OPL Examples

Each example is a complete policy. The first five are the shape the Magistrate studio writes. None sets on_indeterminate, so UNKNOWN is deny. The rest use parts of OPL the engine decides but the studio doesn't write yet. See Language for what each keyword means.

Allow only Austria

A device outside Austria gets deny. The question is "Is the device in Austria?", and YES is permit.

policy p_3b41af1558a1448b8845fa2821871b5d {
  combine deny_overrides
  rule deny when outside(country("AT")) reason "E-304"
  default permit
  freshness 5m
}

Exclude Cuba and Iran

A device in Cuba or Iran gets deny. Every other device gets permit. The question is "Is the device in Cuba or Iran?", and YES is deny.

policy p_efdbc3832b1a48d5878f96ddf3dccdda {
  combine deny_overrides
  rule deny when within(country("CU") union country("IR")) reason "E-303"
  default permit
  freshness 5m
}

The United States, except California

Two deny rules. A device outside the US, or inside California, gets deny.

policy p_9450142ac044410c96b0c392b8875af5 {
  combine deny_overrides
  rule deny when within(subdivision("US-CA")) reason "E-305"
  rule deny when outside(country("US")) reason "E-304"
  default permit
  freshness 5m
}

If a device's proof names only its country, the California rule can't be settled, so the answer is UNKNOWN (cause undecidable), which is deny.

The OFAC embargo

The studio's OFAC list: Cuba, Iran, North Korea, and the Ukrainian regions Crimea (UA-43), Sevastopol (UA-40), Donetsk (UA-14) and Luhansk (UA-09).

policy p_a356e4585bf5466cb0f36bc41a1caeb4 {
  combine deny_overrides
  rule deny when within(country("CU") union country("IR") union country("KP") union subdivision("UA-43") union subdivision("UA-40") union subdivision("UA-14") union subdivision("UA-09")) reason "E-303"
  default permit
  freshness 5m
}

The United States, including its territories

ISO codes Puerto Rico, Guam and the other territories separately from US. To include them, list them.

policy p_7e78819f31f54f569706737db8fa796f {
  combine deny_overrides
  rule deny when outside(country("US") union country("PR") union country("GU") union country("VI") union country("AS") union country("MP")) reason "E-304"
  default permit
  freshness 5m
}

Allow-list with permit rules

Not yet written by the studio. Each permit rule names one place, and every other device gets the default, deny.

policy p_6381b5844203465ab011a490d0ccdf43 {
  rule permit when within(country("AT"))
  rule permit when within(country("DE"))
  rule permit when within(country("CH"))
  default deny
  freshness 5m
}

A geofence around a point

Not yet written by the studio. A device within 2 km of central Vienna gets permit. The engine decides discs today, but the Magistrate module throws bindingUnavailable for them until an Octet SDK release can prove one.

policy p_c5bc9d87a6be4bb6b2db28138e43506f {
  rule permit when within(disc(48.2082, 16.3738, 2km))
  default deny
  freshness 5m
}

A country, minus one state

Not yet written by the studio. The same decision as two deny rules, written as one region with difference.

policy p_0bc79291bb4e452eac8c52f57355895d {
  rule deny when outside(country("US") difference subdivision("US-NJ"))
  default permit
  freshness 5m
}

Require a state-level proof

Not yet written by the studio. The policy refuses to decide on a proof that names only a country, and answers UNKNOWN instead, with cause other. It does so even when the answer looks obvious, for example for a phone in London that proves only GB.

policy p_2242fb3f9b6b400f8ed37c8375e30a2f {
  requires proof_level >= subdivision
  rule deny when outside(subdivision("US-NY"))
  default permit
  freshness 5m
}