# ExclusionPolicyConstraintType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: AbstractPolicyConstraintType
Container that defines exclusion of entities (e.g. roles). It is a part of Segregation of Duties (SoD) mechanism.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
name | property string | [0,1] | Identifier of the constraint.
description | property string | [0,1] |
presentation | container PolicyConstraintPresentationType | [0,1] | How should be triggering of this constraint presented, e.
enforcement | property PolicyConstraintEnforcementType | [0,1] |
targetRef | reference ObjectReferenceType | [0,1] | Target of exclusion.
orderConstraint | container OrderConstraintsType | [0,-1] | Specification of relation(s) when this exclusion constraint should be applied at the source side.
targetOrderConstraint | container OrderConstraintsType | [0,-1] | Specification of relation(s) when this exclusion constraint should be applied at the target side.
policy | property ExclusionPolicyType | [0,1] |

- ### Items

  - #### name

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identifier of the constraint. It is used when midPoint needs to refer to a specific constraint, e.g. in order to record exception. This element is formally specified as optional, mostly due to the compatibility reasons. But it has to be provided in order for some functionality to work correctly.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### presentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    How should be triggering of this constraint presented, e.g. in enforcement messages, in approvals, in certification, in notifications, etc.

  - #### enforcement

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]

  - #### targetRef

    Flags: RAM

    Multiplicity: [0,1]

    Target of exclusion. The object defining this "exclusion" and the object defined as target cannot be assigned at the same time. Filter in the reference may be used to dynamically exclude broader range of roles - assuming that runtime resolution is used.

  - #### orderConstraint

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Specification of relation(s) when this exclusion constraint should be applied at the source side. (I.e. this is evaluated against the object defining this exclusion constraint.) The default is "order = 1". EXPERIMENTAL. Currently it does not work with non-member relations because of assignment evaluation optimizations (see TestSegregationOfDuties.test950JackSelfExclusion). So it can be used only for default and manager relations.

  - #### targetOrderConstraint

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Specification of relation(s) when this exclusion constraint should be applied at the target side. (I.e. this is evaluated against the target object.) The default is "order = 1". EXPERIMENTAL. Currently it does not work with non-member relations because of assignment evaluation optimizations (see TestSegregationOfDuties.test950JackSelfExclusion). So it can be used only for default and manager relations.

  - #### policy

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]