# OPL Examples

Each example is a complete policy. The first five are the shape the Magistrate studio writes. None sets `on_indeterminate`, so UNKNOWN is `deny`. The rest use parts of OPL the engine decides but the studio doesn't write yet. See [Language](/docs/magistrate/opl/language/) for what each keyword means.

#### Allow only Austria

A device outside Austria gets `deny`. The question is "Is the device in Austria?", and YES is `permit`.

```opl
policy p_3b41af1558a1448b8845fa2821871b5d {
  combine deny_overrides
  rule deny when outside(country("AT")) reason "E-304"
  default permit
  freshness 5m
}
```

#### Exclude Cuba and Iran

A device in Cuba or Iran gets `deny`. Every other device gets `permit`. The question is "Is the device in Cuba or Iran?", and YES is `deny`.

```opl
policy p_efdbc3832b1a48d5878f96ddf3dccdda {
  combine deny_overrides
  rule deny when within(country("CU") union country("IR")) reason "E-303"
  default permit
  freshness 5m
}
```

#### The United States, except California

Two deny rules. A device outside the US, or inside California, gets `deny`.

```opl
policy p_9450142ac044410c96b0c392b8875af5 {
  combine deny_overrides
  rule deny when within(subdivision("US-CA")) reason "E-305"
  rule deny when outside(country("US")) reason "E-304"
  default permit
  freshness 5m
}
```

If a device's proof names only its country, the California rule can't be settled, so the answer is UNKNOWN (`cause` `undecidable`), which is `deny`.

#### The OFAC embargo

The studio's OFAC list: Cuba, Iran, North Korea, and the Ukrainian regions Crimea (`UA-43`), Sevastopol (`UA-40`), Donetsk (`UA-14`) and Luhansk (`UA-09`).

```opl
policy p_a356e4585bf5466cb0f36bc41a1caeb4 {
  combine deny_overrides
  rule deny when within(country("CU") union country("IR") union country("KP") union subdivision("UA-43") union subdivision("UA-40") union subdivision("UA-14") union subdivision("UA-09")) reason "E-303"
  default permit
  freshness 5m
}
```

:::note

A device that proves only that it is in Ukraine gets UNKNOWN, which is `deny`. Its proof can't say whether it is in one of the listed regions.

:::

#### The United States, including its territories

ISO codes Puerto Rico, Guam and the other territories separately from `US`. To include them, list them.

```opl
policy p_7e78819f31f54f569706737db8fa796f {
  combine deny_overrides
  rule deny when outside(country("US") union country("PR") union country("GU") union country("VI") union country("AS") union country("MP")) reason "E-304"
  default permit
  freshness 5m
}
```

#### Allow-list with permit rules

Not yet written by the studio. Each permit rule names one place, and every other device gets the default, `deny`.

```opl
policy p_6381b5844203465ab011a490d0ccdf43 {
  rule permit when within(country("AT"))
  rule permit when within(country("DE"))
  rule permit when within(country("CH"))
  default deny
  freshness 5m
}
```

#### A geofence around a point

Not yet written by the studio. A device within 2 km of central Vienna gets `permit`. The engine decides discs today, but the Magistrate module throws `bindingUnavailable` for them until an Octet SDK release can prove one.

```opl
policy p_c5bc9d87a6be4bb6b2db28138e43506f {
  rule permit when within(disc(48.2082, 16.3738, 2km))
  default deny
  freshness 5m
}
```

#### A country, minus one state

Not yet written by the studio. The same decision as two deny rules, written as one region with `difference`.

```opl
policy p_0bc79291bb4e452eac8c52f57355895d {
  rule deny when outside(country("US") difference subdivision("US-NJ"))
  default permit
  freshness 5m
}
```

#### Require a state-level proof

Not yet written by the studio. The policy refuses to decide on a proof that names only a country, and answers UNKNOWN instead, with `cause` `other`. It does so even when the answer looks obvious, for example for a phone in London that proves only `GB`.

```opl
policy p_2242fb3f9b6b400f8ed37c8375e30a2f {
  requires proof_level >= subdivision
  rule deny when outside(subdivision("US-NY"))
  default permit
  freshness 5m
}
```