问使用ALFA和XACML编写一个示例ABAC授权策略

EN

namespace policies{
    attribute actionId{
        category = actionCat
        id = "actionId"
        type = string
    }

    attribute resourceType{
        category = resourceCat
        id = "resourceType"
        type = string
    }

    attribute amount{
        category = resourceCat
        id = "amount"
        type = double
    }
    /**
     * The limit could be a subject attribute in the case it's user-specific
     */
    attribute limit{
        category = subjectCat
        id = "limit"
        type = double
    }

    /* 
     * A user can do the `action==transfer` on a resource of `type==bank account` if and only if the `amount transferred 
     * < the amount limit` (e.g. 2000 in your case) ==> **permit**
     * 
     */
     policy transfer{
        target clause actionId == "transfer" and resourceType=="bank account"
        apply firstApplicable
        rule allow{
            condition amount <= limit
            permit
        }
        rule denyTransfer{
            deny
        }
     }
}