A condition represents a logical expression that must be evaluated to true in order to execute the rule body part. If this part is missing, a logical true is assumed; that is, the rule’s body is always executed. The conditions part contains a list of conditions that are combined together with the conjunction logical operator (“&&”). All conditions in the list must be evaluated to true for the whole conditional part to be evaluated to true. The condition can be either a claims selection operator or aggregate function call. These two are mutually exclusive, which means that aggregate functions and claim selectors cannot be combined in a single rule conditions part.

The rule body can contain only a single issuance statement. If the claim selectors are used in the conditions part, the rule body is executed as many times as there are claims in the conditions part output collection. If a single claim selector is used, the conditions part output collection is equal to the claim selector return value. If more than one claim selector is used, the conditions part output is equal to a Cartesian product between individual output claims collections as produced by the claims selectors, going from left to right.

The rule body represents a claim issuance action. There are two claim issuance actions that the language recognizes:

• Issue statement: The issue statement creates a claim that goes to both evaluation and output claim collections. For example, the following statement issues a new claim based on its evaluation context:
  
  c:[type == "Name"] => issue(type = "Greeting", value = "Hello " + c.value);
  
  
• Add statement: The add statement creates a new claim that is added only to the evaluation context collection. For example, the following statement adds a new claim to the evaluation context:
  
  [type == "Name", value == "domain\user"] => add(type = "Role", value = "Editor");
  
  

There are three forms of issuance statements, regarding arguments and the statement behavior:

• Claim copy: The claim copy creates a copy of the existing claim in the output claims collection. This issuance form only makes sense when combined with the “issue” issuance statement. When it is combined with “add” issuance statement, it does not have any effect. This is because the claim to be copied is already present in the evaluation context and the claim copy issuance does not another exact copy of an existing claim into the evaluation context collection.
  
  
• New claim: Creates a new claim, given the values for various claim properties. Claim.Type must be specified; all other claim properties are optional. The order of arguments for this form is ignored.
  
  
• New claims with values from an attribute store: This form creates claims with values that are retrieved from an attribute store. It is possible to create multiple claim types by using a single issuance statement, which is important for attribute stores that make network or disk input/output (I/O) operations during the attribute retrieval. Therefore, it is desirable to limit the number of roundtrips between the policy engine and the attribute store. It is also legal to create multiple claims for a given claim type. When the attribute store returns multiple values for a given claim type, the issuance statement automatically creates a claim for each returned claim value. An attribute store implementation uses the param arguments to substitute the placeholders in the query argument with values that are provided in param arguments. The placeholders use the same syntax as the .NET String.Format() function (for example, {1}, {2}, and so on). The order of the arguments for this form of issuance is important, and it must be the order which is prescribed in the following grammar.