<!--
  ~ Copyright (c) 2024-2025 Evolveum and contributors
  ~
  ~ This work is dual-licensed under the Apache License 2.0
  ~ and European Union Public License. See LICENSE file for details.
  -->
<policy xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        oid="00000000-0000-0000-0000-000000000332">
    <name>Privileged access</name>
    <description>Classification used to label roles providing privileged access.</description>
    <documentation>
        This classification is meant to be applied to application roles, authorization roles and similar "leaf" roles.
        This classification sets "Privileged access" mark to roles that the mark is assigned to, and to users affected by the roles.
        Note: As of midPoint 4.10 and earlier, we cannot easily mark intermediary roles (such as business roles).
        (ISO27001/A.5.15,ISO27001/A.5.18,ISO27001/A.8.2,ISO27001/A.8.9)
    </documentation>
    <assignment id="1">
        <identifier>archetype</identifier>
        <targetRef oid="00000000-0000-0000-0000-000000000330" type="ArchetypeType"/>
    </assignment>
    <assignment id="2">
        <identifier>org-ad-hoc-classifications</identifier>
        <targetRef oid="f9259e1c-30af-4f69-b1f1-a2dd66234316" type="OrgType"/>
    </assignment>
    <inducement id="3">
        <identifier>mark-focus</identifier>
        <documentation>
            Any object (focus) which is classified with this classification will be also marked with the corresponding "Privileged access" mark.
        </documentation>
        <policyRule>
            <policyConstraints>
                <alwaysTrue>
                    <name>mark-focus-always-true</name>
                </alwaysTrue>
            </policyConstraints>
            <markRef oid="c58394cd-c883-4e41-927c-f90a7c7a0c97"/>
            <policyActions>
                <record/>
            </policyActions>
        </policyRule>
    </inducement>
    <inducement id="4">
        <identifier>mark-user</identifier>
        <documentation>
            Mark users that are (indirectly) affected by any role classified as privileged with "Privileged access" mark.
        </documentation>
        <policyRule>
            <policyConstraints>
                <alwaysTrue>
                    <name>mark-user-always-true</name>
                </alwaysTrue>
            </policyConstraints>
            <markRef oid="c58394cd-c883-4e41-927c-f90a7c7a0c97"/>
            <policyActions>
                <record/>
            </policyActions>
        </policyRule>
        <orderConstraint>
            <order>2</order>
        </orderConstraint>
        <focusType>UserType</focusType>
    </inducement>
</policy>
