# PolicyConstraintsType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: AbstractPolicyConstraintType
Set of governance, risk management, compliance (GRC) and similar policy constraints that influence the identity model. These constraints act as triggers for the rules.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
name | property string | [0,1] | Identifier of the constraint.
description | property string | [0,1] |
presentation | container PolicyConstraintPresentationType | [0,1] | How should be triggering of this constraint presented, e.
enforcement | property PolicyConstraintEnforcementType | [0,1] |
objectState | container StatePolicyConstraintType | [0,-1] | Particular state of the object, described by a filter or an expression.
assignmentState | container StatePolicyConstraintType | [0,-1] | Particular state of an assignment, described by a filter or an expression.
hasAssignment | container HasAssignmentPolicyConstraintType | [0,-1] | The focus has assignment(s) of given object(s).
hasNoAssignment | container HasAssignmentPolicyConstraintType | [0,-1] | The focus has no assignment(s) of given object(s).
exclusion | container ExclusionPolicyConstraintType | [0,-1] | Exclusion constraint.
minAssignees | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this role assigned is lower than prescribed value.
maxAssignees | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this role assigned is higher than prescribed value.
objectMinAssigneesViolation | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this object (e.
objectMaxAssigneesViolation | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this object (e.
modification | container ModificationPolicyConstraintType | [0,-1] | Constraint that triggers when the object is modified.
assignment | container AssignmentModificationPolicyConstraintType | [0,-1] | Constraint that triggers when the object is assigned, unassigned or the assignment is modified.
objectTimeValidity | container TimeValidityPolicyConstraintType | [0,-1] | A constraint that triggers when validity of an object or any of its time-sensitive items (e.
assignmentTimeValidity | container TimeValidityPolicyConstraintType | [0,-1] | A constraint that triggers when validity of an assignment or any of its time-sensitive items (e.
situation | container PolicySituationPolicyConstraintType | [0,-1] | Occurrence of the policy situation within an object or an assignment.
and | container PolicyConstraintsType | [0,-1] | Constraints that must all apply.
or | container PolicyConstraintsType | [0,-1] | Constraints from which at least one must apply.
not | container PolicyConstraintsType | [0,-1] | The inner constraint must not apply.
transition | container TransitionPolicyConstraintType | [0,-1] | Specifies how the inner constraints are to be evaluated with regards to operation start and end state.
ref | container PolicyConstraintReferenceType | [0,-1] | References another policy constraint e.

- ### Items

  - #### name

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identifier of the constraint. It is used when midPoint needs to refer to a specific constraint, e.g. in order to record exception. This element is formally specified as optional, mostly due to the compatibility reasons. But it has to be provided in order for some functionality to work correctly.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### presentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    How should be triggering of this constraint presented, e.g. in enforcement messages, in approvals, in certification, in notifications, etc.

  - #### enforcement

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]

  - #### objectState

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Particular state of the object, described by a filter or an expression.

  - #### assignmentState

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Particular state of an assignment, described by a filter or an expression.

  - #### hasAssignment

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    The focus has assignment(s) of given object(s).

  - #### hasNoAssignment

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    The focus has no assignment(s) of given object(s).

  - #### exclusion

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Exclusion constraint. Constraint that forbids this object to be assigned together with other object.

  - #### minAssignees

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this role assigned is lower than prescribed value. (The constraint should be perhaps named minAssigneesViolation.)

  - #### maxAssignees

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this role assigned is higher than prescribed value. (The constraint should be perhaps named maxAssigneesViolation.)

  - #### objectMinAssigneesViolation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this object (e.g. role) assigned is lower than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

  - #### objectMaxAssigneesViolation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this object (e.g. role) assigned is higher than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

  - #### modification

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Constraint that triggers when the object is modified. Modification of the object (add, modify, delete). (This constraint should be perhaps named objectModification.)

  - #### assignment

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Constraint that triggers when the object is assigned, unassigned or the assignment is modified. Modification of an assignment, i.e. where this object is a target of assignment that is being modified. (This constraint should be perhaps named assignmentModification.)

  - #### objectTimeValidity

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    A constraint that triggers when validity of an object or any of its time-sensitive items (e.g. password) is about to end.

  - #### assignmentTimeValidity

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    A constraint that triggers when validity of an assignment or any of its time-sensitive items (e.g. password) is about to end.

  - #### situation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Occurrence of the policy situation within an object or an assignment.

  - #### and

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    Constraints that must all apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

  - #### or

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    Constraints from which at least one must apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

  - #### not

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    The inner constraint must not apply.

  - #### transition

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    Specifies how the inner constraints are to be evaluated with regards to operation start and end state. May not include any transitional constraints itself!

  - #### ref

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    References another policy constraint e.g. by its name. The referenced constraint must be present as part of policy rules gathered for a given assignment or object. Also, all declared global constraints are available for referencing, regardless of which objects they are attached to or whether they are active or not.