@salesforce/afv-skills 1.67.0 → 1.68.0

package/skills/platform-policy-rule-generate/references/condition-templates.md

@@ -0,0 +1,89 @@
+# Condition Templates
+
+Use these templates only after resolving the reference values in the target org.
+
+## Entity Type
+
+```xml
+<conditions>
+    <clause>WHEN</clause>
+    <operator>IS</operator>
+    <policyRuleValueSet>
+        <valueText>OBJECT</valueText>
+    </policyRuleValueSet>
+    <resourcePath>ENTITYTYPE</resourcePath>
+</conditions>
+```
+
+For a UI-renderable object-level (OLS/GOVERNANCE `TupleRead`) policy, both `OBJECT` and `FIELD` entity-type conditions are required and must be OR'd together — see the OLS section in `policy-shapes.md` and the entity-type discriminator rule in `ui-compatibility.md`. Omitting the pair still deploys and works at runtime, but crashes the Policy Builder on open (UI-only failure, not a persistence failure). FLS/masking policies use `FIELD` only — do not add an `OBJECT` condition for those.
+
+## Standard Tag
+
+```xml
+<conditions>
+    <clause>WHEN</clause>
+    <operator>CONTAINS_ANY</operator>
+    <policyRuleValueSet>
+        <valueReference>EXACT.STANDARD.TAG.NAME</valueReference>
+        <valueReferenceType>STANDARD_TAG</valueReferenceType>
+    </policyRuleValueSet>
+    <resourcePath>TAG</resourcePath>
+</conditions>
+```
+
+## Standard Classification
+
+```xml
+<conditions>
+    <clause>WHEN</clause>
+    <operator>CONTAINS_ANY</operator>
+    <policyRuleValueSet>
+        <valueReference>EXACT.STANDARD.CLASSIFICATION.NAME</valueReference>
+        <valueReferenceType>STANDARD_CLASSIFICATION</valueReferenceType>
+    </policyRuleValueSet>
+    <resourcePath>CLASSIFICATION</resourcePath>
+</conditions>
+```
+
+## Custom Permission
+
+```xml
+<conditions>
+    <clause>WHEN</clause>
+    <operator>CONTAINS_ANY</operator>
+    <policyRuleValueSet>
+        <valueReference>EXACT_CUSTOM_PERMISSION_DEVELOPER_NAME</valueReference>
+        <valueReferenceType>CUSTOM_PERMISSION</valueReferenceType>
+    </policyRuleValueSet>
+    <principalPath>ASSIGNED_PERMISSIONS_PATH</principalPath>
+</conditions>
+```
+
+## Principal Scalar Attribute
+
+Use the complete `principalExpression` template in `principal-expression.md`. Its right-side comparison is normally `<valueText>...</valueText>`.
+
+For FLS or masking, instantiate the Entity Type template once with `FIELD`. For OLS, instantiate it twice, first with `OBJECT` and then with `FIELD`.
+
+## RLS Record Field Equals Principal Attribute
+
+Use this template in normal author mode whenever the request compares a resource field to the requesting principal's own attribute (for example, "records where `OwnerDepartment` matches the user's `Department`"). `SCALAR_ATTRIBUTE` is a confirmed, deployable, Policy Builder-compatible principal path for this comparison, per DG UI source (this is how the builder itself authors the condition, not established by a per-shape round-trip).
+
+```xml
+<conditions>
+    <clause>WHEN</clause>
+    <operator>EQUALS</operator>
+    <principalExpression>
+        <soqlTarget>
+            <select>EXACT_USER_FIELD</select>
+        </soqlTarget>
+        <type>SOQLTARGETLISTEXPR</type>
+        <version>1</version>
+    </principalExpression>
+    <resourcePath>RECORDFIELD</resourcePath>
+    <valueDomain>EXACT_DMO:EXACT_FIELD</valueDomain>
+    <valuePrincipalPath>SCALAR_ATTRIBUTE</valuePrincipalPath>
+</conditions>
+```
+
+This shape has a resource path, a principal expression, a value domain, and a value principal path. Resolve all three API names in the target org before generating XML.

package/skills/platform-policy-rule-generate/references/conjunction-compiler.md

@@ -0,0 +1,25 @@
+# Conjunction Compiler
+
+Construct conjunctions from a typed intermediate plan, not by hand-editing an expression string.
+
+1. Build and validate all conditions.
+2. Classify each condition into `DATA_SPACE`, `TAG_CLASSIFICATION`, `PERMISSION`, `ENTITY_TYPE`, or `RECORD_FIELD`; never mix classifications, permissions, entity types, and RLS criteria in one local group.
+3. Reject conditions that cannot belong to a selected consumer/profile.
+4. Assign stable condition IDs after final ordering.
+5. Build each non-empty local group with its requested operator.
+6. In normal author mode for `DATACLOUD`, build a typed custom-conjunction plan for UI validation, then serialize it to the ordinary MDAPI `conjunctionExpression`. There is no literal `CUSTOM` XML element. For example, two alternative classifications plus one required permission become `(AND (OR 1 2) (AND 3))`.
+7. For `ALL`, use the general conjunction contract.
+8. Validate that every condition is referenced exactly once, no unknown ID is referenced, no group is empty, and nested RLS join conditions use independent numbering.
+
+In explicit evidence-recreation mode, do not compile or normalize the named API 69.0 example's conjunction. Its exact condition order and conjunction take precedence; validate their internal index consistency and reproduce them verbatim.
+
+For `DATACLOUD`, a typical OLS tree is:
+
+```text
+CUSTOM(AND,
+  ENTITY_TYPE(OR, 1, 2),
+  TAG_CLASSIFICATION(OR, 3, 4),
+  PERMISSION(AND, 5))
+```
+
+The XML has no literal section elements; section identity is represented by the custom-conjunction tree consumed by the UI.

package/skills/platform-policy-rule-generate/references/conjunction-expression.md

@@ -0,0 +1,22 @@
+# Conjunction Expressions
+
+Conditions are numbered in document order, starting at `1`. The `<conjunctionExpression>` uses those numbers in prefix notation.
+
+For six conditions grouped as two entity-type checks, two principal checks, and two tag checks:
+
+```xml
+<conjunctionExpression>(AND (OR 1 2) (AND 3 4) (AND 5 6))</conjunctionExpression>
+```
+
+**Top-level operator must always be `AND`.** Never emit a bare top-level `(OR 1 2)` — the UI treats it as `// ERROR: Unsupported rule!` and silently drops the rule — and never emit a bare top-level condition index (e.g. `3` instead of `(AND 3)`), which crashes the builder. `OR` is allowed only inside a single section's local group, never as (or at) the top level. Wrap every local group under a top-level `AND`: `(AND (OR 1 2))`, `(AND 3)`. See `ui-compatibility.md` for the full non-round-trip checklist.
+
+Construction:
+
+1. Number every `<conditions>` element from top to bottom.
+2. Build each local group using those numbers.
+3. Combine the groups with the top-level `AND` operator — never a bare top-level `OR` or a bare index.
+4. Check that every referenced number exists exactly once in the intended expression.
+
+Do not renumber conditions after changing their order without updating the expression.
+
+An `EXISTS` resource expression can contain nested `policyRuleDefinitionCondition` elements. Its `whereClauseConjunction` has a separate one-indexed namespace. For one nested condition, use `<whereClauseConjunction>1</whereClauseConjunction>` exactly as preserved by the semantic `ExistsJoinRLS` example.

package/skills/platform-policy-rule-generate/references/consumer-all.md

@@ -0,0 +1,9 @@
+# ALL Consumer: General Policy
+
+`consumer=ALL` selects the shared H360 policy contract. It does not apply Data Governance Policy Builder restrictions.
+
+Keep the shared OLS, FLS, direct RLS, join RLS, Transform, condition, expression, and conjunction models reusable here. Apply base metadata, semantic, target-org reference, MDAPI, and runtime validation.
+
+`ALL` does not mean unvalidated. Resolve resource domains, fields, joins, tags, classifications, permissions, and principal expressions before deployment. Reject `PLACEHOLDER` because it is internal-only. Do not reject `PLURAL_ATTRIBUTE` solely because the Data Governance UI cannot render it; require separate MDAPI/runtime evidence for any such policy.
+
+RLS plus tag/classification conditions remain experimental until their combined metadata and runtime semantics are proven. Do not claim support from enum presence alone.

package/skills/platform-policy-rule-generate/references/consumer-datacloud-ui.md

@@ -0,0 +1,91 @@
+# DATACLOUD Consumer: Data Governance UI
+
+In normal author mode, `consumer=DATACLOUD` selects the Data Governance UI-renderability candidate contract. The policy must be representable by the Data Governance Policy Builder and must not rely on the UI silently dropping or rewriting unsupported content. The consumer value alone is not proof of UI validation.
+
+Explicit evidence-recreation mode is the narrow exception. When the request names one of this skill's retrieved API 69.0 examples and asks for exact recreation, preserve that example's exact conjunction and persisted scalar-expression shape even when it is not accepted by the normal author-mode compiler. Do not describe the recreated policy as UI validated; MDAPI retrieval, dry run, deploy, or persistence cannot establish that claim.
+
+## UI Conjunction and Section Grouping
+
+The UI reconstructs policy sections through a custom-conjunction API/UI projection. `whenClauseConjunction=Custom` and `whenClauseCustomConjunction` are API/UI concepts, not XML elements or MDAPI enum values. The generated package still emits ordinary MDAPI XML: serialize the typed plan into a nested `<conjunctionExpression>` using `AND`/`OR` groups. Do not invent a `CUSTOM` XML wrapper or put condition indexes directly in the top-level expression.
+
+- `DATA_SPACE`: `DATASPACE` or `SESSION_DATASPACE`.
+- `TAG_CLASSIFICATION`: `TAG` or `CLASSIFICATION`.
+- `PERMISSION`: `ASSIGNED_PERMISSIONS_PATH` for permission membership, and `SCALAR_ATTRIBUTE` (with a `SOQLTARGETLISTEXPR` `principalExpression`) for a supported principal-attribute comparison. Both are confirmed deployable; `SCALAR_ATTRIBUTE` is UI-renderable per DG UI source (this is how the builder itself authors the condition), not by a per-shape round-trip. Group them together in the `PERMISSION` section.
+- `ENTITY_TYPE`: `ENTITYTYPE`.
+- `RECORD_FIELD`: `RECORDFIELD` or `EXPRESSION`.
+
+Build conditions first, classify them, build each local group with its requested `AND`/`OR`, then build the top-level custom `AND`. Serialize that plan to the MDAPI `conjunctionExpression`. Every condition identifier must appear exactly once, no group may be empty, and no bare condition may be used where the UI expects a group. RLS join `whereClauseConjunction` uses a separate nested index namespace. Validate the API/UI projection separately; MDAPI persistence alone does not prove UI behavior.
+
+The grouping contract is:
+
+| Section group | Conditions kept together | Local grouping |
+|---|---|---|
+| `DATA_SPACE` | Dataspace and session-dataspace conditions | `AND` or `OR` as required by the policy |
+| `TAG_CLASSIFICATION` | Tag and classification conditions | `OR` for alternatives, `AND` for cumulative requirements |
+| `PERMISSION` | Assigned-permission and supported principal-attribute conditions | `AND` or `OR` as required by the policy |
+| `ENTITY_TYPE` | Object/field entity-type discriminator conditions | `OR` for object-versus-field alternatives |
+| `RECORD_FIELD` | Direct record-field and RLS join-expression conditions | `AND` for cumulative RLS criteria |
+
+Examples:
+
+```text
+Two alternative classifications + one required permission:
+Custom conjunction API/UI object:
+CUSTOM(AND,
+  TAG_CLASSIFICATION(OR, 1, 2),
+  PERMISSION(AND, 3))
+
+The corresponding MDAPI XML expression is:
+(AND (OR 1 2) (AND 3))
+```
+
+For an object-level TupleRead policy with two entity-type alternatives, two alternative classifications, and one permission gate:
+
+```text
+(AND (OR 1 2) (OR 3 4) (AND 5))
+```
+
+Here `(OR 1 2)` is the `ENTITY_TYPE` group, `(OR 3 4)` is the `TAG_CLASSIFICATION` group, and `(AND 5)` is the `PERMISSION` group. If the policy is RLS, its direct field or `EXPRESSION` conditions form the `RECORD_FIELD` group instead of being mixed into the tag or permission group. The numbers are assigned only after final condition ordering.
+
+## Shape Restrictions
+
+- One rule per set.
+- One action only; use only UI-supported `Read` or `TupleRead` combinations.
+- At most one resource domain; the UI consumes only the first domain.
+- Use only UI-supported categories, effects, scopes, and transforms.
+- Do not emit `UNLESS` conditions or an `UNLESS` conjunction.
+- Do not emit a plain `AND`/`OR` conjunction in place of the custom conjunction.
+- Never author `PLACEHOLDER`; its recognition by the UI reader does not make it an authoring construct.
+
+## Principal Attributes
+
+Reject `PLURAL_ATTRIBUTE`; it remains unconfirmed. `SCALAR_ATTRIBUTE`/`SOQLTARGETLISTEXPR` is confirmed deployable and UI-compatible per DG UI source (this is how the builder itself authors the condition, not established by a per-shape round-trip) — generate it directly for any attribute the directional table below marks `yes`:
+
+| Attribute | Principal path | Resource/RLS path |
+|---|---:|---:|
+| `CompanyName` | yes | yes |
+| `Department` | yes | yes |
+| `Division` | yes | yes |
+| `Username` | no | yes |
+| `Email` | no | yes |
+| `Title` | yes | yes |
+| `CallCenterId` | yes | yes |
+| `ContactId` | no | yes |
+| `ProfileId` | yes | yes |
+| `UserRoleId` | no | no |
+
+This table is intentionally extensible and reflects the current UI source, not a universal H360 enum.
+
+## RLS
+
+- Resolve the single resource domain and every referenced field in the target org.
+- Resolve every join schema, alias, predicate field, and principal expression field.
+- Reject unresolved value domains; never emit a null or guessed field reference.
+- The UI currently exposes RLS target field types `Text`, `Number`, `Boolean`, `Date`, and `Percent`; currency is normalized as `Number`.
+- Reject `Email`, `Phone`, `Url`, and array-valued target fields for UI-renderable RLS.
+- Validate resource-domain containment when dataspace scope is present.
+- Treat RLS plus tag/classification predicates as unsupported until a UI round-trip and runtime test proves their semantics.
+
+## Evidence Boundary
+
+The UI source confirms its reconstruction and serialization contract. MDAPI deploy/retrieve alone does not prove that a policy opens, saves, and preserves semantics in the UI. Claim UI compatibility only after open/save/retrieve validation.

package/skills/platform-policy-rule-generate/references/deploy-errors.md

@@ -1,54 +1,42 @@
 # Deploy Error Reference
 
-When `sf project deploy start` fails, it prints a per-component status table. Below are the most common error families for `PolicyRuleDefinition` / `PolicyRuleDefinitionSet` metadata.
-
-For verbose output when scripting:
-```bash
-sf project deploy start --target-org <alias> --source-dir … --json --verbose \
-  | jq '.result.details.componentFailures'
-```
+Create/update run over headless-360 `dispatch`/`/headless/metadata`; delete runs over the Data 360 MCP `d360_data_governance_access_policy_delete` tool (Core has no real metadata delete). There is no CLI fallback on either path. This file documents the server-side error taxonomy; the create/update/read errors below surface directly on the `dispatch` path.
 
 ---
 
-## Error Table
+## Headless Dispatch Errors
 
 | Error fragment | Likely cause | Fix |
 |---|---|---|
-| `Not available for deploy for this organization` | Org has `EnforceOMatic` perm (entities visible) but lacks `PolicyRuleMDAPI` org perm | Internal license/feature provisioning — surface to the operator. Both `EnforceOMatic` AND `PolicyRuleMDAPI` are required (see §11.1 of policy.md). |
-| `Cannot find … PolicyRuleDefinition` (older orgs) | Org missing `EnforceOMatic` entirely, or API version too low | Confirm both `EnforceOMatic` and `PolicyRuleMDAPI` perms; ensure `<version>` ≥ 64.0 in package.xml |
-| `INVALIDFORCATEGORY` / `Resource scope … not valid for category …` | Scope × category mismatch (e.g., ACCESS/GOVERNANCE + RECORD scope, or TRANSFORM + ANY scope) | Match scope to category per the §4 matrix in SKILL.md. For OLS/FLS on tagged objects: use `ANY`/`FIELD` scope + tag/classification condition — **not** `<resourceDomain>`. |
-| `Identified record category should use record field …` | Attempted to author an `IDENTIFIED_RECORD` policy with a non-`RECORDFIELD` resource path | Do not author `IDENTIFIED_RECORD` via MDAPI — use a runtime `RuleProvider` instead. |
-| `Invalid resource domain - <name>` | `<resourceDomain>` references an entity that doesn't exist in the target org | Pre-deploy the DMO/entity, or remove the rule until the target is available. Namespaced DMOs (e.g. `ssot__Account__dlm`) need the namespace prefix in the XML. |
-| `An unexpected error occurred. Please include this ErrorId… (-116061062)` (opaque gack on RLS deploy) | RLS rule references a `<valueDomain>` DMO field that exists in metadata but is **not mapped** in the target org's data streams. Server-side NPE instead of a clean validation error. | Verify each `<valueDomain>` field is mapped in Setup → Data Cloud → Data Explorer. Build the rule in the UI first — the UI surfaces field-mapping issues with usable errors where MDAPI doesn't. |
-| `Metadata API received improper input. … Load of metadata from db failed for metadata of type:PolicyRuleDefinition and file name:<name>` (on **retrieve**) | UI-saved RLS rules can fail to round-trip back through MDAPI retrieve in some org states | No clean fix. Use the UI as source of truth for that rule, or hand-author from a known-deployable RLS template. |
-| `Use the principal … with external record category.` | `EXTERNAL_RECORD` rule used a non-`IS_AUTHENTICATED`/`IS_INTERNAL` `principalPath` | Switch principal path or change category |
-| `Unsupported … contextPath` | Used a context path outside `RuleContextPathType.SESSION_DATASPACE` | Not authorable via MDAPI XML — use a runtime `RuleProvider` |
+| `400 FIELD_INTEGRITY_EXCEPTION "Not available for deploy for this organization"` | Type/op is on the MD-CRUD allowlist, but the org lacks the feature/perm provisioning to deploy this metadata type | Org setup gap — surface it to the operator; do not fall back to CLI on this error alone, since the CLI path hits the same org gate. |
+| `400 UNSUPPORTED_OPERATION` | The type/op is genuinely not on the MD-CRUD allowlist | Onboarding gap — surface it to the operator; there is no CLI fallback. |
+| `'body' must be a JSON object, got an unexpected type` | A client/transport let a raw unescaped newline reach the JSON body, or a transient tool-arg serialization glitch (NOT the server rejecting multi-line XML — a properly-escaped multi-line `xmlRep` persists fine) | Flatten `xmlRep` to one line as a defensive default; if it still fails, retry once before concluding the shape is unsupported. |
+| `404` (on GET) | Type/op is allowlisted; the named member does not exist | Expected for a not-yet-created component, not an error. |
+| `405` / no-op `200` (on a `/headless/metadata` DELETE) | Core has no real metadata delete — the verb 405s, and the interim delete is a no-op 200 that removes nothing | Do not delete via `/headless/metadata`. Delete the whole policy over the Data 360 MCP `d360_data_governance_access_policy_delete` tool (removes the Access Policy and its embedded rules by developer name). |
+| DC-connectivity error (on the Data 360 Access Policy delete) | The off-core Data Cloud delete path failed on DC connectivity | Provisioning gap — surface it to the operator; there is no `sf` CLI fallback. Confirm removal via `d360_data_governance_access_policy_get` by name (not-found = success). |
+
+See `references/headless-transport.md` for the full request/response contract.
 
 ---
 
-## OrgPerm Gating
+## Server-Side Validation Errors
 
-Two org permissions are **both** required for MDAPI authoring:
+These deploy-time validation errors are raised by the same metadata deploy engine behind `/headless/metadata`, so they surface directly in the `dispatch` response for `PolicyRuleDefinition` / `PolicyRuleDefinitionSet`. They are shape or org-provisioning problems, not transport problems — fix the authored XML or surface the org gap to the operator; there is no CLI to fall back to.
 
-| Permission | Gate | Effect if missing |
+| Error fragment | Likely cause | Fix |
 |---|---|---|
-| `EnforceOMatic` | `@WsdlGuard` master switch | Entities not visible in UI/Tooling API at all |
-| `PolicyRuleMDAPI` | `orgCanUsePolicyRuleMDAPI` WSDL layer | Deploy fails with `Not available for deploy for this organization` |
-
-`EnforcOMaticMDAPI` is a separate **packaging** gate (`isMdAPIAllowedInternal`) — only required for packaging/change sets, not for DX CLI deploys. After PR #98647 (merged 2026-06-08) the predicate is `DBContext.get().isDoingPackageInstall()`, so DX CLI deploys work with just the two perms above.
+| `Not available for deploy for this organization` | Policy-rule metadata deployment is not enabled for the org | Surface the missing org capability to the operator; do not attempt to bypass the server gate. |
+| `Cannot find … PolicyRuleDefinition` (older orgs) | Policy-rule metadata is unavailable, or the API version is too low | Confirm the org supports policy-rule metadata and ensure the resolved org API version meets the skill's `minApiVersion`. |
+| `INVALIDFORCATEGORY` / `Resource scope … not valid for category …` | Scope × category mismatch (e.g., GOVERNANCE + RECORD scope, or TRANSFORM + ANY scope) | Match a persistence-validated combination in `policy-shapes.md`; do not infer a new category/scope pairing. |
+| `Identified record category should use record field …` | Attempted to author an `IDENTIFIED_RECORD` policy with a non-`RECORDFIELD` resource path | Do not author `IDENTIFIED_RECORD` via MDAPI — use a runtime `RuleProvider` instead. |
+| `Invalid resource domain - <name>` | `<resourceDomain>` references an entity that doesn't exist in the target org | Pre-deploy the DMO/entity, or remove the rule until the target is available. Namespaced DMOs (e.g. `ssot__Account__dlm`) need the namespace prefix in the XML. |
+| Unexpected server error on RLS deploy | RLS rule may reference a `<valueDomain>` DMO field that exists in metadata but is not mapped in the target org's data streams | Verify each `<valueDomain>` field is mapped using a read-only Data 360 MCP / `dispatch_readonly` inspection, then re-issue the create. |
+| `Metadata API received improper input. … Load of metadata from db failed for metadata of type:PolicyRuleDefinition and file name:<name>` (on **GET read-back**) | UI-saved RLS rules can fail to round-trip back through the MD-CRUD read in some org states | No clean fix. Use the UI as source of truth for that rule, or hand-author from a known-deployable RLS template. |
+| `Use the principal … with external record category.` | `EXTERNAL_RECORD` rule used a non-`IS_AUTHENTICATED`/`IS_INTERNAL` `principalPath` | Switch principal path or change category |
+| `Unsupported … contextPath` | Used a context path outside `RuleContextPathType.SESSION_DATASPACE` | Not authorable via MDAPI XML — use a runtime `RuleProvider` |
 
 ---
 
-## Dry-Run First
-
-Always validate before deploying to a long-lived org:
-
-```bash
-sf project deploy start \
-  --target-org <alias> \
-  --source-dir force-app/main/default \
-  --dry-run \
-  --wait 10
-```
+## Validate Before You Persist
 
-A `--dry-run` failure runs the full server-side validation (including the `IDENTIFIED_RECORD` constraint) without persisting. This catches all of the errors in the table above before they affect a real org.
+There is no dry-run on the MD-CRUD path — a `POST create` persists. Front-load correctness instead: resolve every reference in the target org (Data 360 MCP, or a read-only `dispatch_readonly` sObject describe for a custom `__dlm` DMO), match a persistence-validated scope × category combination from `policy-shapes.md`, and GET the component back after the write to confirm it persisted as authored. The same deploy-time server validation (including the `IDENTIFIED_RECORD` constraint) runs inline on the create and returns in the `dispatch` response.

package/skills/platform-policy-rule-generate/references/examples/ExistsJoinRLS/package.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Package xmlns="http://soap.sforce.com/2006/04/metadata">
+    <types>
+        <members>ExistsJoinRLS_Rule_1</members>
+        <name>PolicyRuleDefinition</name>
+    </types>
+    <types>
+        <members>ExistsJoinRLS</members>
+        <name>PolicyRuleDefinitionSet</name>
+    </types>
+    <version>{API_VERSION}</version>
+</Package>

package/skills/platform-policy-rule-generate/references/examples/ExistsJoinRLS/policyRuleDefinitionSets/ExistsJoinRLS.policyRuleDefinitionSet

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PolicyRuleDefinitionSet xmlns="http://soap.sforce.com/2006/04/metadata">
+    <builderCompatible>false</builderCompatible>
+    <builderValidated>false</builderValidated>
+    <label>ExistsJoinRLS</label>
+</PolicyRuleDefinitionSet>

package/skills/platform-policy-rule-generate/references/examples/ExistsJoinRLS/policyRuleDefinitions/ExistsJoinRLS_Rule_1.policyRuleDefinition

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PolicyRuleDefinition xmlns="http://soap.sforce.com/2006/04/metadata">
+    <action>Read</action>
+    <category>RECORD_POLICY_RULE_DEFINITION</category>
+    <effect>Permit</effect>
+    <label>Rule 1</label>
+    <policyRuleDefinitionSetName>ExistsJoinRLS</policyRuleDefinitionSetName>
+    <policyRuleResourceDomains>
+        <resourceDomain>yourcontacts__dlm</resourceDomain>
+    </policyRuleResourceDomains>
+    <principalAuthenticationLevel>INTERNAL</principalAuthenticationLevel>
+    <principalScopeType>ANY</principalScopeType>
+    <resourceScopeType>RECORD</resourceScopeType>
+    <ruleConsumer>DATACLOUD</ruleConsumer>
+    <transformPrecedence>0</transformPrecedence>
+    <whenPolicyRuleDefinitionClauseConjunction>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>CONTAINS_ANY</operator>
+            <policyRuleValueSet>
+                <valueReference>cust_perm1</valueReference>
+                <valueReferenceType>CUSTOM_PERMISSION</valueReferenceType>
+            </policyRuleValueSet>
+            <principalPath>ASSIGNED_PERMISSIONS_PATH</principalPath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>EQUALS</operator>
+            <policyRuleValueSet>
+                <valueText>sdfgd</valueText>
+            </policyRuleValueSet>
+            <principalExpression>
+                <soqlTarget>
+                    <select>Department</select>
+                </soqlTarget>
+                <type>SOQLTARGETLISTEXPR</type>
+                <version>1</version>
+            </principalExpression>
+            <principalPath>SCALAR_ATTRIBUTE</principalPath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>EQUALS</operator>
+            <principalExpression>
+                <soqlTarget>
+                    <select>Email</select>
+                </soqlTarget>
+                <type>SOQLTARGETLISTEXPR</type>
+                <version>1</version>
+            </principalExpression>
+            <resourcePath>RECORDFIELD</resourcePath>
+            <valueDomain>yourcontacts__dlm:EMAIL__c</valueDomain>
+            <valuePrincipalPath>SCALAR_ATTRIBUTE</valuePrincipalPath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>EXISTS</operator>
+            <policyRuleDefinitionCondition>
+                <clause>WHEN</clause>
+                <operator>EQUALS</operator>
+                <policyRuleValueSet>
+                    <valueText>${User.Email}</valueText>
+                </policyRuleValueSet>
+                <resourcePath>RECORDFIELD</resourcePath>
+                <valueDomain>yourcontacts__dlm:EMAIL__c</valueDomain>
+            </policyRuleDefinitionCondition>
+            <resourceExpression>
+                <projection>
+                    <join>
+                        <alias>ci</alias>
+                        <predicate>
+                            <attribute>contacts_to_importcsv__dlm:EMAIL__c</attribute>
+                            <comparator>EQUALS</comparator>
+                            <on>
+                                <field>EMAIL__c</field>
+                                <resourceAlias>resource</resourceAlias>
+                                <schema>yourcontacts__dlm</schema>
+                            </on>
+                        </predicate>
+                        <schema>contacts_to_importcsv__dlm</schema>
+                    </join>
+                </projection>
+                <type>PROJECTION</type>
+                <version>1</version>
+            </resourceExpression>
+            <resourcePath>EXPRESSION</resourcePath>
+            <whereClauseConjunction>1</whereClauseConjunction>
+        </conditions>
+        <conjunctionExpression>(AND (AND 1 2) (OR 3 4))</conjunctionExpression>
+    </whenPolicyRuleDefinitionClauseConjunction>
+</PolicyRuleDefinition>

package/skills/platform-policy-rule-generate/references/examples/FieldReadDeny/package.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Package xmlns="http://soap.sforce.com/2006/04/metadata">
+    <types>
+        <members>FieldReadDeny_Rule_1</members>
+        <name>PolicyRuleDefinition</name>
+    </types>
+    <types>
+        <members>FieldReadDeny</members>
+        <name>PolicyRuleDefinitionSet</name>
+    </types>
+    <version>{API_VERSION}</version>
+</Package>

package/skills/platform-policy-rule-generate/references/examples/FieldReadDeny/policyRuleDefinitionSets/FieldReadDeny.policyRuleDefinitionSet

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PolicyRuleDefinitionSet xmlns="http://soap.sforce.com/2006/04/metadata">
+    <builderCompatible>false</builderCompatible>
+    <builderValidated>false</builderValidated>
+    <label>FieldReadDeny</label>
+</PolicyRuleDefinitionSet>

package/skills/platform-policy-rule-generate/references/examples/FieldReadDeny/policyRuleDefinitions/FieldReadDeny_Rule_1.policyRuleDefinition

@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PolicyRuleDefinition xmlns="http://soap.sforce.com/2006/04/metadata">
+    <action>Read</action>
+    <category>GOVERNANCE_POLICY_RULE_DEFINITION</category>
+    <effect>Forbid</effect>
+    <label>Rule 1</label>
+    <policyRuleDefinitionSetName>FieldReadDeny</policyRuleDefinitionSetName>
+    <principalAuthenticationLevel>INTERNAL</principalAuthenticationLevel>
+    <principalScopeType>ANY</principalScopeType>
+    <resourceScopeType>ANY</resourceScopeType>
+    <ruleConsumer>DATACLOUD</ruleConsumer>
+    <transformPrecedence>0</transformPrecedence>
+    <whenPolicyRuleDefinitionClauseConjunction>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>IS</operator>
+            <policyRuleValueSet>
+                <valueText>FIELD</valueText>
+            </policyRuleValueSet>
+            <resourcePath>ENTITYTYPE</resourcePath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>EQUALS</operator>
+            <policyRuleValueSet>
+                <valueText>RESOLVE_TARGET_PROFILE_ID</valueText>
+            </policyRuleValueSet>
+            <principalExpression>
+                <soqlTarget>
+                    <select>ProfileId</select>
+                </soqlTarget>
+                <type>SOQLTARGETLISTEXPR</type>
+                <version>1</version>
+            </principalExpression>
+            <principalPath>SCALAR_ATTRIBUTE</principalPath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>EQUALS</operator>
+            <policyRuleValueSet>
+                <valueText>gj</valueText>
+            </policyRuleValueSet>
+            <principalExpression>
+                <soqlTarget>
+                    <select>Title</select>
+                </soqlTarget>
+                <type>SOQLTARGETLISTEXPR</type>
+                <version>1</version>
+            </principalExpression>
+            <principalPath>SCALAR_ATTRIBUTE</principalPath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>CONTAINS_ANY</operator>
+            <policyRuleValueSet>
+                <valueReference>DataGovernanceClassifications.DataCategorization.DataQuality.Consistent</valueReference>
+                <valueReferenceType>STANDARD_CLASSIFICATION</valueReferenceType>
+            </policyRuleValueSet>
+            <resourcePath>CLASSIFICATION</resourcePath>
+        </conditions>
+        <conditions>
+            <clause>WHEN</clause>
+            <operator>CONTAINS_ANY</operator>
+            <policyRuleValueSet>
+                <valueReference>DataGovernanceTags.EthicalAiStandards.EthicalAI.Caste</valueReference>
+                <valueReferenceType>STANDARD_TAG</valueReferenceType>
+            </policyRuleValueSet>
+            <resourcePath>TAG</resourcePath>
+        </conditions>
+        <conjunctionExpression>(AND 1 (AND 2 3) (OR 4 5))</conjunctionExpression>
+    </whenPolicyRuleDefinitionClauseConjunction>
+</PolicyRuleDefinition>

package/skills/platform-policy-rule-generate/references/examples/LastCharactersFieldMasking/package.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Package xmlns="http://soap.sforce.com/2006/04/metadata">
+    <types>
+        <members>LastCharactersFieldMasking_Rule_1</members>
+        <name>PolicyRuleDefinition</name>
+    </types>
+    <types>
+        <members>LastCharactersFieldMasking</members>
+        <name>PolicyRuleDefinitionSet</name>
+    </types>
+    <version>{API_VERSION}</version>
+</Package>

package/skills/platform-policy-rule-generate/references/examples/LastCharactersFieldMasking/policyRuleDefinitionSets/LastCharactersFieldMasking.policyRuleDefinitionSet

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PolicyRuleDefinitionSet xmlns="http://soap.sforce.com/2006/04/metadata">
+    <builderCompatible>false</builderCompatible>
+    <builderValidated>false</builderValidated>
+    <label>LastCharactersFieldMasking</label>
+</PolicyRuleDefinitionSet>