# PolicyConstraintsType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: AbstractPolicyConstraintType
Set of governance, risk management, compliance (GRC) and similar policy constraints that influence the identity model. These constraints act as triggers for the rules.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
name | property string | [0,1] | Identifier of the constraint.
description | property string | [0,1] |
documentation | property string | [0,1] | Technical documentation for a particular object or construct.
presentation | container PolicyConstraintPresentationType | [0,1] | How should be triggering of this constraint presented, e.
objectState | container StatePolicyConstraintType | [0,-1] | Particular state of the object, described by a filter or an expression.
assignmentState | container StatePolicyConstraintType | [0,-1] | Particular state of an assignment, described by a filter or an expression.
hasAssignment | container HasAssignmentPolicyConstraintType | [0,-1] | The focus has assignment(s) of given object(s).
hasNoAssignment | container HasAssignmentPolicyConstraintType | [0,-1] | The focus has no assignment(s) of given object(s).
requirement | container ExclusionPolicyConstraintType | [0,-1] | Requirement constraint.
exclusion | container ExclusionPolicyConstraintType | [0,-1] | Exclusion constraint.
minAssignees | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this role assigned is lower than prescribed value.
maxAssignees | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this role assigned is higher than prescribed value.
objectMinAssigneesViolation | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this object (e.
objectMaxAssigneesViolation | container MultiplicityPolicyConstraintType | [0,-1] | Actual number of objects that have this object (e.
modification | container ModificationPolicyConstraintType | [0,-1] | Constraint that triggers when the object is modified.
assignment | container AssignmentModificationPolicyConstraintType | [0,-1] | Constraint that triggers when the object is assigned, unassigned or the assignment is modified.
objectTimeValidity | container TimeValidityPolicyConstraintType | [0,-1] | A constraint that triggers when validity of an object or any of its time-sensitive items (e.
assignmentTimeValidity | container TimeValidityPolicyConstraintType | [0,-1] | A constraint that triggers when validity of an assignment or any of its time-sensitive items (e.
situation | container PolicySituationPolicyConstraintType | [0,-1] | Occurrence of the policy situation within an object or an assignment.
custom | container CustomPolicyConstraintType | [0,-1] | Custom ways of evaluating a policy constraint.
collectionStats | container CollectionStatsPolicyConstraintType | [0,-1] | Constraints for collection stats (statistics).
alwaysTrue | container AlwaysTruePolicyConstraintType | [0,-1] | This constraint always applies.
orphaned | container OrphanedPolicyConstraintType | [0,-1] | The object (currently supported are tasks) is orphaned i.
and | container PolicyConstraintsType | [0,-1] | Constraints that must all apply.
or | container PolicyConstraintsType | [0,-1] | Constraints from which at least one must apply.
not | container PolicyConstraintsType | [0,-1] | The inner constraint must not apply.
transition | container TransitionPolicyConstraintType | [0,-1] | Specifies how the inner constraints are to be evaluated with regard to operation start and end state.
ref | container PolicyConstraintReferenceType | [0,-1] | References another policy constraint e.

- ### Items

  - #### name

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identifier of the constraint. It is used when midPoint needs to refer to a specific constraint, e.g. in order to record exception. This element is formally specified as optional, mostly due to the compatibility reasons. But it has to be provided in order for some functionality to work correctly.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### documentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Technical documentation for a particular object or construct.

    The purpose of this element is to document system configuration and behavior. The documentation will not be presented to end users. In fact, it will probably not be presented at all in midPoint user interface. This documentation element is supposed to be a part of the technical documentation of midPoint deployment. The tools than generate deployment configuration will look for these elements and combine them to compiled documentation document.

    AsciiDoc formatting is assumed for this element. Any leading or trailing whitespace is skipped. Indentation equivalent to he indentation of the first non-blank line of text is also skipped.

  - #### presentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    How should be triggering of this constraint presented, e.g. in enforcement messages, in approvals, in certification, in notifications, etc.

  - #### objectState

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Particular state of the object, described by a filter or an expression.

  - #### assignmentState

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Particular state of an assignment, described by a filter or an expression.

  - #### hasAssignment

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    The focus has assignment(s) of given object(s).

  - #### hasNoAssignment

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    The focus has no assignment(s) of given object(s).

  - #### requirement

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Requirement constraint. Constraint that mandates that this object to be assigned together with other object. It can be used to require presence of clearances, job roles, require assignment is specific organization units, etc.

  - #### exclusion

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Exclusion constraint. Constraint that forbids this object to be assigned together with other object. It is usually used to enforce segregation of duty (SoD) policies.

  - #### minAssignees

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this role assigned is lower than prescribed value. (The constraint should be perhaps named minAssigneesViolation.)

  - #### maxAssignees

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this role assigned is higher than prescribed value. (The constraint should be perhaps named maxAssigneesViolation.)

  - #### objectMinAssigneesViolation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this object (e.g. role) assigned is lower than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

  - #### objectMaxAssigneesViolation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Actual number of objects that have this object (e.g. role) assigned is higher than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

  - #### modification

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Constraint that triggers when the object is modified. Modification of the object (add, modify, delete). (This constraint should be perhaps named objectModification.)

  - #### assignment

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Constraint that triggers when the object is assigned, unassigned or the assignment is modified. Modification of an assignment, i.e. where this object is a target of assignment that is being modified. (This constraint should be perhaps named assignmentModification.)

  - #### objectTimeValidity

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    A constraint that triggers when validity of an object or any of its time-sensitive items (e.g. password) is about to end.

  - #### assignmentTimeValidity

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    A constraint that triggers when validity of an assignment or any of its time-sensitive items (e.g. password) is about to end.

  - #### situation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Occurrence of the policy situation within an object or an assignment.

  - #### custom

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Custom ways of evaluating a policy constraint. Used typically for transitional constraints. (State-based custom ones can always be evaluated using `objectState` constraint.) TODO reconsider the name

  - #### collectionStats

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Constraints for collection stats (statistics). Can be used to trigger policy rules on the number of objects in collection, percentage and so on.

    Policy rules with this constraint are ignored during normal processing. Evaluation of such policy rules require special handling (e.g. scanner task).

  - #### alwaysTrue

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    This constraint always applies.

  - #### orphaned

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    The object (currently supported are tasks) is orphaned i.e. has declared a parent but the parent does not exist.

  - #### and

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    Constraints that must all apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

  - #### or

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    Constraints from which at least one must apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

  - #### not

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    The inner constraint must not apply.

  - #### transition

    Flags: elaborate,RAM,runtime

    Multiplicity: [0,-1]

    Specifies how the inner constraints are to be evaluated with regard to operation start and end state. May not include any transitional constraints itself!

  - #### ref

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    References another policy constraint e.g. by its name. The referenced constraint must be present as part of policy rules gathered for a given assignment or object. Also, all declared global constraints are available for referencing, regardless of which objects they are attached to or whether they are active or not.