# ExclusionPolicyConstraintType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: AbstractPolicyConstraintType
Container that defines exclusion of entities (e.g. roles). It is a part of Segregation of Duties (SoD) mechanism.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
name | property string | [0,1] | Identifier of the constraint.
description | property string | [0,1] |
documentation | property string | [0,1] | Technical documentation for a particular object or construct.
presentation | container PolicyConstraintPresentationType | [0,1] | How should be triggering of this constraint presented, e.
targetRef | reference ObjectReferenceType | [0,1] | Target of exclusion.
orderConstraint | container OrderConstraintsType | [0,-1] | Specification of relation(s) when this exclusion constraint should be applied at the source side.
targetOrderConstraint | container OrderConstraintsType | [0,-1] | Specification of relation(s) when this exclusion constraint should be applied at the target side.

- ### Items

  - #### name

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Identifier of the constraint. It is used when midPoint needs to refer to a specific constraint, e.g. in order to record exception. This element is formally specified as optional, mostly due to the compatibility reasons. But it has to be provided in order for some functionality to work correctly.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

  - #### documentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Technical documentation for a particular object or construct.

    The purpose of this element is to document system configuration and behavior. The documentation will not be presented to end users. In fact, it will probably not be presented at all in midPoint user interface. This documentation element is supposed to be a part of the technical documentation of midPoint deployment. The tools than generate deployment configuration will look for these elements and combine them to compiled documentation document.

    AsciiDoc formatting is assumed for this element. Any leading or trailing whitespace is skipped. Indentation equivalent to he indentation of the first non-blank line of text is also skipped.

  - #### presentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    How should be triggering of this constraint presented, e.g. in enforcement messages, in approvals, in certification, in notifications, etc.

  - #### targetRef

    Flags: RAM

    Multiplicity: [0,1]

    Display order:

    Target of exclusion. The object defining this "exclusion" and the object defined as target cannot be assigned at the same time. Filter in the reference may be used to dynamically exclude broader range of roles - assuming that runtime resolution is used. If script expression is used in the filter, following variables are available: - `policyRule`: currently evaluated policy rule (type EvaluatedPolicyRule)

  - #### orderConstraint

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Specification of relation(s) when this exclusion constraint should be applied at the source side. (I.e. this is evaluated against the object defining this exclusion constraint.) The default is "order = 1". Limitation: Currently it does not work with non-member relations because of assignment evaluation optimizations (see TestSegregationOfDuties.test950JackSelfExclusion). So it can be used only for default and manager relations.

  - #### targetOrderConstraint

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Specification of relation(s) when this exclusion constraint should be applied at the target side. (I.e. this is evaluated against the target object.) The default is "order = 1". Limitation: Currently it does not work with non-member relations because of assignment evaluation optimizations (see TestSegregationOfDuties.test950JackSelfExclusion). So it can be used only for default and manager relations.