# ExpressionProfileType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Specifies restrictions for execution of expressions and scripts.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
identifier | property string | [1,1] | Profile identifier.
description | property string | [0,1] | Free-form description (comment).
documentation | property string | [0,1] | Technical documentation for a particular object or construct.
decision | property AuthorizationDecisionType | [1,1] | Default decision for evaluators in this profile: this is the decision of those evaluators that are not explicitly enumerated within it.
evaluator | container ExpressionEvaluatorProfileType | [0,-1] | Detailed specification of expression evaluator profile.
bulkActionsProfile | property string | [0,1] | ID of the actions profile to be used with this expression profile.
functionLibrariesProfile | property string | [0,1] | ID of the function libraries profile to be used with this expression profile.
privilegeElevation | property AuthorizationDecisionType | [0,1] | Is the privilege elevation (runAsRef, runPrivileged) feature available?

- ### Items

  - #### identifier

    Flags: RAM,runtime

    Multiplicity: [1,1]

    Display order:

    Profile identifier. Usually short string, essentially a simple profile name. Custom profiles should consider using URIs instead of simple names to avoid conflicts with built-in profiles that may be provided in later versions.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Free-form description (comment).

  - #### documentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Technical documentation for a particular object or construct.

    The purpose of this element is to document system configuration and behavior. The documentation will not be presented to end users. In fact, it will probably not be presented at all in midPoint user interface. This documentation element is supposed to be a part of the technical documentation of midPoint deployment. The tools than generate deployment configuration will look for these elements and combine them to compiled documentation document.

    AsciiDoc formatting is assumed for this element. Any leading or trailing whitespace is skipped. Indentation equivalent to he indentation of the first non-blank line of text is also skipped.

  - #### decision

    Flags: RAM,runtime,AVals:2

    Multiplicity: [1,1]

    Display order:

    Default decision for evaluators in this profile: this is the decision of those evaluators that are not explicitly enumerated within it. Currently, this property does NOT apply for other parts of the profile. In particular, bulkActionsProfile and functionLibrariesProfile have their own defaults: If not specified, the "allow all" values are applied for them. Also, the "privilegeElevation" has a separate default of "allow".

  - #### evaluator

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Detailed specification of expression evaluator profile.

  - #### bulkActionsProfile

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    ID of the actions profile to be used with this expression profile. If not specified, the "allow all" profile is assumed. (TODO - or should we take the "decision" property into account? But what about backwards compatibility? The same for `functionLibrariesProfile`.)

  - #### functionLibrariesProfile

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    ID of the function libraries profile to be used with this expression profile. If not specified, the "allow all" profile is assumed.

  - #### privilegeElevation

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

    Display order:

    Is the privilege elevation (runAsRef, runPrivileged) feature available?