<policy oid="8296304e-4722-4792-b6bd-9693b2a42d70" xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
    <name>Category III</name>
    <description>Classified for restricted access.</description>
    <assignment>
        <targetRef oid="00000000-0000-0000-0000-000000000330" type="ArchetypeType"/>
    </assignment>
    <inducement>
        <targetRef oid="71a7cb99-3a69-48e3-9521-d9a933c2b5c5" type="PolicyType"/>
    </inducement>
    <inducement>
        <policyRule>
            <name>required-special-training</name>
            <policyConstraints>
                <requirement>
                    <targetRef oid="5bb5c5b5-eca2-4129-b73f-34c0b0bd2736" type="PolicyType" />
                </requirement>
            </policyConstraints>
            <policyActions>
                <enforcement>
                    <documentation>Strict requirement, policy rule is enforced.</documentation>
                </enforcement>
            </policyActions>
        </policyRule>
    </inducement>
    <inducement id="4">
        <orderConstraint>
            <order>2</order>
        </orderConstraint>
        <focusType>UserType</focusType>
        <focusMappings>
            <mapping>
                <strength>strong</strength>
                <expression>
                    <value>Category III</value>
                </expression>
                <target>
                    <path>extension/accessCategory</path>
                </target>
            </mapping>
        </focusMappings>
    </inducement>
    <inducement>
        <focusType>ServiceType</focusType>
        <focusMappings>
            <mapping>
                <strength>strong</strength>
                <expression>
                    <value>Category III</value>
                </expression>
                <condition>
                    <description>
                        Dirty hack.
                        We want to store this value only if it is direct assignment.
                        We do not want to show classification hierarchy.
                    </description>
                    <script>
                        <code>immediateRole instanceof com.evolveum.midpoint.xml.ns._public.common.common_3.ServiceType</code>
                    </script>
                </condition>
                <target>
                    <path>extension/accessCategory</path>
                </target>
            </mapping>
        </focusMappings>
    </inducement>
</policy>
