diff options
| -rw-r--r-- | xacml-translation/xacml.rego | 726 |
1 files changed, 726 insertions, 0 deletions
diff --git a/xacml-translation/xacml.rego b/xacml-translation/xacml.rego new file mode 100644 index 0000000..b5ba0ff --- /dev/null +++ b/xacml-translation/xacml.rego @@ -0,0 +1,726 @@ +package equivalence + +import future.keywords.every +import future.keywords.if +import future.keywords.in + +######################################################################## +# Data Types +######################################################################## + +## MatchResult + +# - is_match => { "match_result": true } +# - no_match => { "match_result": false } +# - indeterminate => { "match_result": "indeterminate" } + +## Decision + +# - permit => { "decision": "permit" } +# - deny => { "decision": "deny" } +# - not_applicable => { "decision": "not_applicable" } +# - indeterminate => { "decision": "indeterminate" } + +## Extended Decision + +# - permit => { "decision_extended": "permit" } +# - deny => { "decision_extended": "deny" } +# - not_applicable => { "decision_extended": "not_applicable" } +# - indeterminate => { "decision_extended": "indeterminate" } +# - indeterminate_d => { "decision_extended": "indeterminate_d" } +# - indeterminate_p => { "decision_extended": "indeterminate_p" } +# - indeterminate_dp => { "decision_extended": "indeterminate_dp" } + +lift_decision_indeterminate({ "decision": "not_applicable" }) := { "decision": "not_applicable" } +lift_decision_indeterminate({ "decision": "permit" }) := { "decision": "indeterminate_p" } +lift_decision_indeterminate({ "decision": "deny" }) := { "decision": "indeterminate_d" } +lift_decision_indeterminate({ "decision": "indeterminate" }) := { "decision": "indeterminate_dp" } +lift_decision_indeterminate({ "decision": "indeterminate_dp" }) := { "decision": "indeterminate_dp" } +lift_decision_indeterminate({ "decision": "indeterminate_p" }) := { "decision": "indeterminate_p" } +lift_decision_indeterminate({ "decision": "indeterminate_d" }) := { "decision": "indeterminate_d" } + +## Value + +# - { "kind": "primitive", +# "type": string, +# "value": string } +# - { "kind": "bag", +# "values": ... } + +### Booleans + +true_value := { "kind": "primitive", "type": "boolean", "value": true } +false_value := { "kind": "primitive", "type": "boolean", "value": false } +indeterminate_value := { "kind": "primitive", "type": "boolean" } + +is_indeterminate(value) if { is_null(value.value) } + +## StatusCode + +# - ok => { "status": "ok" } +# - missing_attribute => { "status": "missing_attribute" } +# - syntax_error => { "status": "syntax_error" } +# - processing_error => { "status": "processing_error" } + +## AttributeDesignator + +# - { category : string +# identifier : string +# type : string +# issuer : string or null +# must_be_present : boolean } + +## Expression + +# - { "expression": "apply", +# "function": string, +# "args": [string, ...] } +# - { "expression": "attribute_designator", +# "inner": AttributeDesignator } +# - { "expression": "attribute_value", +# "inner": Value } +# - { "expression": "function" +# "function": string } + +## Match + +# - { "function": string, +# "designator": AttributeDesignator, +# "value": Value } + +## Obligation + +# - { "assignments": [Attribute, ...], +# "identifier": string } + +## ObligationExpression + +# - { "assignments": [AttributeAssignmentExpression, ...], +# "identifier": string, +# "fulfill_on": Decision } + +## Advice + +# - { "assignments": [Attribute, ...], +# "identifier": string } + +## AdviceExpression + +# - { "assignments": [AttributeAssignmentExpression, ...], +# "identifier": string, +# "applies_to": Decision } + +## AttributeAssignmentExpression + +# - { "category": string, +# "identifier": string, +# "issuer": string or null, +# "expression": Expression } + +## Target: [[[Expression, ...], ...], ...] + +## Rule + +# - { "target": Target, +# "condition": Expression or null, +# "effect": "permit" or "deny", +# "obligations": [ObligationExpression, ...], +# "advice": [AdviceExpression, ...] } + +## Policy + +# - { "combinator": string, +# "target": Target, +# "obligations": [ObligationExpression, ...], +# "advice": [AdviceExpression, ...] } + +## PolicySet + +# - { "combinator": string, +# "target": Target, +# "obligations": [ObligationExpression, ...], +# "advice": [AdviceExpression, ...] } + +# We assume the request attributes are stored in `input.request` as an array or set of +# +# { category : string +# identifier : string +# issuer : string or null +# value : [Value, ...] } + +######################################################################## +# Match Functions +######################################################################## + +## TODO +apply_xacml_function("urn:oasis:names:tc:xacml:1.0:function:string-equal", [("http://www.w3.org/2001/XMLSchema#string", a), ("http://www.w3.org/2001/XMLSchema#string", b)]) := true_value if { + a == b +} else := false_value + +######################################################################## +# AttributeDesignator +######################################################################## + +designator_matches(designator, attribute) if { + attribute.category == designator.category + attribute.identifier == designator.identifier + attribute.value.type == designator.type + attribute.attr.issuer == null +} + +designator_matches(designator, attribute) if { + attribute.category == designator.category + attribute.identifier == designator.identifier + attribute.value.type == designator.type + attribute.attr.issuer == designator.issuer +} + +evaluate_designator(designator) := result if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] + count(xs) > 0 + result := { "kind": "bag", "values": xs } +} + +evaluate_designator(designator) := result if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] + count(xs) == 0 + not designator.must_be_present + result := { "kind": "bag", "values": xs } +} + +evaluate_designator(designator) := { "status": "missing_attribute" } if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] + count(xs) == 0 + designator.must_be_present +} + +######################################################################### +# Match +######################################################################## + +evaluate_match(match) := { "match_result": true_value } if { + designator_result := evaluate_designator(match.designator) + + # Designator evaluates without error. + is_array(designator_result) + + some x in designator_result + apply_xacml_function(match.fn, x).value == true +} else := { "match_result": indeterminate_value } if { + designator_result := evaluate_designator(match.designator) + + # Designator evaluates without error. + is_array(designator_result) + + some x in designator_result + is_indeterminate(apply_xacml_function(match.fn, x)) +} else := { "match_result": false_value } if { + designator_result := evaluate_designator(match.designator) + + # Designator evaluates without error. + is_array(designator_result) +} else := { "match_result": indeterminate_value } + +# Last case runs when evaluating the designator results in an error. + +evaluate_all_of(conj) := { "match_result": true_value } if { + every x in conj { + evaluate_match(x) == true + } +} else := { "match_result": "indeterminate" } if { + some x in conj + is_indeterminate(evaluate_match(x).match_result) +} else := { "match_result": "no_match" } + +evaluate_any_of([]) := { "match_result": true_value } +evaluate_any_of(disj) := { "match_result": true_value } if { + some x in disj + evaluate_all_of(x) == { "match_result": true_value } +} else := { "match_result": "indeterminate" } if { + some x in disj + evaluate_all_of(x) == { "match_result": true_value } +} else := { "match_result": "no_match" } + + +######################################################################## +# Target +######################################################################## + +evaluate_target([]) := { "match_result": true_value } +evaluate_target(xs) := { "match_result": true_value } if { + every disj in xs { + evaluate_any_of(disj).match_result.value == true + } +} else := { "match_result": false_value } if { + some disj in xs + evaluate_any_of(disj).match_result.value == false +} else := { "match_result": indeterminate_value } + +######################################################################## +# Expression +######################################################################## + +evaluate_expression({ "expression": "apply", "function": function_name, "args": args }) := x if { + x := apply_xacml_function(function_name, args) +} +evaluate_expression({ "expression": "attribute_designator", "inner": designator }) := x if { + x := evaluate_designator(designator) +} +evaluate_expression({ "expression": "attribute_value", "inner": value }) := x if { + x := value +} +evaluate_expression({ "expression": "function", "function": name }) := x if { + x := name +} + +######################################################################## +# Obligations and Advice +######################################################################## + +evaluate_attribute_assignment_expression(expr) := assignment { + { "kind": "primitive", "value": inner } = evaluate_expression(expr.expression) + assignment := { "category": expr.category, + "identifier": expr.identifier, + "issuer": expr.issuer, + "value": inner } +} + +evaluate_obligation_expression(obligation_expression) := obligation { + assignments := [evaluate_attribute_assignment_expression(expr) | expr := obligation_expression.assignments[_]] + obligation := { "assignments": assignments, "identifier": obligation_expression.identifier } +} + +evaluate_advice_expression(advice_expression) := advice { + assignments := [evaluate_attribute_assignment_expression(expr) | expr := advice_expression.assignments[_]] + advice := { "assignments": assignments, "identifier": advice_expression.identifier } +} + + +######################################################################## +# Rule +######################################################################## + +# Condition is specified and applicable +evaluate_rule_decision(rule) := { "decision_extended": decision } { + evaluate_target(rule.target).match_result.value == true + + is_object(rule.condition) + evaluate_expression(rule.condition) == true + + decision := rule.effect +} +# Condition is specified and not applicable +evaluate_rule_decision(rule) := { "decision_extended": "not_applicable" } { + evaluate_target(rule.target).match_result.value == true + evaluate_expression(rule.condition) == false +} +# Condition is indeterminate +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_p" } { + evaluate_target(rule.target).match_result.value == true + condition := evaluate_expression(rule.condition) + is_null(condition) + rule.effect == "permit" +} +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_d" } { + evaluate_target(rule.target).match_result.value == true + condition := evaluate_expression(rule.condition) + is_null(condition) + rule.effect == "deny" +} +# Condition is unspecified +evaluate_rule_decision(rule) := { "decision_extended": decision } { + evaluate_target(rule.target).match_result.value == true + decision := rule.effect +} + +evaluate_rule_decision(rule) := { "decision_extended": "not_applicable" } { + evaluate_target(rule.target).match_result.value == false +} +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_p" } { + is_indeterminate(evaluate_target(rule.target)) + rule.effect == "permit" +} +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_d" } { + is_indeterminate(evaluate_target(rule.target)) + rule.effect == "permit" +} + +evaluate_rule_advices(rule) := { "advice": advice } if { + decision := evaluate_rule_decision(rule) + advice := [expr | expr := rule.advice[_]; expr.applies_to == decision ] +} + +evaluate_rule_obligations(rule) := { "obligations": obligations } if { + decision := evaluate_rule_decision(rule) + obligations := [expr | expr := rule.obligations[_]; expr.fulfill_on == decision ] +} + +######################################################################## +# Policy +######################################################################## + +evaluate_rule_combinator("deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("ordered_deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("ordered_permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("deny_unless_permit", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "deny" } + +evaluate_rule_combinator("permit_unless_deny", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "permit" } + +evaluate_rule_combinator("first_applicable", results) := result if { + indices := [i | results[i].decision_extended != "not_applicable"] + count(indices) > 0 + result := results[max(indices)] + result.decision_extended == "deny" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("legacy_deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("ordered_legacy_deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("legacy_permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +evaluate_rule_combinator("ordered_legacy_permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +# child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)] +evaluate_policy_decision(policy, child_results) := decision if { + evaluate_target(policy.target).match_result.value == true + decision := evaluate_rule_combinator(policy.combinator, child_results) +} else := decision if { + is_indeterminate(evaluate_target(policy.target)) + decision := lift_decision_indeterminate(evaluate_rule_combinator(policy.combinator, child_results)) +} else := { "decision_extended": "not_applicable" } + +# children_advice := [advice | rule := policy.rules[_]; expr := evaluate_rule_advices(rule); advice := expr[_]] +evaluate_policy_advices(policy, child_results, children_advice) := { "advice" : advice } if { + decision := evaluate_policy_decision(policy, child_results) + policy_advice := [expr | expr := policy.advice[_]; expr.applies_to == decision ] + advice := array.concat(policy_advice, children_advice) +} + +# children_obligations := [obligation | rule := policy.rules[_]; expr := evaluate_rule_obligations(rule); obligation := expr[_]] +evaluate_policy_obligations(policy, child_results, children_obligations) := { "obligations" : obligations } if { + decision := evaluate_policy_decision(policy, child_results) + policy_obligations := [expr | expr := policy.obligations[_]; expr.applies_to == decision ] + obligations := array.concat(policy_obligations, children_obligations) +} + +######################################################################## +# PolicySet +######################################################################## + +evaluate_policy_combinator("deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("ordered_deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("ordered_permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { + some result in results + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { + some result1 in results + some result2 in results + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("deny_unless_permit", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "deny" } + +evaluate_policy_combinator("permit_unless_deny", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "permit" } + +evaluate_policy_combinator("first_applicable", results) := result if { + indices := [i | results[i].decision_extended != "not_applicable"] + count(indices) > 0 + result := results[max(indices)] + result.decision_extended == "deny" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("only_one_applicable", results) := result if { + applicable := [result | result := results[i]; result.decision_extended != "not_applicable"] + count(applicable) == 1 + result := applicable[0] +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("legacy_deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "indeterminate" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("ordered_legacy_deny_overrides", results) := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "indeterminate" +} else := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("legacy_permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate" +} else := { "decision_extended": "not_applicable" } + +evaluate_policy_combinator("ordered_legacy_permit_overrides", results) := { "decision_extended": "permit" } if { + some result in results + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { + some result in results + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { + some result in results + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } + +evaluate_policyset_decision(policyset, child_results) := decision if { + evaluate_target(policyset.target).match_result.value == true + decision := evaluate_policy_combinator(policyset.combinator, child_results) +} else := decision if { + is_indeterminate(evaluate_target(policyset.target)) + decision := lift_decision_indeterminate(evaluate_policy_combinator(policyset.combinator, child_results)) +} else := { "decision_extended": "not_applicable" } + +evaluate_policyset_advices(policyset, child_results, child_advice) := { "advice" : advice } if { + decision := evaluate_policyset_decision(policyset, child_results) + policyset_advice := [expr | expr := policyset.advice[_]; expr.applies_to == decision ] + advice := array.concat(policyset_advice, child_advice) +} + +evaluate_policyset_obligations(policyset, child_results, child_obligations) := { "obligations" : obligations } if { + decision := evaluate_policyset_decision(policyset, child_results) + policyset_obligations := [expr | expr := policyset.obligations[_]; expr.applies_to == decision ] + obligations := array.concat(policyset_obligations, child_obligations) +} |