<?xml version="1.0" encoding="UTF-8"?>
<Policy PolicyId="BuiltInPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:ordered-permit-overrides" xmlns="urn:oasis:names:tc:xacml:1.0:policy" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	
	<Description>
		This rule allows the core built-in library modules (identified by namespace URI) to be
		imported by all users.  If an external library module has the same namespace URI, it
		is not allowed.
	</Description>
	<Target>
		<Resources>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://www.w3.org/2003/05/xpath-functions</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/util</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/transform</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/request</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/xmldb</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/text</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/examples</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">http://exist-db.org/xquery/validation</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-namespace" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
				</ResourceMatch>
			</Resource>
		</Resources>
	</Target>
	
	<Rule RuleId="AllowInternal" Effect="Permit">
		
		<Target>
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">internal library</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml#module-category" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
		</Target>
	</Rule>
	
	<Rule RuleId="DenyAllOthers" Effect="Deny">
		<Description>
			This rule denies access to all other built-in modules.
		</Description>
	</Rule>
</Policy>
