<?xml version="1.0" encoding="UTF-8" standalone="no"?><!--
  ~ Copyright (C) 2010-2021 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  --><xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:jaxb="https://jakarta.ee/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" elementFormDefault="qualified" jaxb:extensionBindingPrefixes="xjc" jaxb:version="3.0" targetNamespace="http://midpoint.evolveum.com/xml/ns/public/common/common-3">

    <xsd:annotation>
        <xsd:documentation>
            TODO
        </xsd:documentation>
    </xsd:annotation>

    <!-- Don't provide schemaLocation here, as it causes xjc to really contact the URIs (!) -->
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/annotation-3" schemaLocation="../annotation-3.xsd"/>
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/types-3" schemaLocation="../types-3.xsd"/>
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/query-3" schemaLocation="../query-3.xsd"/>
    <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3" schemaLocation="../model/scripting/scripting-3.xsd"/>

    <xsd:include schemaLocation="common-core-3.xsd"/>
    <xsd:include schemaLocation="common-gui-3.xsd"/>
    <xsd:include schemaLocation="common-workflows-3.xsd"/>
    <xsd:include schemaLocation="common-model-context-3.xsd"/>

    <xsd:complexType name="PolicyConstraintsType">
        <xsd:annotation>
            <xsd:documentation>
                Set of governance, risk management, compliance (GRC) and similar policy constraints
                that influence the identity model. These constraints act as triggers for the rules.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectState" type="tns:StatePolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Particular state of the object, described by a filter or an expression.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>PolicyConstraintsType.objectState</a:displayName>
                                <a:help>PolicyConstraintsType.objectState.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="assignmentState" type="tns:StatePolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Particular state of an assignment, described by a filter or an expression.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>PolicyConstraintsType.assignmentState</a:displayName>
                                <a:help>PolicyConstraintsType.assignmentState.help</a:help>
                                <a:schemaContext>
                                    <a:type>tns:AssignmentHolderType</a:type>
                                    <a:path>assignment</a:path>
                                </a:schemaContext>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="hasAssignment" type="tns:HasAssignmentPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The focus has assignment(s) of given object(s).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>PolicyConstraintsType.hasAssignment</a:displayName>
                                <a:help>PolicyConstraintsType.hasAssignment.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="hasNoAssignment" type="tns:HasAssignmentPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The focus has no assignment(s) of given object(s).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>PolicyConstraintsType.hasNoAssignment</a:displayName>
                                <a:help>PolicyConstraintsType.hasNoAssignment.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="requirement" type="tns:ExclusionPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Requirement constraint.
                                Constraint that mandates that this object to be assigned together with other object.
                                It can be used to require presence of clearances, job roles, require assignment of specific organization units, etc.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.9</a:since>
                                <a:displayName>PolicyConstraintsType.requirement</a:displayName>
                                <a:help>PolicyConstraintsType.requirement.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="exclusion" type="tns:ExclusionPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Exclusion constraint.
                                Constraint that forbids this object to be assigned together with other object.
                                It is usually used to enforce segregation of duty (SoD) policies.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>PolicyConstraintsType.exclusion</a:displayName>
                                <a:help>PolicyConstraintsType.exclusion.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="minAssignees" type="tns:MultiplicityPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Actual number of objects that have this role assigned is lower than prescribed value.
                                (The constraint should be perhaps named minAssigneesViolation.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>PolicyConstraintsType.minAssignees</a:displayName>
                                <a:help>PolicyConstraintsType.minAssignees.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="maxAssignees" type="tns:MultiplicityPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Actual number of objects that have this role assigned is higher than prescribed value.
                                (The constraint should be perhaps named maxAssigneesViolation.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>PolicyConstraintsType.maxAssignees</a:displayName>
                                <a:help>PolicyConstraintsType.maxAssignees.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectMinAssigneesViolation" type="tns:MultiplicityPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Actual number of objects that have this object (e.g. role) assigned is lower than prescribed value.
                                This is the same as minAssignees, but indicates that the constraint should be evaluated against an object
                                when evaluating object constraints. HIGHLY EXPERIMENTAL
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:displayName>PolicyConstraintsType.objectMinAssigneesViolation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectMaxAssigneesViolation" type="tns:MultiplicityPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Actual number of objects that have this object (e.g. role) assigned is higher than prescribed value.
                                This is the same as minAssignees, but indicates that the constraint should be evaluated against an object
                                when evaluating object constraints. HIGHLY EXPERIMENTAL
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:displayName>PolicyConstraintsType.objectMaxAssigneesViolation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="modification" type="tns:ModificationPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Constraint that triggers when the object is modified.
                                Modification of the object (add, modify, delete).
                                (This constraint should be perhaps named objectModification.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>PolicyConstraintsType.modification</a:displayName>
                                <a:help>PolicyConstraintsType.modification.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="assignment" type="tns:AssignmentModificationPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Constraint that triggers when the object is assigned, unassigned or the assignment is modified.
                                Modification of an assignment, i.e. where this object is a target of assignment that is being modified.
                                (This constraint should be perhaps named assignmentModification.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>PolicyConstraintsType.assignment</a:displayName>
                                <a:help>PolicyConstraintsType.assignment.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectTimeValidity" type="tns:TimeValidityPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A constraint that triggers when validity of an object or any of its time-sensitive
                                items (e.g. password) is about to end.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.6</a:since>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.objectTimeValidity</a:displayName>
                                    <a:help>PolicyConstraintsType.objectTimeValidity.help</a:help>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="assignmentTimeValidity" type="tns:TimeValidityPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A constraint that triggers when validity of an assignment or any of its time-sensitive
                                items (e.g. password) is about to end.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.6</a:since>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.assignmentTimeValidity</a:displayName>
                                    <a:help>PolicyConstraintsType.assignmentTimeValidity.help</a:help>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="situation" type="tns:PolicySituationPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Occurrence of the policy situation within an object or an assignment.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.situation</a:displayName>
                                    <a:help>PolicyConstraintsType.situation.help</a:help>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="custom" type="tns:CustomPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Custom ways of evaluating a policy constraint. Used typically for transitional constraints.
                                (State-based custom ones can always be evaluated using `objectState` constraint.)

                                TODO reconsider the name
                            </xsd:documentation>
                            <xsd:appinfo>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.custom</a:displayName>
                                    <a:help>PolicyConstraintsType.custom.help</a:help>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="collectionStats" type="tns:CollectionStatsPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Constraints for collection stats (statistics). Can be used to trigger policy
                                    rules on the number of objects in collection, percentage and so on.
                                </p>
                                <p>
                                    Policy rules with this constraint are ignored during normal processing.
                                    Evaluation of such policy rules require special handling (e.g. scanner task).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.collectionStats</a:displayName>
                                    <a:help>PolicyConstraintsType.collectionStats.help</a:help>
                                    <a:since>4.0</a:since>
                                    <a:experimental>true</a:experimental>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="alwaysTrue" type="tns:AlwaysTruePolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                This constraint always applies.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:elaborate>true</a:elaborate>
                                <a:displayName>PolicyConstraintsType.alwaysTrue</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="orphaned" type="tns:OrphanedPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object (currently supported are tasks) is orphaned i.e. has declared a parent but the parent does not exist.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:experimental>true</a:experimental>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.orphaned</a:displayName>
                                    <a:help>PolicyConstraintsType.orphaned.help</a:help>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="and" type="tns:PolicyConstraintsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Constraints that must all apply. (But note that if there are more values of this item,
                                they are interpreted according to the enclosing operator.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:elaborate>true</a:elaborate>
                                <a:displayName>PolicyConstraintsType.and</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="or" type="tns:PolicyConstraintsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Constraints from which at least one must apply. (But note that if there are more values of this item,
                                they are interpreted according to the enclosing operator.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:elaborate>true</a:elaborate>
                                <a:displayName>PolicyConstraintsType.or</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="not" type="tns:PolicyConstraintsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The inner constraint must not apply.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:elaborate>true</a:elaborate>
                                <a:displayName>PolicyConstraintsType.not</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="transition" type="tns:TransitionPolicyConstraintType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies how the inner constraints are to be evaluated with regard to operation start and end state.
                                May not include any transitional constraints itself!
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.transition</a:displayName>
                                    <a:help>PolicyConstraintsType.transition.help</a:help>
                                    <a:elaborate>true</a:elaborate>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="ref" type="tns:PolicyConstraintReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                References another policy constraint e.g. by its name.
                                The referenced constraint must be present as part of policy rules gathered for a given
                                assignment or object. Also, all declared global constraints are available for referencing,
                                regardless of which objects they are attached to or whether they are active or not.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <xsd:appinfo>
                                    <a:displayName>PolicyConstraintsType.ref</a:displayName>
                                    <a:help>PolicyConstraintsType.ref.help</a:help>
                                </xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
        <!--<xsd:attribute name="id" type="xsd:long"/>--> <!-- already present in the abstract constraint -->
    </xsd:complexType>

    <xsd:complexType name="PolicyConstraintReferenceType">
        <xsd:annotation>
            <xsd:documentation>
                References another policy constraint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the constraint referenced.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyConstraintReferenceType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
                <!-- parameters, if the referenced constraint is a parametrized one -->
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Basic data structure for all policy constraints.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:enforcement</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of the constraint. It is used when midPoint
                        needs to refer to a specific constraint, e.g. in order
                        to record exception.
                        This element is formally specified as optional, mostly
                        due to the compatibility reasons. But it
                        has to be provided in order for some functionality to
                        work correctly.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                        <xsd:appinfo>
                            <a:displayName>AbstractPolicyConstraintType.name</a:displayName>
                            <a:help>AbstractPolicyConstraintType.name.help</a:help>
                        </xsd:appinfo>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AbstractPolicyConstraintType.description</a:displayName>
                        <a:help>AbstractPolicyConstraintType.description.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="presentation" type="tns:PolicyConstraintPresentationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should be triggering of this constraint presented, e.g. in enforcement messages,
                        in approvals, in certification, in notifications, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                        <a:displayName>AbstractPolicyConstraintType.presentation</a:displayName>
                        <a:help>AbstractPolicyConstraintType.presentation.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="abstractPolicyConstraint" type="tns:AbstractPolicyConstraintType"/>

    <xsd:complexType name="PolicyConstraintPresentationType">
        <xsd:annotation>
            <xsd:documentation>
                How should be triggering of this constraint presented, e.g. in enforcement messages,
                in approvals, in certification, in notifications, etc.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="message" type="tns:LocalizableMessageTemplateType">
                <xsd:annotation>
                    <xsd:documentation>
                        Message to be conveyed to the user.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyConstraintPresentationType.message</a:displayName>
                        <a:help>PolicyConstraintPresentationType.message.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="shortMessage" type="tns:LocalizableMessageTemplateType">
                <xsd:annotation>
                    <xsd:documentation>
                        Very short message describing the situation. Could be used for e.g. notification messages subject, approval process or work item names.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyConstraintPresentationType.shortMessage</a:displayName>
                        <a:help>PolicyConstraintPresentationType.shortMessage.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="longMessage" type="tns:LocalizableMessageTemplateType">
                <xsd:annotation>
                    <xsd:documentation>
                        Long, documentation-like explanation of the rule.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyConstraintPresentationType.longMessage</a:displayName>
                        <a:help>PolicyConstraintPresentationType.longMessage.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- todo something like GUI component id/type -->
            <xsd:element minOccurs="0" name="final" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, no embedded triggers will be presented. Use for hiding constraints that are
                        to be considered too technical to be shown to user. EXPERIMENTAL
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:displayName>PolicyConstraintPresentationType.final</a:displayName>
                        <a:help>PolicyConstraintPresentationType.final.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="hidden" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, this trigger will be excluded from presentation. EXPERIMENTAL
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:displayName>PolicyConstraintPresentationType.hidden</a:displayName>
                        <a:help>PolicyConstraintPresentationType.hidden.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="displayOrder" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Ordinal number that determines ordering of displayed messages. EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:displayName>PolicyConstraintPresentationType.displayOrder</a:displayName>
                        <a:help>PolicyConstraintPresentationType.displayOrder.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="policyConstraintPresentation" type="tns:PolicyConstraintPresentationType"/>

    <xsd:simpleType name="TriggeredPolicyRulesStorageStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                How much information about triggered policy rules should be stored?
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        Triggered policy rules will not be stored.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="messageOnly">
                <xsd:annotation>
                    <xsd:documentation>
                        Only message and short message for each trigger will be stored. Hidden and final presentation settings are respected.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MESSAGE_ONLY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="full">
                <xsd:annotation>
                    <xsd:documentation>
                        The triggers and other information for the rule will be stored (including subtriggers).
                        Hidden and final presentation settings are respected.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ExclusionPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Container that defines exclusion of entities (e.g. roles).
                It is a part of Segregation of Duties (SoD) mechanism.

                or

                Container that defines requirement between entities (e.g. roles, clearances).
                It is a part of classification/clearance mechanism.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>ExclusionPolicyConstraintType.details</a:displayName>
                <a:schemaMigration>
                    <a:element>tns:policy</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="targetRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Target of exclusion/requirement. The object defining this "exclusion" and
                                the object defined as target cannot be assigned at the same time.
                                the object defined as target cannot be assigned at the same time.
                                In case of "requirement", the required object must be assigned.
                                Filter in the reference may be used to dynamically exclude broader
                                range of roles - assuming that runtime resolution is used.

                                or

                                If script expression is used in the filter, following variables are available:
                                - `policyRule`: currently evaluated policy rule (type EvaluatedPolicyRule)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:AbstractRoleType</a:objectReferenceTargetType>
                                <a:displayName>ExclusionPolicyConstraintType.targetRef</a:displayName>
                                <a:help>ExclusionPolicyConstraintType.targetRef.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="orderConstraint" type="tns:OrderConstraintsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of relation(s) when this exclusion constraint should be applied at the source side.
                                (I.e. this is evaluated against the object defining this exclusion constraint.)
                                The default is "order = 1".

                                Limitation: Currently it does not work with non-member relations because of assignment
                                evaluation optimizations (see TestSegregationOfDuties.test950JackSelfExclusion). So it can
                                be used only for default and manager relations.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7.1</a:since>
                                <a:displayName>ExclusionPolicyConstraintType.orderConstraint</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="targetOrderConstraint" type="tns:OrderConstraintsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of relation(s) when this exclusion constraint should be applied at the target side.
                                (I.e. this is evaluated against the target object.)
                                The default is "order = 1".

                                Limitation: Currently it does not work with non-member relations because of assignment
                                evaluation optimizations (see TestSegregationOfDuties.test950JackSelfExclusion). So it can
                                be used only for default and manager relations.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7.1</a:since>
                                <a:displayName>ExclusionPolicyConstraintType.targetOrderConstraint</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="targetArchetypeRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Excluding/requiring target objects that have this archetype.
                                The object defining this "exclusion" and
                                the object defined as target cannot be assigned at the same time.
                                In case of "requirement", the required object must be assigned.

                                Filter in the reference is NOT supported.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.10</a:since>
                                <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                                <a:displayName>ExclusionPolicyConstraintType.targetArchetypeRef</a:displayName>
                                <a:help>ExclusionPolicyConstraintType.targetArchetypeRef.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="exclusionPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:ExclusionPolicyConstraintType"/>

    <xsd:complexType name="MultiplicityPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Constraint on multiplicity of assigned objects.
                (Other multiplicity requirements will be probably treated in separate constraints, like "constraint that
                restricts value(s) of given item, based on a set of conditions that must be met".)
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element name="multiplicity" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Numeric value or string "unbounded".
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MultiplicityPolicyConstraintType.multiplicity</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Relation(s) to which this constraint applies. All of these relations must match
                                the defined multiplicity. If no relation is present, org:default (i.e. null) is assumed.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MultiplicityPolicyConstraintType.relation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO something like "assigned" vs. "effective" - i.e. if we watch assignments created
                    or assignments that are actually "alive" (i.e. enabled and with condition = true) -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="minAssigneesPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:MultiplicityPolicyConstraintType"/>
    <xsd:element name="maxAssigneesPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:MultiplicityPolicyConstraintType"/>

    <xsd:complexType name="ModificationPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Constraint that triggers the rule on object modification, addition or deletion.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:merger>ModificationPolicyConstraintType</a:merger>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="operation" type="t:ChangeTypeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies the operation(s) for which this constraints should be triggered.
                                If not specified then it will be triggered for all operations.
                                This defines the object operation (add/modify/delete of the entire object)
                                or assignment operation (add/modify/delete of the given assignment).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ModificationPolicyConstraintType.operation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of items that must be modified (all of them) in order for this
                                constraint be triggered. If no items are specified then any modification will
                                trigger this constraint. The item paths should not contain container value IDs.

                                The values are considered along with the values of "specialItem".
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ModificationPolicyConstraintType.item</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="specialItem" type="tns:SpecialItemSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of (special) items that must be modified (all of them) in order for this
                                constraint be triggered. If no items are specified then any modification will
                                trigger this constraint.

                                The values are considered along with the values of "item".

                                Currently supported only for MODIFY deltas.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ModificationPolicyConstraintType.item</a:displayName>
                                <a:since>4.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="exactPathMatch" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If true, item paths to be matched must match exactly. E.g. if "inducement" is specified
                                as an item to be matched, then only object modifications having "inducement" in the path
                                (i.e. whole inducement being added/deleted/replaced) would match.

                                This is applicable only for modification operations. For add and delete operations the
                                value of this flag is ignored.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>ModificationPolicyConstraintType.exactPathMatch</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="expression" type="c:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expression that is used to determine the result. It is evaluated in addition to all the other
                                conditions, and must have a value of true in order for constraint to be triggered.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>ModificationPolicyConstraintType.expression</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!--<xsd:element name="ignoreItem" type="t:ItemPathType"  minOccurs="0" maxOccurs="unbounded">-->
                        <!--<xsd:annotation>-->
                            <!--<xsd:documentation>-->
                                <!--Modifications of these items are to be ignored.-->
                                <!--EXPERIMENTAL-->
                            <!--</xsd:documentation>-->
                            <!--<xsd:appinfo>-->
                                <!--<a:experimental>true</a:experimental>-->
                                <!--<a:since>3.7</a:since>-->
                            <!--</xsd:appinfo>-->
                        <!--</xsd:annotation>-->
                    <!--</xsd:element>-->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="modificationPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:ModificationPolicyConstraintType"/>

    <xsd:simpleType name="SpecialItemSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of a special item that cannot be described by a (fixed) item path.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="resourceObjectNamingAttribute">
                <xsd:annotation>
                    <xsd:documentation>
                        The naming attribute of a resource object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCE_OBJECT_NAMING_ATTRIBUTE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="resourceObjectIdentifier">
                <xsd:annotation>
                    <xsd:documentation>
                        A primary or secondary identifier of a resource object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCE_OBJECT_IDENTIFIER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="resourceObjectEntitlement">
                <xsd:annotation>
                    <xsd:documentation>
                        An entitlement of a resource object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCE_OBJECT_ENTITLEMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="resourceObjectItem">
                <xsd:annotation>
                    <xsd:documentation>
                        Any item on a resource object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCE_OBJECT_ITEM"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AssignmentModificationPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Constraint that triggers the rule when the object is assigned.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ModificationPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                This constraint only applies to relations of the specified type. The value
                                of this element is compared to the relation of the targetRef relation
                                in the assignment. If not specified then this policy only
                                applies to the null (default) relation. If all relations need to be
                                affected by this policy then the special value of "any" should be specified
                                in this element.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AssignmentModificationPolicyConstraintType.relation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="direct" maxOccurs="1" minOccurs="0" name="scope" type="tns:AssignmentModificationPolicyConstraintScopeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Scope of assignment policy constraint application.
                                It specifies whether the constraint should be triggered when assigned directly, indirectly or in both cases.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.10</a:since>
                                <a:displayName>AssignmentModificationPolicyConstraintType.scope</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!--<xsd:element name="targetType" type="xsd:QName"  minOccurs="0" maxOccurs="unbounded">-->
                        <!--<xsd:annotation>-->
                            <!--<xsd:documentation>-->
                                <!--This policy only applies to targets of the specified type.-->
                            <!--</xsd:documentation>-->
                            <!--<xsd:appinfo>-->
                                <!--<a:since>3.6</a:since>-->
                            <!--</xsd:appinfo>-->
                        <!--</xsd:annotation>-->
                    <!--</xsd:element>-->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="assignmentModificationPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:AssignmentModificationPolicyConstraintType"/>

    <xsd:simpleType name="AssignmentModificationPolicyConstraintScopeType">
        <xsd:annotation>
            <xsd:documentation>
                Scope of assignment policy constraint application.
                It specifies whether the constraint should be triggered when assigned directly, indirectly or in both cases.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.10</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="direct">
                <xsd:annotation>
                    <xsd:documentation>
                        Trigger the constraint for direct assignments only.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DIRECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="indirect">
                <xsd:annotation>
                    <xsd:documentation>
                        Trigger the constraint for indirect assignments only.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INDIRECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="any">
                <xsd:annotation>
                    <xsd:documentation>
                        Trigger the constraint for both direct and indirect assignments.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ANY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="HasAssignmentPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Constraint that triggers when the focus has given assignment(s).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="targetRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Assignment target to be matched. Might be dynamic (with a resolution time of "run"), just
                                like the one in exclusion constraint. If a relation here is specified, it takes precedence
                                over "relation" item in this constraint.

                                If script expression is used in the filter, following variables are available:
                                - `policyRule`: currently evaluated policy rule (type EvaluatedPolicyRule)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>HasAssignmentPolicyConstraintType.targetRef</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="direct" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If true the assignment to given target must be direct. If false, it must be indirect (induced).
                                If not specified, it might be either direct or indirect. But in all cases it must be of the order
                                one, i.e. metaroles are not considered.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>HasAssignmentPolicyConstraintType.direct</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="enabled" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If true the assignment to given target must be effectively enabled. If false, it must be present
                                but effectively disabled (beware, the behavior of midPoint for disabled indirect assignments may
                                be fragile). If not specified, the effective status is not considered.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>HasAssignmentPolicyConstraintType.enabled</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                This policy only applies to relations of the specified type. (Provided that the relation
                                is not set in the targetRef.) The value of this element is compared to the relation of the
                                targetRef relation in the assignment/inducement. If not specified then this policy only
                                applies to the null (default) relation. If all relations need to be affected by this policy
                                then the special value of "any" should be specified in this element or in the targetRef element.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>HasAssignmentPolicyConstraintType.relation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="targetArchetypeRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Requiring target objects that have this archetype.
                                Filter in the reference is NOT supported.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.10</a:since>
                                <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                                <a:displayName>HasAssignmentPolicyConstraintType.targetArchetypeRef</a:displayName>
                                <a:help>HasAssignmentPolicyConstraintType.targetArchetypeRef.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="hasAssignmentPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:HasAssignmentPolicyConstraintType"/>
    <xsd:element name="hasNoAssignmentPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:HasAssignmentPolicyConstraintType"/>

    <xsd:complexType name="TimeValidityPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                A constraint that triggers when validity of an object, assignment, or basically any time-sensitive
                item (e.g. password) is about to end.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.6</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="item" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The item whose validity is to be checked. If not specified, activation/validTo is assumed.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TimeValidityPolicyConstraintType.item</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="assignment" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If set to true, validity of assignments of the relevant object are to be checked, not
                                items of the object itself. So, for example, if you want to send notifications before validity of
                                assignments to roles A, B, C expire, you'd need to attach a policy rule with this constraint
                                having assignment=true to roles A, B, and C.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TimeValidityPolicyConstraintType.assignment</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="activateOn" type="xsd:duration">
                        <xsd:annotation>
                            <xsd:documentation>
                                When will this policy constraint activate (trigger)? If not specified, activation will occur
                                on the moment of validity change. Specify negative durations if you need to activate the trigger
                                before that moment; and positive ones if the trigger should be activated after that.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TimeValidityPolicyConstraintType.activateOn</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="deactivateOn" type="xsd:duration">
                        <xsd:annotation>
                            <xsd:documentation>
                                When will be this policy constraint deactivated? If not specified, it will be active forever.
                                Specify negative durations if you need to activate the trigger before the moment of validity
                                change; and positive ones is the trigger should be deactivated after that.

                                If not specified, the trigger will be active forever (TODO ok? or only until validTo occurs?)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TimeValidityPolicyConstraintType.deactivateOn</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="timeValidityPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:TimeValidityPolicyConstraintType"/>

    <xsd:complexType name="StatePolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                A constraint that triggers when an object or assignment is in a given state.
                If both filter and expressions are specified, both must be true in order for constraint to be triggered.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="filter" type="q:SearchFilterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Filter that is to be used to determine the state. Mutually exclusive with expression, messageExpression, and executeScript.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>StatePolicyConstraintType.filter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="expression" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expression that is to be used to determine the state. Mutually exclusive with messageExpression, filter, and executeScript.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>StatePolicyConstraintType.expression</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="messageExpression" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expression that is to be used to determine the state: if state matches it should return LocalizableMessageType to be used
                                (both as normal and short messages). Mutually exclusive with message, filter, and executeScript.

                                Probably will change in the future.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>StatePolicyConstraintType.messageExpression</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="executeScript" type="s:ExecuteScriptType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Scripting expression (action) to be used to determine the state. Mutually exclusive with filter, expression and messageExpression.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>StatePolicyConstraintType.executeScript</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="objectStatePolicyConstraintType" substitutionGroup="tns:abstractPolicyConstraint" type="tns:StatePolicyConstraintType"/>
    <xsd:element name="assignmentStatePolicyConstraintType" substitutionGroup="tns:abstractPolicyConstraint" type="tns:StatePolicyConstraintType"/>

    <xsd:complexType name="PolicySituationPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Constraint that triggers the rule when the object is in a given policy situation(s).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.6</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="situation" type="xsd:anyURI">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies the policy situation URI(s) to look for.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>PolicySituationPolicyConstraintType.situation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO some more complex expressions (at least "and / or"; or something like this) -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="situationPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:PolicySituationPolicyConstraintType"/>

    <xsd:complexType name="CustomPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Custom ways of evaluating a policy constraint. Used typically for transitional constraints.
                (State-based custom ones can always be evaluated using `objectState` constraint.)
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="expression" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expression that is used to determine the result. It must have a value of true in order
                                for constraint to be triggered.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CustomPolicyConstraintType.expression</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="customPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:CustomPolicyConstraintType"/>

    <xsd:complexType name="CollectionStatsPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Constraints for collection stats (statistics). Can be used to trigger policy
                    rules on the number of objects in collection, percentage and so on.
                </p>
                <p>
                    Policy rules with this constraint are ignored during normal processing.
                    Evaluation of such policy rules require special handling (e.g. scanner task).
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="collection" type="tns:CollectionSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Refers to "itself" as a collection. This means that it interprets the object
                                to which the rule applies as a collection. And this element specifies the
                                details how the collection should be interpreted. E.g. whether we mean
                                the list of objects that ObjectCollectionType refers to by filter. Or
                                whether we mean assignees (owners/approvers) of that object.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CollectionStatsPolicyConstraintType.collection</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AlwaysTruePolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    This policy constraint always applies.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType"/>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="alwaysTruePolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:AlwaysTruePolicyConstraintType"/>

    <xsd:complexType name="OrphanedPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    The object (currently supported are tasks) is orphaned i.e. has declared a parent but the parent does not exist.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType"/>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="orphanedPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:OrphanedPolicyConstraintType"/>

    <xsd:complexType name="TransitionPolicyConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies how the inner constraints are to be evaluated with regard to operation start and end state.
                May not include any transitional constraints itself!
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPolicyConstraintType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="stateBefore" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expected inner constraint state before the operation.
                                True means the constraint must evaluate to true. False means the constraint must evaluate to false.
                                Unspecified means the constraint is not checked before the operation.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TransitionPolicyConstraintType.stateBefore</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="stateAfter" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expected inner constraint state after the operation.
                                True means the constraint must evaluate to true. False means the constraint must evaluate to false.
                                Unspecified means the constraint is not checked after the operation.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TransitionPolicyConstraintType.stateAfter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="constraints" type="tns:PolicyConstraintsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Non-transitional policy constraints to be evaluated.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>TransitionPolicyConstraintType.constraints</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="transitionPolicyConstraint" substitutionGroup="tns:abstractPolicyConstraint" type="tns:TransitionPolicyConstraintType"/>

     <xsd:complexType name="PolicyThresholdType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies limits when is the action executed.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="lowWaterMark" type="tns:WaterMarkType">
                <xsd:annotation>
                    <xsd:documentation>
                        Lower bound of the threshold.
                        Lowest value for which the policy rule is activated. The policy rule
                        will be triggered for all values starting from this value up until the
                        high water mark (closed interval). If no low water mark is specified then
                        the policy rule will be activated for all values up to the high water mark.
                        Policy rule with a threshold that does not have any water marks will
                        never be activated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyThresholdType.lowWaterMark</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="highWaterMark" type="tns:WaterMarkType">
                <xsd:annotation>
                    <xsd:documentation>
                        Upper bound of the threshold.
                        Highest value for which the policy rule is activated. The policy rule
                        will be triggered for all values starting from low water mark up until
                        this value (closed interval). If no high water mark is specified then
                        the policy rule will be activated for all values that are greater than
                        or equal to high water mark.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyThresholdType.highWaterMark</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timeInterval" type="tns:TimeIntervalType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO: time interval!
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyThresholdType.timeInterval</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
             </xsd:element>
            <!--  later scope,... -->
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="policyThreshold" type="tns:PolicyThresholdType"/>

    <xsd:complexType name="WaterMarkType">
        <xsd:annotation>
            <xsd:documentation>
                Water mark (bound). Lowest or highest value defining an interval.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="count" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Absolute count of objects that triggers the watermark.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>WaterMarkType.count</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="percentage" type="xsd:float">
                <xsd:annotation>
                    <xsd:documentation>
                        Relative proportion (percentage) of objects that triggers
                        the watermark. Value in percents (0-100). The value is relative
                        to the "domain". This only works if a domain is specified.
                        E.g. it will work for object collections with a domain or
                        for processes where we know total count of all processed
                        objects. Percentage watermarks cannot be used if domain
                        is not specified.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>WaterMarkType.percentage</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="TimeIntervalType">
        <xsd:annotation>
            <xsd:documentation>
                Water mark (bound). Lowest or highest value defining an interval.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="interval" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        Time interval. Interpretation of this time interval depends on the context
                        in which it is used. E.g. for synchronization thresholds the interval of 1 hour
                        usually means "number of changes in one hour interval". For dashboards it may
                        mean "number of errors in last hour" and so on.
                        If there is a danger that the interval might be misinterpreted then the
                        precise interpretation may be specified by using additional items in this
                        data structure.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>TimeIntervalType.interval</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: specify how to interpret time interval.
                    Whether it is periodic (every 5min), relative to present time (last 24hours),
                    relative to other point in time (first 3hours after system start) or absolute
                    time range. -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="PolicyActionsType">
        <xsd:annotation>
            <xsd:documentation>
                Actions that are executed as reactions to triggered policy rules.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="enforcement" type="tns:EnforcementPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Enforcement action. This action stops the operation and results with the error.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.enforcement</a:displayName>
                        <a:help>PolicyActionsType.enforcement.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="approval" type="tns:ApprovalPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Approval action(s). The operation will be suspended and the approval workflow will be started.
                        If the workflow ends with success the operation will proceed. If the workflow ends with
                        an error the operation will also end with an error.

                        More approval actions can be specified. They will be eventually merged into one approval process.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.approval</a:displayName>
                        <a:help>PolicyActionsType.approval.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="remediation" type="tns:RemediationPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Remediation action. The operation will proceed. A workflow will be started to remediate the
                        result of the operation after the operation is done.
                        This action is ideal for operations that cannot be stopped, e.g. when manager
                        of an organizational unit is deleted because he quits the job.
                        This action starts a workflow. Therefore it is ideal for actions that are not frequent but
                        that require immediate attention. E.g. missing manager for organizational unit.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:displayName>PolicyActionsType.remediation</a:displayName>
                        <a:help>PolicyActionsType.remediation.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="prune" type="tns:PrunePolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Prune action. The operation will proceed. Any other assignments that are in conflict with
                        this assignment that triggered the rule will be "pruned": they will be removed. The removal
                        of the conflicting assignments is automatic and silent. It will not be subject to approvals
                        or other policy constraints.
                        This mechanism can be used for example to implement set of roles where only one of the roles
                        can be assigned at a time.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>PolicyActionsType.prune</a:displayName>
                        <a:help>PolicyActionsType.prune.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="certification" type="tns:CertificationPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Certification action. The operation will proceed. The object will be scheduled for
                        a certification campaign after the operation is done.
                        This action works with certification campaign. Therefore it is ideal for actions that are frequent
                        and can occur on large number of objects. The campaign is an efficient method how to handle mass
                        decisions. However it mat not be started immediately.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.certification</a:displayName>
                        <a:help>PolicyActionsType.certification.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="notification" type="tns:NotificationPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Notification action. The operation will proceed. Notifications are sent at the end of the
                        operation. More notification actions can be specified.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.notification</a:displayName>
                        <a:help>PolicyActionsType.notification.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="record" type="tns:RecordPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Record action. The operation will proceed. Policy situation(s) will be recorded for
                        given object or assignment. It can be reported on or certified later on.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.record</a:displayName>
                        <a:help>PolicyActionsType.record.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="scriptExecution" type="tns:ScriptExecutionPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Execute script (action). The operation will proceed. Script(s) are executed at the end of the operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.scriptExecution</a:displayName>
                        <a:help>PolicyActionsType.scriptExecution.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="suspendTask" type="tns:SuspendTaskPolicyActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Stop action. This action stops the operation after n executions and results with the error.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionsType.stop</a:displayName>
                        <a:help>PolicyActionsType.stop.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="PolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                Common supertype for policy actions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Name for the action. It is used for logging and other diagnostic purposes.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionType.name</a:displayName>
                        <a:help>PolicyActionType.name.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Free-form description (e.g. comments about the action purpose)
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyActionType.description</a:displayName>
                        <a:help>PolicyActionType.description.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="condition" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            When should this action be applied?
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                        <a:displayName>PolicyActionType.condition</a:displayName>
                        <a:help>PolicyActionType.condition.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="EnforcementPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                Enforcement action. This action stops the operation and results with the error.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <!-- Empty for now.
                         TODO: later add type of error and message -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

     <xsd:complexType name="SuspendTaskPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                Stop action. This action stops the operation and results with the error.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <!-- Empty for now.
                         TODO: later add type of error and message -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ApprovalPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                Approval action. The operation will be suspended and the approval workflow will be started.
                If the workflow ends with success the operation will proceed. If the workflow ends with
                an error the operation will also end with an error.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:displayName>ApprovalPolicyActionType.details</a:displayName>
                <a:schemaMigration>
                    <a:element>tns:automaticallyApproved</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="processSpecification" type="c:WfProcessSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                TODO
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:experimental>true</a:experimental>
                                <a:displayName>ApprovalPolicyActionType.processSpecification</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="compositionStrategy" type="c:ApprovalCompositionStrategyType">
                        <xsd:annotation>
                            <xsd:documentation>
                                How should be this approval policy action composed with other ones that
                                might be related to the same item (object or assignment)?
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ApprovalPolicyActionType.compositionStrategy</a:displayName>
                                <a:help>ApprovalPolicyActionType.compositionStrategy.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="approvalDisplayName" type="tns:LocalizableMessageTemplateType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Display name for this approval definition. If not specified, the name is derived from triggered constraints (short messages).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ApprovalPolicyActionType.approvalDisplayName</a:displayName>
                                <a:help>ApprovalPolicyActionType.approvalDisplayName.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:choice>
                        <xsd:sequence>
                            <xsd:element maxOccurs="unbounded" minOccurs="0" name="approverRelation" type="xsd:QName">
                                <xsd:annotation>
                                    <xsd:documentation>
                                        <p>
                                            What relation(s) to use when determining approvers? E.g. "approver", "owner",
                                            "securityApprover", and so on.
                                        </p>
                                    </xsd:documentation>
                                    <xsd:appinfo>
                                        <a:displayName>ApprovalPolicyActionType.approverRelation</a:displayName>
                                        <a:help>ApprovalPolicyActionType.approverRelation.help</a:help>
                                    </xsd:appinfo>
                                </xsd:annotation>
                            </xsd:element>
                            <xsd:element maxOccurs="unbounded" minOccurs="0" name="approverRef" type="c:ObjectReferenceType">
                                <xsd:annotation>
                                    <xsd:documentation>
                                        <p>
                                            Direct enumeration of the approvers to be used.
                                            May be used with approverRelation and approverExpression element(s).
                                        </p>
                                    </xsd:documentation>
                                    <xsd:appinfo>
                                        <a:displayName>ApprovalPolicyActionType.approverRef</a:displayName>
                                        <a:help>ApprovalPolicyActionType.approverRef.help</a:help>
                                    </xsd:appinfo>
                                </xsd:annotation>
                            </xsd:element>
                            <xsd:element maxOccurs="unbounded" minOccurs="0" name="approverExpression" type="c:ExpressionType">
                                <xsd:annotation>
                                    <xsd:documentation>
                                        <p>
                                            Expression(s) that yield approvers to be used. If specified, the expression(s) are evaluated and
                                            the result is used as a set of approvers (UserType, OrgType, RoleType, or any combination of them).
                                            May be used with approverRelation and approverRef element(s).
                                        </p>
                                    </xsd:documentation>
                                    <xsd:appinfo>
                                        <a:displayName>ApprovalPolicyActionType.approverExpression</a:displayName>
                                        <a:help>ApprovalPolicyActionType.approverExpression.help</a:help>
                                    </xsd:appinfo>
                                </xsd:annotation>
                            </xsd:element>
                        </xsd:sequence>
                        <xsd:element minOccurs="0" name="approvalSchema" type="c:ApprovalSchemaType">
                            <xsd:annotation>
                                <xsd:documentation>
                                    <p>
                                        More complex (multi-stages) approval schema.
                                    </p>
                                </xsd:documentation>
                                <xsd:appinfo>
                                    <a:displayName>ApprovalPolicyActionType.approvalSchema</a:displayName>
                                    <a:help>ApprovalPolicyActionType.approvalSchema.help</a:help>
                                </xsd:appinfo>
                            </xsd:annotation>
                        </xsd:element>
                        <xsd:element minOccurs="0" name="approvalProcess" type="xsd:string">
                            <xsd:annotation>
                                <xsd:documentation>
                                    <p>
                                        Name of custom approval process.
                                    </p>
                                    <p>
                                        THIS PROPERTY (approvalProcess) IS NOT SUPPORTED YET.
                                    </p>
                                </xsd:documentation>
                                <xsd:appinfo>
                                    <a:experimental>true</a:experimental>
                                </xsd:appinfo>
                            </xsd:annotation>
                        </xsd:element>
                    </xsd:choice>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ApprovalCompositionStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                Prescribes how individual approval requirements should be composed into overall approval schema.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="order" type="xsd:int">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ApprovalCompositionStrategyType.order</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="exclusive" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, this fragment might be the only one with this particular order number.
                        (Other fragments could be merged into it, but in "mergeIntoOrder" mode. TODO TODO TODO)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ApprovalCompositionStrategyType.exclusive</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="mergeable" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, this schema fragment is eligible to merging with other fragments of the same order.
                        (Non-mergeable fragments with the same order are ordered randomly. Mergeable fragments must have
                        order filled-in.)

                        Mergeable fragments must have "order" attribute set.

                        Restrictions on merging schema fragments:
                        1) Mergeable fragments must contain exactly one stage. It is merged with the stage(s) of the other
                        fragment(s) without any further considerations (e.g. regarding stage order or name or whatever).
                        2) It is expected that single policy rule triggered all the fragments that are being merged. So
                        we consider any of these rules.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ApprovalCompositionStrategyType.mergeable</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="mergeIntoOrder" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Which fragments should this one be merged with. This is mutually exclusive with the "order" attribute.
                        If order is set, it is not possible to specify mergeIntoOrder. Both fragments with the same order are
                        considered "equal". This can be used e.g. to provide a different set of approvers (for the given stage).
                        If mergeIntoOrder is set (usually with multiple values), this fragment is considered as an augmentation
                        of other ones. This can be used e.g. to provide an escalation or notification strategy, custom form information, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ApprovalCompositionStrategyType.mergeIntoOrder</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="mergeIntoAll" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Indicates that this fragment is to be merged into all the other "base" fragments.
                        This is mutually exclusive with the "order" and "mergeIntoOrder" attributes.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ApprovalCompositionStrategyType.mergeIntoAll</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="mergePriority" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Provides an information about order in which this fragment is merged (lower numbers are processed before higher ones).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ApprovalCompositionStrategyType.mergePriority</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="mergeOverwriting" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        If stage B is being merged into existing stage A (i.e. mergeOrder B is greater mergeOrder A),
                        all non-null values of B will be added to values of A; overwriting them in case of single-valued items.
                        For items marked as "mergeOverwriting", the actual values of B (even those that are null or empty)
                        overwrite those in A.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ApprovalCompositionStrategyType.mergeOverwriting</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="WfProcessSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of a process that is to be started.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:choice>
                <xsd:element minOccurs="0" name="ref" type="xsd:string">
                    <xsd:annotation>
                        <xsd:documentation>
                            Reference to existing process specification.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>WfProcessSpecificationType.ref</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="name" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name for this process specification.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>WfProcessSpecificationType.name</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="order" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                In what order this process specification is to be considered.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>WfProcessSpecificationType.order</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="deltaFrom" type="c:DeltaSourceSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                TODO
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>WfProcessSpecificationType.deltaFrom</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="includeAction" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                What approval actions to include during approval schema creation for this process.
                                If they are not triggered an exception is thrown.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>WfProcessSpecificationType.includeAction</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="includeActionIfPresent" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                What approval actions to include during approval schema creation for this process.
                                If they are not triggered they are silently skipped.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>WfProcessSpecificationType.includeActionIfPresent</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="approvalDisplayName" type="tns:LocalizableMessageTemplateType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name for approval process. If not specified, name from approval action(s) is taken.
                                If not specified even there, the name is derived from triggered constraints (short messages).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>WfProcessSpecificationType.approvalDisplayName</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:choice>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="DeltaSourceSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
                <a:experimental>true</a:experimental>
                <a:displayName>DeltaSourceSpecificationType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:choice>
                <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="t:ItemPathType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Include all modifications of these items as a delta that is to be approved.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>DeltaSourceSpecificationType.item</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="0" name="itemValue" type="t:ItemPathType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Create a delta for each value of this item that is to be added, deleted or modified.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>DeltaSourceSpecificationType.itemValue</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="RemediationPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <!-- TODO -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="PrunePolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <!-- TODO -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CertificationPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="definitionRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Certification definition(s) to be started as part of the action execution.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:AccessCertificationDefinitionType</a:objectReferenceTargetType>
                                <a:since>3.6</a:since>
                                <a:displayName>CertificationPolicyActionType.definitionRef</a:displayName>
                                <a:help>CertificationPolicyActionType.definitionRef.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="NotificationPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:experimental>true</a:experimental>
                <a:displayName>NotificationPolicyActionType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <!-- TODO -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ScriptExecutionPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.9</a:since>
                <a:displayName>ExecuteScriptPolicyActionType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="object" type="c:ScriptExecutionObjectType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Object(s) on which the script should be executed.
                                (If not specified, current focus is assumed.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="executeScript" type="s:ExecuteScriptType"/>
                    <xsd:element minOccurs="0" name="asynchronousExecution" type="c:AsynchronousScriptExecutionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Options for asynchronous script execution.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="runAsRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Reference to the user whose identity will be used to execute the script,
                                    including task submission in case of asynchronous execution.
                                    (Note that search for relevant objects is currently done directly via repository,
                                    so it is not covered by authorizations.)
                                </p>
                                <p>
                                    The whole process will use authorizations that this user has. If the script
                                    triggers any change then the change will be audited under the identity of
                                    this user.
                                </p>
                                <p>
                                    If no user is specified then the identity of currently logged-in user or
                                    the owner of the task will be used.
                                </p>
                                <p>
                                    DEPRECATED: use "privileges" instead.
                                    Cannot be present when "privileges" are used.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                                <a:deprecated>true</a:deprecated>
                                <a:deprecatedSince>4.8</a:deprecatedSince>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="privileges" type="tns:ExecutionPrivilegesSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Privileges and identity that will be used to execute the script.
                                (Note that search for relevant objects is currently done directly via repository,
                                so it is not covered by authorizations.)

                                For asynchronous executions, the identity stemming from "runAsRef" property of this item
                                will be used as the respective task owner.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.8</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="RecordPolicyActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyActionType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="policyRules" type="tns:TriggeredPolicyRulesStorageStrategyType">
                        <xsd:annotation>
                            <xsd:documentation>
                                How much information about triggered policy rules should be stored?
                                EXPERIMENTAL
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:displayName>RecordPolicyActionType.policyRules</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO we may select what situation(s) we want to record. The default is all applicable ones. -->
                    <!--<xsd:element name="situationConstraints" type="tns:SituationConstraintsStorageStrategyType" minOccurs="0">-->
                        <!--<xsd:annotation>-->
                            <!--<xsd:documentation>-->
                                <!--Should triggers for situation constraints be stored "as is" or should referenced rules be unwrapped?-->
                                <!--EXPERIMENTAL-->
                            <!--</xsd:documentation>-->
                        <!--</xsd:annotation>-->
                    <!--</xsd:element>-->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="PolicyExceptionType">
        <xsd:annotation>
            <xsd:documentation>
                Recorded exception from a policy rule. The exceptions that are approved are
                recoded here to avoid re-evaluating and re-approving them all the time.
                This is EXPERIMENTAL functionality. It is likely to change in the near future.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="ruleName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Name for the rule for which this is an exception.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="policySituation" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Policy situation for which this is an exception.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: validity? -->
            <xsd:element minOccurs="0" name="metadata" type="tns:MetadataType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="PolicyRuleEnforcerPreviewOutputType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="rule" type="tns:EvaluatedPolicyRuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            TODO
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LifecycleStateModelType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of lifecycle states and state transitions.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="state" type="tns:LifecycleStateType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Specification of lifecycle state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateModelType.state</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LifecycleStateType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of lifecycle state.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
                <a:experimental>true</a:experimental>
                <a:displayName>LifecycleStateType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Identifier of the state. This is the value that is used in the
                            lifecycleState property.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Free-form description of the state (e.g. purpose, mechanisms, etc.)
                            Used for documentation purposes (comment).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="displayName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            User-friendly name of the state, e.g. for displaying in the user interface.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.displayName</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="forcedActivationStatus" type="tns:ActivationStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Activation status forced by this lifecycle state. If lifecycle state
                            implies activation status, then such status will be forced to all objects
                            that are in that lifecycle state. Such objects will have the effective status
                            set to the value of forcedActivationStatus regardless of other activation setting.
                            I.e. administrativeStatus and validity are not considered in this case.
                        </p>
                        <p>
                            If no forced status is specified for a state that is explicitly defined,
                            the "undefined" is implied. In that case the usual activation computation
                            takes place (e.g. administrativeStatus and validity).
                        </p>
                        <p>
                            However, there is a couple of hardcoded lifecycle states. If these states
                            are not explicitly defined in a lifecycle model, the hardcoded defaults are applied
                            for activation in these hardcoded states ("undefined" for active and deprecated
                            states, "archived" for archived state, "disabled" for all other states). To turn off this default behaviour
                            those hardcoded lifecycle states need to be explicitly defined in the state model
                            and the forcedActivationStatus property should be left undefined.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:displayName>LifecycleStateType.forcedActivationStatus</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="forcedAssignment" type="tns:VirtualAssignmentSpecificationType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            There are cases when you need to force midpoint thinks that user has assigned some
                            role. The assignment actually doesn't exist but there is a need to pretend as it does.
                            This can be used e.g. for post-authentication flow. The user has assigned all business,
                            application, etc. roles but we don't want to consider these roles during his
                            post-authentication process. Instead, we want to pretend he has "temporary" role assigned
                            which allows him to perform post-authentication.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.forcedAssignment</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="activeAssignments" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Setting that specifies whether object assignments should be considered
                            active in this lifecycle state. If set to true, then assignments are considered
                            active. That means that the assignments will be computed as usual.
                            If set to false then all object assignments are considered inactive. Which
                            means that they will be ignored (as if they do not exist at all).
                        </p>
                        <p>
                            If this setting is not specified then the result of forced activation status
                            determines behavior of the assignments. If forced activation is "disabled" or
                            "archived" then the assignments are considered to be inactive. If forced activation
                            status is "enabled" or if it is not defined at all then the assignments are considered
                            active.
                        </p>
                        <p>
                            However, there is a couple of hardcoded lifecycle states. If these states
                            are not explicitly defined in a lifecycle model, the hardcoded defaults are applied
                            for activation in these hardcoded states ("undefined" for active and deprecated
                            states, "disabled" for all other states). To turn off this default behaviour
                            those hardcoded lifecycle states need to be explicitly defined in the state model
                            and the forcedActivationStatus property should be left undefined.
                        </p>
                        <!-- TODO: should be replaced by assignmentSelector later -->
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:displayName>LifecycleStateType.activeAssignments</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: MID-5741: assignmentSelector that can be used to selectively activate/deactivate assignments based on their targetType, targetArchetype, relation, subtype and so on -->
            <!-- TODO: activationStatus -->
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="entryAction" type="tns:LifecycleStateActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            State entry action. Action that is executed when the state is entered.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.entryAction</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="exitAction" type="tns:LifecycleStateActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            State exit action. Action that is executed when the state is exited.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.exitAction</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="transition" type="tns:LifecycleStateTransitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Transition to another state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateType.transition</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="VirtualAssignmentSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    There are cases when you need to force midpoint thinks that user has assigned some
                    role. The assignment actually doesn't exist but there is a need to pretend as it does.
                    This can be used e.g. for post-authentication flow. The user has assigned all business,
                    application, etc. roles but we don't want to consider these roles during his
                    post-authentication process. Instead, we want to pretend he has "temporary" role assigned
                    which allows him to perform post-authentication.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.8.1</a:since>
                <a:experimental>true</a:experimental>
                <a:schemaContext>
                    <a:typePath>targetType</a:typePath>
                </a:schemaContext>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="targetType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The target type of the assignment, e.g RoleType, ServiceType, OrgType, ...
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>VirtualAssignmentSpecificationType.targetType</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="filter" type="q:SearchFilterType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            No filter, no virtual assignments.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>VirtualAssignmentSpecificationType.filter</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LifecycleStateTransitionType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of lifecycle state transition.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Short name for the transition. It may be used in log files, user interface, etc.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateTransitionType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Free-form description of transition purpose, mechanisms, etc.
                            Used for documentation purposes (comment).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateTransitionType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="targetState" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Identifier of the state that is the target of the transition.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateTransitionType.targetState</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="condition" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Condition for automatic state transition. If the condition returns true value
                            then lifecycle transitions to the target state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateTransitionType.condition</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LifecycleStateActionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
                <a:experimental>true</a:experimental>
                <a:displayName>LifecycleStateActionType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Short name of the action. It may be used in log files, user interface, etc.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateActionType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Free-form description of the action purpose, mechanisms, etc.
                            Used for documentation purposes (comment).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateActionType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="dataReduction" type="tns:LifecycleStateActionDataReductionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Action that reduces (purges) object data.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateActionType.dataReduction</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: assign, (mass) unassign -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LifecycleStateActionDataReductionType">
        <xsd:annotation>
            <xsd:documentation>
                Action that reduces (purges) object data.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="purgeItem" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Remove all values of the item.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LifecycleStateActionDataReductionType.purgeItem</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: keepItem -->
            <!-- TODO: keepMetadata? keepOperationalData? -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ScriptExecutionObjectType">
        <xsd:annotation>
            <xsd:documentation>
                Object(s) on which the script should be executed.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="currentObject" type="c:ObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Current object. This is the default if nothing is specified.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="linkTarget" type="c:LinkTargetObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Objects linked from this one, matching given selector(s).
                            TODO find better name.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="namedLinkTarget" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Objects linked from this one, with the specified link type name.
                            It is actually a shortcut for linkTarget with linkType set.

                            EXPERIMENTAL. UNSTABLE. DO NOT USE.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="linkSource" type="c:LinkSourceObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Objects linked to this one, matching given selector(s).
                            TODO find better name.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="namedLinkSource" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Objects linked to this one, with the specified link type name.
                            It is actually a shortcut for linkSource with linkType set.

                            EXPERIMENTAL. UNSTABLE. DO NOT USE.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="scriptExecutionObject" type="tns:ScriptExecutionObjectType"/>

    <xsd:complexType name="LinkSourceObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects objects among linked sources (for this object).
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:LinkedObjectSelectorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="linkType" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of the link type. Not to be mixed with other linked object selector items.
                                EXPERIMENTAL. UNSTABLE. DO NOT USE.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="linkSourceObjectSelector" type="tns:LinkSourceObjectSelectorType"/>

    <xsd:complexType name="LinkTargetObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects objects among link targets (for this object).
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:LinkedObjectSelectorType">
                <xsd:sequence>
                    <xsd:element default="always" minOccurs="0" name="changeSituation" type="tns:LinkChangeSituationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                 In what situations (change-related) does the link match?
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="linkType" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of the link type. Not to be mixed with other linked object selector items.
                                EXPERIMENTAL. UNSTABLE. DO NOT USE.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="matchesRuleAssignment" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                The link target is related to the assignment that brought this policy rule to the focus object.
                                This setting can eliminate the need to specify linked targets e.g. via archetype, if the archetype
                                itself brings this policy rule to the object.

                                This filter is approximate only! First, it ignores relations (for now). Second, it ignores whether
                                the assignment that brought this policy rule was really the one that become listed in (old/new)
                                roleMembershipRef. So please do not use it if you need absolute precision.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="matchesConstraint" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                The link target was matched by some constraint in this policy rule (e.g. assignment modification
                                constraint has a target object equal to assignment target). This setting can eliminate the need
                                to specify linked targets e.g. using archetype.

                                Highly experimental, probably will be removed.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO some kind of limiting links targets to those present in roleMembershipRef or similar data?
                          Currently roleMembershipRef presence is the default. -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="linkTargetObjectSelector" type="tns:LinkTargetObjectSelectorType"/>

    <xsd:simpleType name="LinkChangeSituationType">
        <xsd:annotation>
            <xsd:documentation>
                In what situations (change-related) does the link match?
                EXPERIMENTAL. Think about broader applicability for transitional policy rules.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="always">
                <xsd:annotation>
                    <xsd:documentation>
                        Link always matches (even if it existed but does not any more).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALWAYS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="added">
                <xsd:annotation>
                    <xsd:documentation>
                        Link matches only if it was just added (i.e. its existence went from false to true).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADDED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="removed">
                <xsd:annotation>
                    <xsd:documentation>
                        Link matches only if it was just removed (i.e. existence went from true to false).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REMOVED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="inNew">
                <xsd:annotation>
                    <xsd:documentation>
                        Link matches if it exists in the "new" state (i.e. it existence went from any to true).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN_NEW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="inOld">
                <xsd:annotation>
                    <xsd:documentation>
                        Link matches if it exists in the "old" state (i.e. it existence went from true to any).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN_OLD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="changed">
                <xsd:annotation>
                    <xsd:documentation>
                        Link matches if its existence was changed (false-&gt;true or true-&gt;false).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unchanged">
                <xsd:annotation>
                    <xsd:documentation>
                        Link matches if its existence was unchanged (false-&gt;false or true-&gt;true).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNCHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AsynchronousScriptExecutionType">
        <xsd:annotation>
            <xsd:documentation>
                Options for asynchronous script execution.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="iterative" minOccurs="0" name="executionMode" type="c:AsynchronousScriptExecutionModeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Mode of execution.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="taskOwnerRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Owner of the task created. The default is the currently logged-in user; or the one impersonated
                        via runAsRef.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="taskTemplateRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Task template to use.

                        EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>c:TaskType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="taskCustomizer" type="c:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        An expression that takes a task and customizes its content.

                        Input variable: preparedTask (of TaskType).
                        Output: TaskType that should be used. (It is possible to modify preparedTask and return it.)

                        This is the final step in task preparation. So the task is executed in the form
                        that is prepared by this expression.

                        EXPERIMENTAL.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="asynchronousScriptExecution" type="c:AsynchronousScriptExecutionType"/>

    <xsd:simpleType name="AsynchronousScriptExecutionModeType">
        <xsd:annotation>
            <xsd:documentation>
                Mode of asynchronous script execution.
                EXPERIMENTAL.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="iterative">
                <xsd:annotation>
                    <xsd:documentation>
                        Uses iterative scripting handler, i.e. object query with a script that processes every object found. This is the default.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ITERATIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="singleRun">
                <xsd:annotation>
                    <xsd:documentation>
                        Uses single-run scripting action. Input for this action contains
                        references to objects that should serve as action inputs.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SINGLE_RUN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="singleRunNoInput">
                <xsd:annotation>
                    <xsd:documentation>
                        Uses single-run scripting action without any explicit input.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SINGLE_RUN_NO_INPUT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="PolicyStatementTypeType">
        <xsd:annotation>
            <xsd:appinfo>
                        <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
         <xsd:restriction base="xsd:string">
             <xsd:enumeration value="apply">
                 <xsd:annotation>
                     <xsd:documentation>
                         Specified policy will be applied to object
                     </xsd:documentation>
                     <xsd:appinfo>
                         <jaxb:typesafeEnumMember name="APPLY"/>
                     </xsd:appinfo>
                 </xsd:annotation>
             </xsd:enumeration>
             <xsd:enumeration value="exclude">
                 <xsd:annotation>
                     <xsd:documentation>
                         Specified policy will be excluded from object
                     </xsd:documentation>
                     <xsd:appinfo>
                         <jaxb:typesafeEnumMember name="EXCLUDE"/>
                     </xsd:appinfo>
                 </xsd:annotation>
             </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="PolicyStatementType">
        <xsd:annotation>
            <xsd:documentation>
                Statement specifying explicit include (marking) of object or exclude from specified policy.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="markRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Object mark representing policy, which is APPLIED or EXCLUDED
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:MarkType</a:objectReferenceTargetType>
                        <a:displayName>PolicyStatementType.markRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="type" type="tns:PolicyStatementTypeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of policy statement.
                        apply: mark is applied to object explicitly.
                        exclude: mark is not applied to object even if it matches policy specific for mark.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:lifecycleState">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.lifecycleState</a:displayName>
                        <a:since>4.9</a:since>
                        <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000230" type="tns:LookupTableType"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="metadata" type="tns:MetadataType"/>
        </xsd:sequence>
    </xsd:complexType>

</xsd:schema>