANIZATION_STATE.equals('ACTIVE');
--CONDITION current_user_own_profile_role_is_not_xidbox       VALUE current_user_profiles.stream().anyMatch(#predicate('entity.uuid.equals(USER_PROFILE_CARD_UUID)', attributes)) && !ROLE_SYSTEM.equals('xidbox');
--CONDITION current_user_own_profile_system_is_not_xidbox     VALUE current_user_profiles.stream().anyMatch(#predicate('entity.uuid.equals(USER_PROFILE_CARD_UUID)', attributes)) && !SYSTEM.equals('xidbox');
CONDITION profile_systems_contains_controlled_system        VALUE USER_PROFILE_SYSTEMS.contains(controlled_system);
CONDITION current_profile_is_author                         VALUE current_user_profile.uuid.equals(AUTHOR_UUID);
------------------------------------------
---------------POLICY BLOCK---------------
POLICY organization_card__read__full_access                                                       RESOURCE_TYPE organization_card_type                        RESOURCE organization_card                      ACTION    read                CONDITION full_access;
POLICY organization_card__read__current_user_belongs_to_organizations                             RESOURCE_TYPE organization_card_type                        RESOURCE organization_card                      ACTION    read                CONDITION current_user_belongs_to_organizations;
POLICY organization_card__export__full_access                                                     RESOURCE_TYPE organization_card_type                        RESOURCE organization_card                      ACTION    export              CONDITION full_access;
POLICY organization_core_fields__read__full_access                                                RESOURCE_TYPE organization_card_type                        RESOURCE organization_core_fields               ACTION    read                CONDITION full_access;
POLICY organization_core_fields__read__current_user_belongs_to_organizations                      RESOURCE_TYPE organization_card_type                        RESOURCE organization_core_fields               ACTION    read                CONDITION current_user_belongs_to_organizations;
POLICY organization_core_fields__export__full_access                                              RESOURCE_TYPE organization_card_type                        RESOURCE organization_core_fields               ACTION    export              CONDITION full_access;
POLICY organization_core_fields_storage__read__full_access                                        RESOURCE_TYPE organization_card_type                        RESOURCE organization_core_fields_storage       ACTION    read                CONDITION full_access;
POLICY organization_core_fields_storage__read__current_user_belongs_to_organizations              RESOURCE_TYPE organization_card_type                        RESOURCE organization_core_fields_storage       ACTION    read                CONDITION current_user_belongs_to_organizations;
POLICY organization_core_fields_storage__export__full_access                                      RESOURCE_TYPE organization_card_type                        RESOURCE organization_core_fields_storage       ACTION    export              CONDITION full_access;
POLICY organization_dynamic_fields__read__full_access                                             RESOURCE_TYPE organization_card_type                        RESOURCE organization_dynamic_fields            ACTION    read                CONDITION full_access;
POLICY organization_dynamic_fields__read__current_user_belongs_to_organizations                   RESOURCE_TYPE organization_card_type                        RESOURCE organization_dynamic_fields            ACTION    read                CONDITION current_user_belongs_to_organizations;
POLICY organization_dynamic_fields__export__full_access                                           RESOURCE_TYPE organization_card_type                        RESOURCE organization_dynamic_fields            ACTION    export              CONDITION full_access;
POLICY organization_dynamic_fields_storage__read__full_access                                     RESOURCE_TYPE organization_card_type                        RESOURCE organization_dynamic_fields_storage    ACTION    read                CONDITION full_access;
POLICY organization_dynamic_fields_storage__read__current_user_belongs_to_organizations           RESOURCE_TYPE organization_card_type                        RESOURCE organization_dynamic_fields_storage    ACTION    read                CONDITION current_user_belongs_to_organizations;
POLICY organization_dynamic_fields_storage__export__full_access                                   RESOURCE_TYPE organization_card_type                        RESOURCE organization_dynamic_fields_storage    ACTION    export              CONDITION full_access;

POLICY sub_organization_card__read__full_access                                                   RESOURCE_TYPE organization_card_type                        RESOURCE sub_organization_card                  ACTION    read                CONDITION full_access;
POLICY sub_organization_cards__read__full_access                                                  RESOURCE_TYPE organization_card_type                        RESOURCE sub_organization_cards                 ACTION    read                CONDITION full_access;
POLICY sub_organization_cards__read__current_user_belongs_to_organizations                        RESOURCE_TYPE organization_card_type                        RESOURCE sub_organization_cards                 ACTION    read                CONDITION current_user_belongs_to_organizations;

POLICY organization_cards__read__full_access                                                      RESOURCE_TYPE organization_cards_type                       RESOURCE organization_cards                     ACTION    read                CONDITION full_access;
POLICY organization_cards__export__full_access                                                    RESOURCE_TYPE organization_cards_type                       RESOURCE organization_cards                     ACTION    export              CONDITION full_access;

POLICY organization_types_dictionary__read__full_access                                           RESOURCE_TYPE organization_dictionary_type                  RESOURCE organization_types_dictionary          ACTION    read                CONDITION full_access;
POLICY organization_states_dictionary__read__full_access                                          RESOURCE_TYPE organization_dictionary_type                  RESOURCE organization_states_dictionary         ACTION    read                CONDITION full_access;

POLICY sub_organization_rules__read__full_access                                                  RESOURCE_TYPE sub_organization_rules_type                   RESOURCE sub_organization_rules                 ACTION    read                CONDITION full_access;

POLICY user_card__read__current_user_is_owner                                                     RESOURCE_TYPE user_card_type                                RESOURCE user_card                              ACTION    read                CONDITION current_user_is_owner;
POLICY user_card__read__user_systems_contains_controlled_system                                   RESOURCE_TYPE user_card_type                                RESOURCE user_card                              ACTION    read                CONDITION user_systems_contains_controlled_system;
POLICY user_card__read__full_access                                                               RESOURCE_TYPE user_card_type                                RESOURCE user_card                              ACTION    read                CONDITION full_access;
POLICY user_dynamic_fields__read__current_user_is_owner                                           RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields                    ACTION    read                CONDITION current_user_is_owner;
POLICY user_dynamic_fields__read__user_systems_contains_controlled_system                         RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields                    ACTION    read                CONDITION user_systems_contains_controlled_system;
POLICY user_dynamic_fields__read__full_access                                                     RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields                    ACTION    read                CONDITION full_access;
POLICY user_dynamic_fields_storage__read__current_user_is_owner                                   RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields_storage            ACTION    read                CONDITION current_user_is_owner;
POLICY user_dynamic_fields_storage__read__user_systems_contains_controlled_system                 RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields_storage            ACTION    read                CONDITION user_systems_contains_controlled_system;
POLICY user_dynamic_fields_storage__read__full_access                                             RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields_storage            ACTION    read                CONDITION full_access;
POLICY user_core_fields__read__current_user_is_owner                                              RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields                       ACTION    read                CONDITION current_user_is_owner;
POLICY user_core_fields__read__user_systems_contains_controlled_system                            RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields                       ACTION    read                CONDITION user_systems_contains_controlled_system;
POLICY user_core_fields__read__full_access                                                        RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields                       ACTION    read                CONDITION full_access;
POLICY user_core_fields_storage__read__current_user_is_owner                                      RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields_storage               ACTION    read                CONDITION current_user_is_owner;
POLICY user_core_fields_storage__read__user_systems_contains_controlled_system                    RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields_storage               ACTION    read                CONDITION user_systems_contains_controlled_system;
POLICY user_core_fields_storage__read__full_access                                                RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields_storage               ACTION    read                CONDITION full_access;

POLICY user_cards__read__full_access                                                              RESOURCE_TYPE user_cards_type                               RESOURCE user_cards                             ACTION    read                CONDITION full_access;

POLICY user_card__export__full_access                                                             RESOURCE_TYPE user_card_type                                RESOURCE user_card                              ACTION    export              CONDITION full_access;
POLICY user_card__export__user_systems_contains_controlled_system                                 RESOURCE_TYPE user_card_type                                RESOURCE user_card                              ACTION    export              CONDITION user_systems_contains_controlled_system;
POLICY user_dynamic_fields__export__full_access                                                   RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields                    ACTION    export              CONDITION full_access;
POLICY user_dynamic_fields__export__user_systems_contains_controlled_system                       RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields                    ACTION    export              CONDITION user_systems_contains_controlled_system;
POLICY user_dynamic_fields_storage__export__full_access                                           RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields_storage            ACTION    export              CONDITION full_access;
POLICY user_dynamic_fields_storage__export__user_systems_contains_controlled_system               RESOURCE_TYPE user_card_type                                RESOURCE user_dynamic_fields_storage            ACTION    export              CONDITION user_systems_contains_controlled_system;
POLICY user_core_fields__export__full_access                                                      RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields                       ACTION    export              CONDITION full_access;
POLICY user_core_fields__export__user_systems_contains_controlled_system                          RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields                       ACTION    export              CONDITION user_systems_contains_controlled_system;
POLICY user_core_fields_storage__export__full_access                                              RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields_storage               ACTION    export              CONDITION full_access;
POLICY user_core_fields_storage__export__user_systems_contains_controlled_system                  RESOURCE_TYPE user_card_type                                RESOURCE user_core_fields_storage               ACTION    export              CONDITION user_systems_contains_controlled_system;

POLICY user_cards__export__full_access                                                            RESOURCE_TYPE user_cards_type                               RESOURCE user_cards                             ACTION    export              CONDITION full_access;

POLICY user_card_via_order__create__full_access                                                   RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    create              CONDITION full_access;
POLICY user_card_via_order__update__current_user_is_owner                                         RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    update              CONDITION current_user_is_owner;
POLICY user_card_via_order__update__full_access                                                   RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    update              CONDITION full_access;
POLICY user_card_via_order__permanent_block__current_user_is_not_owner                            RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    permanent_block     CONDITION current_user_is_not_owner;
POLICY user_card_via_order__temporarily_block__current_user_is_not_owner                          RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    temporarily_block   CONDITION current_user_is_not_owner;
POLICY user_card_via_order__unblock__current_user_is_not_owner                                    RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    unblock             CONDITION current_user_is_not_owner;
POLICY user_card_via_order__delete__full_access                                                   RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_card_via_order                    ACTION    delete              CONDITION full_access;

POLICY user_oauth_consent_via_order__delete__current_user_is_owner                                RESOURCE_TYPE user_card_via_order_type                      RESOURCE user_oauth_consent_via_order           ACTION    delete              CONDITION current_user_is_owner;

POLICY user_login__update__full_access                                                            RESOURCE_TYPE user_login_type                               RESOURCE user_login                             ACTION    update              CONDITION full_access;
POLICY user_email__update__full_access                                                            RESOURCE_TYPE user_login_type                               RESOURCE user_email                             ACTION    update              CONDITION full_access;

POLICY user_cards_via_order__create__full_access                                                  RESOURCE_TYPE user_cards_via_order_type                     RESOURCE user_cards_via_order                   ACTION    create              CONDITION full_access;

POLICY user_states_dictionary__read__full_access                                                  RESOURCE_TYPE user_states_dictionary_type                   RESOURCE user_states_dictionary                 ACTION    read                CONDITION full_access;

POLICY user_password_via_order__reset__current_user_is_not_owner                                  RESOURCE_TYPE user_password_via_order_type                  RESOURCE user_password_via_order                ACTION    reset               CONDITION current_user_is_not_owner;
POLICY user_password_via_order__update__current_user_is_owner                                     RESOURCE_TYPE user_password_via_order_type                  RESOURCE user_password_via_order                ACTION    update              CONDITION current_user_is_owner;

POLICY user_profile_card__read__full_access                                                       RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_card                      ACTION    read                CONDITION full_access;
POLICY user_profile_card__read__current_user_is_own_profile                                       RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_card                      ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_card__read__profile_systems_contains_controlled_system                        RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_card                      ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_core_fields__read__full_access                                                RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields               ACTION    read                CONDITION full_access;
POLICY user_profile_core_fields__read__current_user_is_own_profile                                RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields               ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_core_fields__read__profile_systems_contains_controlled_system                 RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields               ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_core_fields_storage__read__full_access                                        RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields_storage       ACTION    read                CONDITION full_access;
POLICY user_profile_core_fields_storage__read__current_user_is_own_profile                        RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields_storage       ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_core_fields_storage__read__profile_systems_contains_controlled_system         RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields_storage       ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_dynamic_fields__read__full_access                                             RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields            ACTION    read                CONDITION full_access;
POLICY user_profile_dynamic_fields__read__current_user_is_own_profile                             RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields            ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_dynamic_fields__read__profile_systems_contains_controlled_system              RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields            ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_dynamic_fields_storage__read__full_access                                     RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields_storage    ACTION    read                CONDITION full_access;
POLICY user_profile_dynamic_fields_storage__read__current_user_is_own_profile                     RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields_storage    ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_dynamic_fields_storage__read__profile_systems_contains_controlled_system      RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields_storage    ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_state_info__read__full_access                                                 RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_state_info                ACTION    read                CONDITION full_access;
POLICY user_profile_state_info__read__current_user_is_own_profile                                 RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_state_info                ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_state_info__read__profile_systems_contains_controlled_system                  RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_state_info                ACTION    read                CONDITION profile_systems_contains_controlled_system;

POLICY user_profile_states_dictionary__read__full_access                                          RESOURCE_TYPE user_profile_states_dictionary_type           RESOURCE user_profile_states_dictionary         ACTION    read                CONDITION full_access;
POLICY user_profile_role_states_dictionary__read__full_access                                     RESOURCE_TYPE user_profile_role_states_dictionary_type      RESOURCE user_profile_role_states_dictionary    ACTION    read                CONDITION full_access;

POLICY user_profile_card_via_order__create__full_access                                           RESOURCE_TYPE user_profile_card_via_order_type              RESOURCE user_profile_card_via_order            ACTION    create              CONDITION full_access;
POLICY user_profile_cards_via_order__create__full_access                                          RESOURCE_TYPE user_profile_cards_via_order_type             RESOURCE user_profile_cards_via_order           ACTION    create              CONDITION full_access;
POLICY user_profile_card_via_order__update__full_access                                           RESOURCE_TYPE user_profile_card_via_order_type              RESOURCE user_profile_card_via_order            ACTION    update              CONDITION full_access;
POLICY user_profile_card_via_order__update__current_profile_is_owner                              RESOURCE_TYPE user_profile_card_via_order_type              RESOURCE user_profile_card_via_order            ACTION    update              CONDITION current_profile_is_owner;
POLICY user_profile_card_via_order__permanent_block__current_user_is_not_own_profile              RESOURCE_TYPE user_profile_card_via_order_type              RESOURCE user_profile_card_via_order            ACTION    permanent_block     CONDITION current_user_is_not_own_profile;
POLICY user_profile_card_via_order__temporarily_block__current_user_is_not_own_profile            RESOURCE_TYPE user_profile_card_via_order_type              RESOURCE user_profile_card_via_order            ACTION    temporarily_block   CONDITION current_user_is_not_own_profile;
POLICY user_profile_card_via_order__unblock__current_user_is_not_own_profile_org_is_active        RESOURCE_TYPE user_profile_card_via_order_type              RESOURCE user_profile_card_via_order            ACTION    unblock             CONDITION current_user_is_not_own_profile_org_is_active;

POLICY user_profile_card_user_info__read__full_access                                             RESOURCE_TYPE user_profile_card_user_info_type              RESOURCE user_profile_card_user_info            ACTION    read                CONDITION full_access;
POLICY user_profile_card_user_info__read__current_user_is_owner                                   RESOURCE_TYPE user_profile_card_user_info_type              RESOURCE user_profile_card_user_info            ACTION    read                CONDITION current_user_is_owner;
POLICY user_profile_card_user_info__read__user_systems_contains_controlled_system                 RESOURCE_TYPE user_profile_card_user_info_type              RESOURCE user_profile_card_user_info            ACTION    read                CONDITION user_systems_contains_controlled_system;

POLICY user_profile_cards_for_user_card__read__full_access                                        RESOURCE_TYPE user_profile_cards_for_user_card_type         RESOURCE user_profile_cards_for_user_card       ACTION    read                CONDITION full_access;
POLICY user_profile_cards_for_user_card__read__current_user_is_owner                              RESOURCE_TYPE user_profile_cards_for_user_card_type         RESOURCE user_profile_cards_for_user_card       ACTION    read                CONDITION current_user_is_owner;
POLICY user_profile_cards_for_user_card__read__user_systems_contains_controlled_system            RESOURCE_TYPE user_profile_cards_for_user_card_type         RESOURCE user_profile_cards_for_user_card       ACTION    read                CONDITION user_systems_contains_controlled_system;

POLICY user_profile_cards__read__full_access                                                      RESOURCE_TYPE user_profile_cards_type                       RESOURCE user_profile_cards                     ACTION    read                CONDITION full_access;

POLICY user_profile_card__export__full_access                                                     RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_card                      ACTION    export              CONDITION full_access;
POLICY user_profile_card__export__profile_systems_contains_controlled_system                      RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_card                      ACTION    export              CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_core_fields__export__full_access                                              RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields               ACTION    export              CONDITION full_access;
POLICY user_profile_core_fields__export__profile_systems_contains_controlled_system               RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields               ACTION    export              CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_core_fields_storage__export__full_access                                      RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields_storage       ACTION    export              CONDITION full_access;
POLICY user_profile_core_fields_storage__export__profile_systems_contains_controlled_system       RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_core_fields_storage       ACTION    export              CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_dynamic_fields__export__full_access                                           RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields            ACTION    export              CONDITION full_access;
POLICY user_profile_dynamic_fields__export__profile_systems_contains_controlled_system            RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields            ACTION    export              CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_dynamic_fields_storage__export__full_access                                   RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields_storage    ACTION    export              CONDITION full_access;
POLICY user_profile_dynamic_fields_storage__export__profile_systems_contains_controlled_system    RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_dynamic_fields_storage    ACTION    export              CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_state_info__export__full_access                                               RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_state_info                ACTION    export              CONDITION full_access;
POLICY user_profile_state_info__export__profile_systems_contains_controlled_system                RESOURCE_TYPE user_profile_card_type                        RESOURCE user_profile_state_info                ACTION    export              CONDITION profile_systems_contains_controlled_system;

POLICY user_profile_cards__export__full_access                                                    RESOURCE_TYPE user_profile_cards_type                       RESOURCE user_profile_cards                     ACTION    export              CONDITION full_access;

POLICY user_profile_cards_for_organization_card__read__full_access                                RESOURCE_TYPE user_profile_cards_for_organization_card_type RESOURCE user_profile_cards_for_organization_card ACTION    read                CONDITION full_access;

POLICY organization_to_create_user_profile__read__full_access                                     RESOURCE_TYPE organization_to_create_user_profile_type      RESOURCE organization_to_create_user_profile    ACTION    read                CONDITION full_access;

POLICY user_authn_info__read__current_user_is_owner                                               RESOURCE_TYPE user_authn_info_type                          RESOURCE user_authn_info                        ACTION    read                CONDITION current_user_is_owner;
POLICY user_authn_info__full_access                                                               RESOURCE_TYPE user_authn_info_type                          RESOURCE user_authn_info                        ACTION    read                CONDITION full_access;
POLICY user_authn_info__user_systems_contains_controlled_system                                   RESOURCE_TYPE user_authn_info_type                          RESOURCE user_authn_info                        ACTION    read                CONDITION user_systems_contains_controlled_system;

POLICY user_state_info__read__current_user_is_owner                                               RESOURCE_TYPE user_state_info_type                          RESOURCE user_state_info                        ACTION    read                CONDITION current_user_is_owner;
POLICY user_state_info__read__full_access                                                         RESOURCE_TYPE user_state_info_type                          RESOURCE user_state_info                        ACTION    read                CONDITION full_access;
POLICY user_state_info__read__user_systems_contains_controlled_system                             RESOURCE_TYPE user_state_info_type                          RESOURCE user_state_info                        ACTION    read                CONDITION user_systems_contains_controlled_system;

POLICY user_cert__read__current_user_is_owner                                                     RESOURCE_TYPE user_cert_type                                RESOURCE user_cert                              ACTION    read                CONDITION current_user_is_owner;
POLICY user_cert__read__full_access                                                               RESOURCE_TYPE user_cert_type                                RESOURCE user_cert                              ACTION    read                CONDITION full_access;
POLICY user_cert__read__user_systems_contains_controlled_system                                   RESOURCE_TYPE user_cert_type                                RESOURCE user_cert                              ACTION    read                CONDITION user_systems_contains_controlled_system;
POLICY user_cert__delete__current_user_is_cert_owner                                              RESOURCE_TYPE user_cert_type                                RESOURCE user_cert                              ACTION    delete              CONDITION current_user_is_cert_owner;
POLICY user_cert_via_order__update__current_user_is_owner                                         RESOURCE_TYPE user_cert_via_order_type                      RESOURCE user_cert_via_order                    ACTION    update              CONDITION current_user_is_owner;

POLICY user_profile_role__read__current_user_is_own_profile                                       RESOURCE_TYPE user_profile_role_type                        RESOURCE user_profile_role                      ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_role__read__role_system_is_controlled_system                                  RESOURCE_TYPE user_profile_role_type                        RESOURCE user_profile_role                      ACTION    read                CONDITION role_system_is_controlled_system;
POLICY user_profile_role__read__full_access                                                       RESOURCE_TYPE user_profile_role_type                        RESOURCE user_profile_role                      ACTION    read                CONDITION full_access;

POLICY user_profile_roles__read__current_user_is_own_profile                                      RESOURCE_TYPE user_profile_roles_type                       RESOURCE user_profile_roles                     ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_roles__read__profile_systems_contains_controlled_system                       RESOURCE_TYPE user_profile_roles_type                       RESOURCE user_profile_roles                     ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_roles__read__full_access                                                      RESOURCE_TYPE user_profile_roles_type                       RESOURCE user_profile_roles                     ACTION    read                CONDITION full_access;

POLICY user_profile_role_possible__read__current_profile_is_owner_role_is_not_xidbox              RESOURCE_TYPE user_profile_role_possible_type               RESOURCE user_profile_role_possible             ACTION    read                CONDITION current_profile_is_owner_role_is_not_xidbox;
POLICY user_profile_role_possible__read__role_system_is_xidbox_and_not_user                       RESOURCE_TYPE user_profile_role_possible_type               RESOURCE user_profile_role_possible             ACTION    read                CONDITION role_system_is_xidbox_and_not_user;
POLICY user_profile_role_possible__read__role_system_is_not_xidbox                                RESOURCE_TYPE user_profile_role_possible_type               RESOURCE user_profile_role_possible             ACTION    read                CONDITION role_system_is_not_xidbox;

POLICY user_profile_roles_possible__read__current_profile_is_owner                                RESOURCE_TYPE user_profile_roles_possible_type              RESOURCE user_profile_roles_possible            ACTION    read                CONDITION current_profile_is_owner;
POLICY user_profile_roles_possible__read__full_access                                             RESOURCE_TYPE user_profile_roles_possible_type              RESOURCE user_profile_roles_possible            ACTION    read                CONDITION full_access;

POLICY user_profile_role_via_order__update__current_profile_is_owner_role_is_not_xidbox           RESOURCE_TYPE user_profile_role_via_order_type              RESOURCE user_profile_role_via_order            ACTION    update              CONDITION current_profile_is_owner_role_is_not_xidbox;
POLICY user_profile_role_via_order__update__role_system_is_xidbox_and_not_user                    RESOURCE_TYPE user_profile_role_via_order_type              RESOURCE user_profile_role_via_order            ACTION    update              CONDITION role_system_is_xidbox_and_not_user;
POLICY user_profile_role_via_order__update__role_system_is_not_xidbox                             RESOURCE_TYPE user_profile_role_via_order_type              RESOURCE user_profile_role_via_order            ACTION    update              CONDITION role_system_is_not_xidbox;

POLICY user_profile_roles_via_order__update__current_profile_is_owner                             RESOURCE_TYPE user_profile_roles_via_order_type             RESOURCE user_profile_roles_via_order           ACTION    update              CONDITION current_profile_is_owner;
POLICY user_profile_roles_via_order__update__full_access                                          RESOURCE_TYPE user_profile_roles_via_order_type             RESOURCE user_profile_roles_via_order           ACTION    update              CONDITION full_access;

POLICY user_profile_role_file_via_order__update__system_is_not_xidbox                             RESOURCE_TYPE user_profile_role_file_via_order_type         RESOURCE user_profile_role_file_via_order       ACTION    update              CONDITION system_is_not_xidbox;
POLICY user_profile_roles_file_via_order_update__full_access                                      RESOURCE_TYPE user_profile_roles_file_via_order_type        RESOURCE user_profile_roles_file_via_order      ACTION    update              CONDITION full_access;

POLICY user_profile_position__read__current_user_is_own_profile                                   RESOURCE_TYPE user_profile_position_type                    RESOURCE user_profile_position                  ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_position__read__full_access                                                   RESOURCE_TYPE user_profile_position_type                    RESOURCE user_profile_position                  ACTION    read                CONDITION full_access;

POLICY user_profile_positions__read__current_user_is_own_profile                                  RESOURCE_TYPE user_profile_positions_type                   RESOURCE user_profile_positions                 ACTION    read                CONDITION current_user_is_own_profile;
POLICY user_profile_positions__read__profile_systems_contains_controlled_system                   RESOURCE_TYPE user_profile_positions_type                   RESOURCE user_profile_positions                 ACTION    read                CONDITION profile_systems_contains_controlled_system;
POLICY user_profile_positions__read__full_access                                                  RESOURCE_TYPE user_profile_positions_type                   RESOURCE user_profile_positions                 ACTION    read                CONDITION full_access;

POLICY user_profile_positions__update__full_access                                                RESOURCE_TYPE user_profile_positions_type                   RESOURCE user_profile_positions                 ACTION    update              CONDITION full_access;

POLICY user_profile_position_via_order__update__full_access                                       RESOURCE_TYPE user_profile_position_via_order_type          RESOURCE user_profile_position_via_order        ACTION    update              CONDITION full_access;

POLICY user_profile_positions_via_order__update__current_profile_is_owner                         RESOURCE_TYPE user_profile_positions_via_order_type         RESOURCE user_profile_positions_via_order       ACTION    update              CONDITION current_profile_is_owner;
POLICY user_profile_positions_via_order__update__full_access                                      RESOURCE_TYPE user_profile_positions_via_order_type         RESOURCE user_profile_positions_via_order       ACTION    update              CONDITION full_access;

POLICY user_profile_session_history__read__full_access                                            RESOURCE_TYPE user_profile_session_history_type             RESOURCE user_profile_session_history           ACTION    read                CONDITION full_access;
POLICY user_profile_session_history__read__current_profile_is_owner                               RESOURCE_TYPE user_profile_session_history_type             RESOURCE user_profile_session_history           ACTION    read                CONDITION current_profile_is_owner;

POLICY security_settings__read_update__full_access                                                RESOURCE_TYPE security_settings_type                        RESOURCE security_settings                      ACTION    read update         CONDITION full_access;
POLICY security_settings__read__full_access                                                       RESOURCE_TYPE security_settings_type                        RESOURCE security_settings                      ACTION    read                CONDITION full_access;

POLICY security_settings_via_order__update__full_access                                           RESOURCE_TYPE security_settings_via_order_type              RESOURCE security_settings_via_order            ACTION    update              CONDITION full_access;
POLICY security_settings_signature__read__full_access                                             RESOURCE_TYPE security_settings_signature_type              RESOURCE security_settings_signature            ACTION    read                CONDITION full_access;
POLICY security_settings_addition__read__full_access                                              RESOURCE_TYPE security_settings_addition_type               RESOURCE security_settings_addition             ACTION    read                CONDITION full_access;

POLICY certification_authority__create_read_delete__full_access                                   RESOURCE_TYPE certification_authorities_type                RESOURCE certification_authority                ACTION    create read delete  CONDITION full_access;
POLICY certification_authority__read__full_access                                                 RESOURCE_TYPE certification_authorities_type                RESOURCE certification_authority                ACTION    read                CONDITION full_access;
POLICY certification_authorities__create_read_delete__full_access                                 RESOURCE_TYPE certification_authorities_type                RESOURCE certification_authorities              ACTION    create read delete  CONDITION full_access;
POLICY certification_authorities__read__full_access                                               RESOURCE_TYPE certification_authorities_type                RESOURCE certification_authorities              ACTION    read                CONDITION full_access;

POLICY mail_template__read_send__full_access                                                      RESOURCE_TYPE mail_template_type                            RESOURCE mail_template                          ACTION    read send           CONDITION full_access;
POLICY mail_templates__read_send__full_access                                                     RESOURCE_TYPE mail_template_type                            RESOURCE mail_templates                         ACTION    read send           CONDITION full_access;
POLICY mail_template_via_order__update__full_access                                               RESOURCE_TYPE mail_template_via_order_type                  RESOURCE mail_template_via_order                ACTION    update              CONDITION full_access;

POLICY role_politics__export__system_is_controlled_system                                         RESOURCE_TYPE role_politics_type                            RESOURCE role_politics                          ACTION    export              CONDITION system_is_controlled_system;
POLICY role_politics__create__system_is_controlled_system                                         RESOURCE_TYPE role_politics_type                            RESOURCE role_politics                          ACTION    create              CONDITION system_is_controlled_system;
POLICY role_politics_via_order__create__full_access                                               RESOURCE_TYPE role_politics_via_order_type                  RESOURCE role_politics_via_order                ACTION    create              CONDITION full_access;

POLICY roles__read__full_access                                                                   RESOURCE_TYPE roles_type                                    RESOURCE roles                                  ACTION    read                CONDITION full_access;
POLICY role_attributes__read__full_access                                                         RESOURCE_TYPE roles_type                                    RESOURCE role_attributes                        ACTION    read                CONDITION full_access;

POLICY roles_to_filter_user_profiles__read__full_access                                           RESOURCE_TYPE roles_to_filter_user_profiles_type            RESOURCE roles_to_filter_user_profiles          ACTION    read                CONDITION full_access;
POLICY roles_to_filter_user_profiles__read__role_system_is_controlled_system                      RESOURCE_TYPE roles_to_filter_user_profiles_type            RESOURCE roles_to_filter_user_profiles          ACTION    read                CONDITION role_system_is_controlled_system;

POLICY roles_to_filter_orders__read__full_access                                                  RESOURCE_TYPE roles_to_filter_orders_type                   RESOURCE roles_to_filter_orders                 ACTION    read                CONDITION full_access;
POLICY roles_to_filter_orders__read__role_system_is_controlled_system                             RESOURCE_TYPE roles_to_filter_orders_type                   RESOURCE roles_to_filter_orders                 ACTION    read                CONDITION role_system_is_controlled_system;

POLICY role_groups_to_filter_roles__read__full_access                                             RESOURCE_TYPE role_groups_to_filter_roles_type              RESOURCE role_groups_to_filter_roles            ACTION    read                CONDITION full_access;

POLICY role_cards__read__full_access                                                              RESOURCE_TYPE role_cards_type                               RESOURCE role_cards                             ACTION    read                CONDITION full_access;
POLICY role_card__read__full_access                                                               RESOURCE_TYPE role_card_type                                RESOURCE role_card                              ACTION    read                CONDITION full_access;
POLICY role_card__read__role_system_is_controlled_system                                          RESOURCE_TYPE role_card_type                                RESOURCE role_card                              ACTION    read                CONDITION role_system_is_controlled_system;
POLICY role_combinings__read__full_access                                                         RESOURCE_TYPE role_card_type                                RESOURCE role_combinings                        ACTION    read                CONDITION full_access;
POLICY role_combinings__read__role_system_is_controlled_system                                    RESOURCE_TYPE role_card_type                                RESOURCE role_combinings                        ACTION    read                CONDITION role_system_is_controlled_system;
POLICY role_combinations__read__full_access                                                       RESOURCE_TYPE role_card_type                                RESOURCE role_combinations                      ACTION    read                CONDITION full_access;
POLICY role_combinations__read__role_system_is_controlled_system                                  RESOURCE_TYPE role_card_type                                RESOURCE role_combinations                      ACTION    read                CONDITION role_system_is_controlled_system;

POLICY role_cards__export__full_access                                                            RESOURCE_TYPE role_cards_type                               RESOURCE role_cards                             ACTION    export              CONDITION full_access;
POLICY role_card__export__full_access                                                             RESOURCE_TYPE role_card_type                                RESOURCE role_card                              ACTION    export              CONDITION full_access;
POLICY role_card__export__role_system_is_controlled_system                                        RESOURCE_TYPE role_card_type                                RESOURCE role_card                              ACTION    export              CONDITION full_access;

POLICY role_card_via_order__update__role_system_is_controlled_system                              RESOURCE_TYPE role_card_via_order_type                      RESOURCE role_card_via_order                    ACTION    update              CONDITION role_system_is_controlled_system;

POLICY ordr_types_dictionary__read__full_access                                                   RESOURCE_TYPE dictionary_type                               RESOURCE ordr_types_dictionary                  ACTION    read                CONDITION full_access;
POLICY ordr_states_dictionary__read__full_access                                                  RESOURCE_TYPE dictionary_type                               RESOURCE ordr_states_dictionary                 ACTION    read                CONDITION full_access;
POLICY role_states_dictionary__read__full_access                                                  RESOURCE_TYPE dictionary_type                               RESOURCE role_states_dictionary                 ACTION    read                CONDITION full_access;
POLICY ordr_card__read__full_access                                                               RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    read                CONDITION full_access;
POLICY ordr_card__read__is_control_object                                                         RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    read                CONDITION is_control_object;
POLICY ordr_card__read__control_object_from_controlled_system                                     RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    read                CONDITION control_object_from_controlled_system;
POLICY ordr_card__read__current_profile_is_author                                                 RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    read                CONDITION current_profile_is_author;

POLICY ordr_cards__read__full_access                                                              RESOURCE_TYPE ordr_cards_type                               RESOURCE ordr_cards                             ACTION    read                CONDITION full_access;

POLICY ordr_card__export__full_access                                                             RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    export              CONDITION full_access;
POLICY ordr_card__export__is_control_object                                                       RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    export              CONDITION is_control_object;
POLICY ordr_card__export__control_object_from_controlled_system                                   RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    export              CONDITION control_object_from_controlled_system;
POLICY ordr_card__export__current_profile_is_author                                               RESOURCE_TYPE ordr_card_type                                RESOURCE ordr_card                              ACTION    export              CONDITION current_profile_is_author;

POLICY ordr_cards__export__full_access                                                            RESOURCE_TYPE ordr_cards_type                               RESOURCE ordr_cards                             ACTION    export              CONDITION full_access;

POLICY decision__create__ordr_type_is_usr_reg                                                     RESOURCE_TYPE decision_type                                 RESOURCE decision                               ACTION    create              CONDITION ordr_type_is_usr_reg;
POLICY decision__create__ordr_type_is_change_account_data                                         RESOURCE_TYPE decision_type                                 RESOURCE decision                               ACTION    create              CONDITION ordr_type_is_change_account_data;
POLICY decision__create__ordr_type_is_change_user_profile_positions                               RESOURCE_TYPE decision_type                                 RESOURCE decision                               ACTION    create              CONDITION ordr_type_is_change_user_profile_positions;

POLICY info_systems__read__full_access                                                            RESOURCE_TYPE info_systems_type                             RESOURCE info_systems                           ACTION    read                CONDITION full_access;

POLICY info_system_cards__read__full_access                                                       RESOURCE_TYPE info_system_cards_type                        RESOURCE info_system_cards                      ACTION    read                CONDITION full_access;

POLICY info_system_card__read__full_access                                                        RESOURCE_TYPE info_system_card_type                         RESOURCE info_system_card                       ACTION    read                CONDITION full_access;
POLICY info_system_card__read__system_is_controlled_system                                        RESOURCE_TYPE info_system_card_type                         RESOURCE info_system_card                       ACTION    read                CONDITION system_is_controlled_system;

POLICY info_system_card_via_order__create__full_access                                            RESOURCE_TYPE info_system_card_via_order_type               RESOURCE info_system_card_via_order             ACTION    create              CONDITION full_access;
POLICY info_system_card_via_order__update__system_is_controlled_system                            RESOURCE_TYPE info_system_card_via_order_type               RESOURCE info_system_card_via_order             ACTION    update              CONDITION system_is_controlled_system;

POLICY info_systems_filter_roles__read__full_access                                               RESOURCE_TYPE info_systems_filter_roles_type                RESOURCE info_systems_to_filter_roles           ACTION    read                CONDITION full_access;
POLICY info_systems_filter_roles__read__system_is_controlled_system                               RESOURCE_TYPE info_systems_filter_roles_type                RESOURCE info_systems_to_filter_roles           ACTION    read                CONDITION system_is_controlled_system;

POLICY info_systems_filter_orders__read__full_access                                              RESOURCE_TYPE info_systems_filter_orders_type               RESOURCE info_systems_to_filter_orders          ACTION    read                CONDITION full_access;
POLICY info_systems_filter_orders__read__system_is_controlled_system                              RESOURCE_TYPE info_systems_filter_orders_type               RESOURCE info_systems_to_filter_orders          ACTION    read                CONDITION system_is_controlled_system;

POLICY info_systems_to_filter_user_profiles__read__full_access                                    RESOURCE_TYPE info_systems_to_filter_user_profiles_type     RESOURCE info_systems_to_filter_user_profiles   ACTION    read                CONDITION full_access;
POLICY info_systems_to_filter_user_profiles__read__system_is_controlled_system                    RESOURCE_TYPE info_systems_to_filter_user_profiles_type     RESOURCE info_systems_to_filter_user_profiles   ACTION    read                CONDITION system_is_controlled_system;

POLICY info_systems_export_role_politics__read__system_is_controlled_system                       RESOURCE_TYPE info_systems_export_role_politics_type        RESOURCE info_systems_to_export_role_politics   ACTION    read                CONDITION system_is_controlled_system;

POLICY info_systems_possible__read__current_profile_is_owner_system_is_not_xidbox                 RESOURCE_TYPE info_systems_possible_type                    RESOURCE info_systems_possible                  ACTION    read                CONDITION current_profile_is_owner_system_is_not_xidbox;
POLICY info_systems_possible__read__system_is_xidbox                                              RESOURCE_TYPE info_systems_possible_type                    RESOURCE info_systems_possible                  ACTION    read                CONDITION system_is_xidbox;
POLICY info_systems_possible__read__system_is_not_xidbox                                          RESOURCE_TYPE info_systems_possible_type                    RESOURCE info_systems_possible                  ACTION    read                CONDITION system_is_not_xidbox;

POLICY info_systems_controlled__read__full_access                                                 RESOURCE_TYPE info_systems_controlled_type                  RESOURCE info_systems_controlled                ACTION    read                CONDITION full_access;

POLICY info_system_authn_types_dictionary__read__full_access                                      RESOURCE_TYPE info_system_authn_types_dictionary_type       RESOURCE info_system_authn_types_dictionary     ACTION    read                CONDITION full_access;

POLICY ordr_report__read__full_access                                                             RESOURCE_TYPE ordr_report_type                              RESOURCE ordr_report                            ACTION    read                CONDITION full_access;
POLICY ordr_report__read__is_control_object                                                       RESOURCE_TYPE ordr_report_type                              RESOURCE ordr_report                            ACTION    read                CONDITION is_control_object;
POLICY ordr_report__read__control_object_from_controlled_system                                   RESOURCE_TYPE ordr_report_type                              RESOURCE ordr_report                            ACTION    read                CONDITION control_object_from_controlled_system;

POLICY token_to_verify_user_email__send__full_access                                              RESOURCE_TYPE token_to_verify_user_email_type               RESOURCE token_to_verify_user_email             ACTION    send                CONDITION full_access;

POLICY token_to_verify_user_profile_email__send__full_access                                      RESOURCE_TYPE token_to_verify_user_profile_email_type       RESOURCE token_to_verify_user_profile_email     ACTION    send                CONDITION full_access;
POLICY token_to_verify_user_profile_email__send__current_profile_is_owner                         RESOURCE_TYPE token_to_verify_user_profile_email_type       RESOURCE token_to_verify_user_profile_email     ACTION    send                CONDITION current_profile_is_owner;

POLICY organizational_structure_departments__read__full_access                                    RESOURCE_TYPE organizational_structure_departments_type     RESOURCE organizational_structure_departments   ACTION    read                CONDITION full_access;
POLICY organizational_structure_positions__read__full_access                                      RESOURCE_TYPE organizational_structure_positions_type       RESOURCE organizational_structure_positions     ACTION    read                CONDITION full_access;

POLICY user_sessions_via_order__delete__current_user_is_not_own_profile                           RESOURCE_TYPE user_sessions_via_order_type                  RESOURCE user_sessions_via_order                ACTION    delete              CONDITION current_user_is_not_own_profile;
POLICY user_sessions__delete__current_profile_is_owner                                            RESOURCE_TYPE user_sessions_type                            RESOURCE user_sessions                          ACTION    delete              CONDITION current_profile_is_owner;
POLICY user_sessions__read__current_user_is_not_own_profile                                       RESOURCE_TYPE user_sessions_type                            RESOURCE user_sessions                          ACTION    read                CONDITION current_user_is_not_own_profile;
POLICY user_sessions__read__current_profile_is_owner                                              RESOURCE_TYPE user_sessions_type                            RESOURCE user_sessions                          ACTION    read                CONDITION current_profile_is_owner;
------------------------------------------
----------------ROLE BLOCK----------------
ROLE user
  LABEL Пользователь
  ENABLED;
ROLE information_system_manager
  LABEL Менеджер информационной системы
  ENABLED
  NEED_CONTROLLED_INFO_SYSTEM
  PRIVILEGED;
ROLE account_manager
  LABEL Менеджер учетных записей
  ENABLED
  PRIVILEGED;
ROLE security_administrator
  LABEL Администратор ИБ
  ENABLED
  PRIVILEGED;
ROLE system_administrator
  LABEL Системный администратор
  ENABLED
  PRIVILEGED;
------------------------------------------
--------ROLE POLICY RELATION BLOCK--------
ACCESS_RULE user
    POLICY
        organization_card__read__current_user_belongs_to_organizations
        organization_core_fields__read__current_user_belongs_to_organizations
        organization_core_fields_storage__read__current_user_belongs_to_organizations
        organization_dynamic_fields__read__current_user_belongs_to_organizations
        organization_dynamic_fields_storage__read__current_user_belongs_to_organizations
        organization_types_dictionary__read__full_access
        organization_states_dictionary__read__full_access
        sub_organization_card__read__full_access
        sub_organization_cards__read__current_user_belongs_to_organizations
        sub_organization_rules__read__full_access
        user_card__read__current_user_is_owner
        user_dynamic_fields__read__current_user_is_owner
        user_dynamic_fields_storage__read__current_user_is_owner
        user_core_fields__read__current_user_is_owner
        user_core_fields_storage__read__current_user_is_owner
        user_card_via_order__update__current_user_is_owner
        user_oauth_consent_via_order__delete__current_user_is_owner
        user_states_dictionary__read__full_access
        user_profile_role__read__current_user_is_own_profile
        user_profile_roles__read__current_user_is_own_profile
        user_profile_role_possible__read__current_profile_is_owner_role_is_not_xidbox
        user_profile_roles_possible__read__current_profile_is_owner
        user_profile_role_via_order__update__current_profile_is_owner_role_is_not_xidbox
        user_profile_roles_via_order__update__current_profile_is_owner
        user_profile_position__read__current_user_is_own_profile
        user_profile_positions__read__current_user_is_own_profile
        user_profile_position_via_order__update__full_access
        user_profile_positions_via_order__update__current_profile_is_owner
        user_password_via_order__update__current_user_is_owner
        user_profile_card__read__current_user_is_own_profile
        user_profile_core_fields__read__current_user_is_own_profile
        user_profile_core_fields_storage__read__current_user_is_own_profile
        user_profile_dynamic_fields__read__current_user_is_own_profile
        user_profile_dynamic_fields_storage__read__current_user_is_own_profile
        user_profile_state_info__read__current_user_is_own_profile
        user_profile_card_via_order__update__current_profile_is_owner
        user_profile_card_user_info__read__current_user_is_owner
        user_profile_states_dictionary__read__full_access
        user_profile_role_states_dictionary__read__full_access
        user_profile_cards_for_user_card__read__current_user_is_owner
        user_profile_session_history__read__current_profile_is_owner
        user_authn_info__read__current_user_is_owner
        user_state_info__read__current_user_is_owner
        user_cert__read__current_user_is_owner
        user_cert__delete__current_user_is_cert_owner
        user_cert_via_order__update__current_user_is_owner
        ordr_types_dictionary__read__full_access
        ordr_states_dictionary__read__full_access
        role_states_dictionary__read__full_access
        ordr_card__read__is_control_object
        ordr_card__read__current_profile_is_author
        ordr_card__export__is_control_object
        ordr_card__export__current_profile_is_author
        ordr_report__read__is_control_object
        ordr_cards__read__full_access
        ordr_cards__export__full_access
        info_systems__read__full_access
        info_systems_possible__read__current_profile_is_owner_system_is_not_xidbox
        token_to_verify_user_profile_email__send__current_profile_is_owner
        organizational_structure_departments__read__full_access
        organizational_structure_positions__read__full_access
        role_groups_to_filter_roles__read__full_access
        role_combinings__read__full_access
        security_settings_signature__read__full_access
        security_settings_addition__read__full_access
        user_sessions__delete__current_profile_is_owner
        user_sessions__read__current_profile_is_owner
    ;
ACCESS_RULE system_administrator
    POLICY
        organization_card__read__full_access
        organization_core_fields__read__full_access
        organization_core_fields_storage__read__full_access
        organization_dynamic_fields__read__full_access
        organization_dynamic_fields_storage__read__full_access
        organization_cards__read__full_access
        organization_card__export__full_access
        organization_core_fields__export__full_access
        organization_core_fields_storage__export__full_access
        organization_dynamic_fields_storage__export__full_access
        organization_dynamic_fields__export__full_access
        organization_cards__export__full_access
        sub_organization_cards__read__full_access
        user_card__read__full_access
        user_dynamic_fields__read__full_access
        user_dynamic_fields_storage__read__full_access
        user_core_fields__read__full_access
        user_core_fields_storage__read__full_access
        user_cards__read__full_access
        user_card__export__full_access
        user_dynamic_fields__export__full_access
        user_dynamic_fields_storage__export__full_access
        user_core_fields__export__full_access
        user_core_fields_storage__export__full_access
        user_cards__export__full_access
        user_cards_via_order__create__full_access
        user_card_via_order__create__full_access
        user_authn_info__full_access
        user_state_info__read__full_access
        user_cert__read__full_access
        user_profile_role__read__full_access
        user_profile_roles__read__full_access
        user_profile_role_possible__read__role_system_is_xidbox_and_not_user
        user_profile_roles_possible__read__full_access
        user_profile_role_via_order__update__role_system_is_xidbox_and_not_user
        user_profile_roles_via_order__update__full_access
        user_profile_position__read__full_access
        user_profile_positions__read__full_access
        user_profile_session_history__read__full_access
        user_card_via_order__temporarily_block__current_user_is_not_owner
        user_card_via_order__permanent_block__current_user_is_not_owner
        user_card_via_order__unblock__current_user_is_not_owner
        user_password_via_order__reset__current_user_is_not_owner
        user_profile_card__read__full_access
        user_profile_core_fields__read__full_access
        user_profile_core_fields_storage__read__full_access
        user_profile_dynamic_fields__read__full_access
        user_profile_dynamic_fields_storage__read__full_access
        user_profile_state_info__read__full_access
        user_profile_card_via_order__permanent_block__current_user_is_not_own_profile
        user_profile_card_via_order__temporarily_block__current_user_is_not_own_profile
        user_profile_card_via_order__unblock__current_user_is_not_own_profile_org_is_active
        user_profile_cards__read__full_access
        user_profile_card__export__full_access
        user_profile_core_fields__export__full_access
        user_profile_dynamic_fields__export__full_access
        user_profile_core_fields_storage__export__full_access
        user_profile_dynamic_fields_storage__export__full_access
        user_profile_state_info__export__full_access
        user_profile_cards__export__full_access
        user_profile_cards_for_user_card__read__full_access
        user_profile_cards_for_organization_card__read__full_access
        user_profile_card_via_order__create__full_access
        user_profile_card_user_info__read__full_access
        organization_to_create_user_profile__read__full_access
        security_settings__read__full_access
        certification_authority__read__full_access
        certification_authorities__read__full_access
        mail_template__read_send__full_access
        mail_templates__read_send__full_access
        mail_template_via_order__update__full_access
        role_cards__read__full_access
        role_card__read__full_access
        role_combinings__read__full_access
        role_combinations__read__full_access
        role_cards__export__full_access
        role_card__export__full_access
        roles__read__full_access
        role_attributes__read__full_access
        roles_to_filter_user_profiles__read__full_access
        roles_to_filter_orders__read__full_access
        ordr_card__read__full_access
        ordr_card__export__full_access
        ordr_report__read__full_access
        info_systems_filter_roles__read__full_access
        info_systems_filter_orders__read__full_access
        info_systems_to_filter_user_profiles__read__full_access
        info_systems_possible__read__system_is_xidbox
        info_systems_controlled__read__full_access
        info_system_cards__read__full_access
        info_system_card__read__full_access
        info_system_card_via_order__create__full_access
        info_system_authn_types_dictionary__read__full_access
        token_to_verify_user_email__send__full_access
        token_to_verify_user_profile_email__send__full_access
        user_sessions_via_order__delete__current_user_is_not_own_profile
        user_sessions__read__current_user_is_not_own_profile
    ;
ACCESS_RULE security_administrator
    POLICY
        organization_card__read__full_access
        organization_core_fields__read__full_access
        organization_core_fields_storage__read__full_access
        organization_dynamic_fields__read__full_access
        organization_dynamic_fields_storage__read__full_access
        organization_cards__read__full_access
        organization_core_fields__export__full_access
        organization_core_fields_storage__export__full_access
        organization_dynamic_fields_storage__export__full_access
        organization_dynamic_fields__export__full_access
        organization_cards__export__full_access
        sub_organization_cards__read__full_access
        user_card__read__full_access
        user_cards__read__full_access
        user_card__export__full_access
        user_dynamic_fields__read__full_access
        user_dynamic_fields_storage__read__full_access
        user_core_fields__read__full_access
        user_core_fields_storage__read__full_access
        user_dynamic_fields__export__full_access
        user_dynamic_fields_storage__export__full_access
        user_core_fields__export__full_access
        user_core_fields_storage__export__full_access
        user_cards__export__full_access
        user_authn_info__full_access
        user_state_info__read__full_access
        user_cert__read__full_access
        user_profile_role__read__full_access
        user_profile_roles__read__full_access
        user_profile_session_history__read__full_access
        user_card_via_order__temporarily_block__current_user_is_not_owner
        user_card_via_order__permanent_block__current_user_is_not_owner
        user_card_via_order__unblock__current_user_is_not_owner
        user_password_via_order__reset__current_user_is_not_owner
        user_profile_position__read__full_access
        user_profile_positions__read__full_access
        user_profile_card__read__full_access
        user_profile_core_fields__read__full_access
        user_profile_core_fields_storage__read__full_access
        user_profile_dynamic_fields__read__full_access
        user_profile_dynamic_fields_storage__read__full_access
        user_profile_state_info__read__full_access
        user_profile_card_via_order__permanent_block__current_user_is_not_own_profile
        user_profile_card_via_order__temporarily_block__current_user_is_not_own_profile
        user_profile_card_via_order__unblock__current_user_is_not_own_profile_org_is_active
        user_profile_card_user_info__read__full_access
        user_profile_cards__read__full_access
        user_profile_card__export__full_access
        user_profile_core_fields__export__full_access
        user_profile_dynamic_fields__export__full_access
        user_profile_core_fields_storage__export__full_access
        user_profile_dynamic_fields_storage__export__full_access
        user_profile_state_info__export__full_access
        user_profile_cards__export__full_access
        user_profile_cards_for_user_card__read__full_access
        user_profile_cards_for_organization_card__read__full_access
        role_cards__read__full_access
        role_card__read__full_access
        role_combinings__read__full_access
        role_combinations__read__full_access
        role_cards__export__full_access
        role_card__export__full_access
        roles__read__full_access
        role_attributes__read__full_access
        roles_to_filter_user_profiles__read__full_access
        roles_to_filter_orders__read__full_access
        security_settings__read_update__full_access
        security_settings_via_order__update__full_access
        certification_authority__create_read_delete__full_access
        certification_authorities__create_read_delete__full_access
        ordr_card__read__full_access
        ordr_card__export__full_access
        ordr_report__read__full_access
        info_systems_filter_roles__read__full_access
        info_systems_filter_orders__read__full_access
        info_systems_to_filter_user_profiles__read__full_access
        info_system_cards__read__full_access
        info_system_card__read__full_access
        info_system_card_via_order__create__full_access
        info_system_authn_types_dictionary__read__full_access
        token_to_verify_user_email__send__full_access
        token_to_verify_user_profile_email__send__full_access
        user_sessions_via_order__delete__current_user_is_not_own_profile
        user_sessions__read__current_user_is_not_own_profile
    ;
ACCESS_RULE information_system_manager
    POLICY
        user_card__read__user_systems_contains_controlled_system
        user_dynamic_fields__read__user_systems_contains_controlled_system
        user_dynamic_fields_storage__read__user_systems_contains_controlled_system
        user_core_fields_storage__read__user_systems_contains_controlled_system
        user_core_fields__read__user_systems_contains_controlled_system
        user_cards__read__full_access
        user_card__export__user_systems_contains_controlled_system
        user_dynamic_fields__export__user_systems_contains_controlled_system
        user_dynamic_fields_storage__export__user_systems_contains_controlled_system
        user_core_fields__export__user_systems_contains_controlled_system
        user_core_fields_storage__export__user_systems_contains_controlled_system
        user_cards__export__full_access
        user_authn_info__user_systems_contains_controlled_system
        user_state_info__read__user_systems_contains_controlled_system
        user_cert__read__user_systems_contains_controlled_system
        user_profile_role__read__role_system_is_controlled_system
        user_profile_roles__read__profile_systems_contains_controlled_system
        user_profile_position__read__full_access
        user_profile_positions__read__profile_systems_contains_controlled_system
        user_profile_card__read__profile_systems_contains_controlled_system
        user_profile_core_fields__read__profile_systems_contains_controlled_system
        user_profile_core_fields_storage__read__profile_systems_contains_controlled_system
        user_profile_dynamic_fields__read__profile_systems_contains_controlled_system
        user_profile_dynamic_fields_storage__read__profile_systems_contains_controlled_system
        user_profile_state_info__read__profile_systems_contains_controlled_system
        user_profile_card__export__profile_systems_contains_controlled_system
        user_profile_core_fields__export__profile_systems_contains_controlled_system
        user_profile_core_fields_storage__export__profile_systems_contains_controlled_system
        user_profile_dynamic_fields__export__profile_systems_contains_controlled_system
        user_profile_dynamic_fields_storage__export__profile_systems_contains_controlled_system
        user_profile_state_info__export__profile_systems_contains_controlled_system
        user_profile_cards__read__full_access
        user_profile_cards__export__full_access
        user_profile_cards_for_user_card__read__user_systems_contains_controlled_system
        user_profile_card_user_info__read__user_systems_contains_controlled_system
        role_politics__export__system_is_controlled_system
        role_politics__create__system_is_controlled_system
        role_politics_via_order__create__full_access
        role_cards__read__full_access
        role_card__read__role_system_is_controlled_system
        role_combinings__read__role_system_is_controlled_system
        role_combinations__read__role_system_is_controlled_system
        role_cards__export__full_access
        role_card__export__role_system_is_controlled_system
        role_card_via_order__update__role_system_is_controlled_system
        roles__read__full_access
        role_attributes__read__full_access
        roles_to_filter_user_profiles__read__role_system_is_controlled_system
        roles_to_filter_orders__read__role_system_is_controlled_system
        ordr_report__read__control_object_from_controlled_system
        ordr_card__read__control_object_from_controlled_system
        ordr_card__export__control_object_from_controlled_system
        info_systems_filter_roles__read__system_is_controlled_system
        info_systems_filter_orders__read__system_is_controlled_system
        info_systems_export_role_politics__read__system_is_controlled_system
        info_systems_to_filter_user_profiles__read__system_is_controlled_system
        info_system_cards__read__full_access
        info_system_card_via_order__update__system_is_controlled_system
        info_system_card__read__system_is_controlled_system
        info_system_authn_types_dictionary__read__full_access
    ;
ACCESS_RULE account_manager
    POLICY
        organization_card__read__full_access
        organization_core_fields__read__full_access
        organization_core_fields_storage__read__full_access
        organization_dynamic_fields__read__full_access
        organization_dynamic_fields_storage__read__full_access
        organization_cards__read__full_access
        organization_card__export__full_access
        organization_core_fields__export__full_access
        organization_core_fields_storage__export__full_access
        organization_dynamic_fields_storage__export__full_access
        organization_dynamic_fields__export__full_access
        organization_cards__export__full_access
        sub_organization_cards__read__full_access
        user_card__read__full_access
        user_cards__read__full_access
        user_card__export__full_access
        user_dynamic_fields__read__full_access
        user_dynamic_fields_storage__read__full_access
        user_core_fields__read__full_access
        user_core_fields_storage__read__full_access
        user_dynamic_fields__export__full_access
        user_dynamic_fields_storage__export__full_access
        user_core_fields__export__full_access
        user_core_fields_storage__export__full_access
        user_cards__export__full_access
        user_cards_via_order__create__full_access
        user_card_via_order__update__full_access
        user_card_via_order__create__full_access
        user_card_via_order__delete__full_access
        user_authn_info__full_access
        user_state_info__read__full_access
        user_cert__read__full_access
        user_profile_role__read__full_access
        user_profile_roles__read__full_access
        user_profile_role_possible__read__role_system_is_not_xidbox
        user_profile_roles_possible__read__full_access
        user_profile_role_via_order__update__role_system_is_not_xidbox
        user_profile_roles_via_order__update__full_access
        user_profile_role_file_via_order__update__system_is_not_xidbox
        user_profile_roles_file_via_order_update__full_access
        user_profile_position__read__full_access
        user_profile_positions__read__full_access
        user_profile_positions__update__full_access
        user_profile_position_via_order__update__full_access
        user_profile_positions_via_order__update__full_access
        user_card_via_order__temporarily_block__current_user_is_not_owner
        user_card_via_order__permanent_block__current_user_is_not_owner
        user_card_via_order__unblock__current_user_is_not_owner
        user_login__update__full_access
        user_email__update__full_access
        user_password_via_order__reset__current_user_is_not_owner
        user_profile_card__read__full_access
        user_profile_core_fields__read__full_access
        user_profile_core_fields_storage__read__full_access
        user_profile_dynamic_fields__read__full_access
        user_profile_dynamic_fields_storage__read__full_access
        user_profile_state_info__read__full_access
        user_profile_card_via_order__update__full_access
        user_profile_card_via_order__permanent_block__current_user_is_not_own_profile
        user_profile_card_via_order__temporarily_block__current_user_is_not_own_profile
        user_profile_card_via_order__unblock__current_user_is_not_own_profile_org_is_active
        user_profile_card_user_info__read__full_access
        user_profile_cards__read__full_access
        user_profile_card__export__full_access
        user_profile_core_fields__export__full_access
        user_profile_dynamic_fields__export__full_access
        user_profile_core_fields_storage__export__full_access
        user_profile_dynamic_fields_storage__export__full_access
        user_profile_state_info__export__full_access
        user_profile_cards__export__full_access
        user_profile_cards_for_user_card__read__full_access
        user_profile_cards_for_organization_card__read__full_access
        user_profile_card_via_order__create__full_access
        user_profile_cards_via_order__create__full_access
        organization_to_create_user_profile__read__full_access
        roles__read__full_access
        role_attributes__read__full_access
        roles_to_filter_user_profiles__read__full_access
        roles_to_filter_orders__read__full_access
        role_combinings__read__full_access
        ordr_card__read__full_access
        ordr_card__export__full_access
        ordr_report__read__full_access
        decision__create__ordr_type_is_usr_reg
        decision__create__ordr_type_is_change_account_data
        decision__create__ordr_type_is_change_user_profile_positions
        info_systems_to_filter_user_profiles__read__full_access
        info_systems_possible__read__system_is_not_xidbox
        token_to_verify_user_email__send__full_access
        token_to_verify_user_profile_email__send__full_access
    ;
--------------------------------------------------------------
------------- APPROVAL RULE BLOCK------------------
APPROVAL_RULE system_administrator APPROVAL_ROLE security_administrator CONDITION full_access STAGE 1;