Add examples for REFERENCE and APPEND only

documentation/IDTA-01004/modules/ROOT/pages/annex/json-access-rule-examples.adoc

@@ -26,6 +26,13 @@ include::partial$examples/allow-read-complete-api.json[]
 include::partial$examples/allow-read-list-semanticids.json[]
 ----
 
+== Allow READ access for Anonymous to submodels only if machine not-running
+
+[source,json,linenums]
+----
+include::partial$examples/allow-read-list-semanticids-machinestate.json[]
+----
+
 == Allow READ and UPDATE for specific authenticated users
 
 [source,json,linenums]
@@ -74,3 +81,10 @@ include::partial$examples/allow-read-submodels-id-pattern.json[]
 ----
 include::partial$examples/filter.json[]
 ----
+
+== Allow only to add elements to the CertificateSet in any Submodel
+
+[source,json,linenums]
+----
+include::partial$examples/allow-create-only-specific.json[]
+----

documentation/IDTA-01004/modules/ROOT/pages/annex/text-access-rule-examples.adoc

@@ -26,6 +26,13 @@ include::partial$examples/allow-read-complete-api.bnf[]
 include::partial$examples/allow-read-list-semanticids.bnf[]
 ----
 
+== Allow READ access for Anonymous to submodels only if machine not-running
+
+[source,bnf,linenums]
+----
+include::partial$examples/allow-read-list-semanticids-machinestate.bnf[]
+----
+
 == Allow READ and UPDATE for specific authenticated users
 
 [source,bnf,linenums]
@@ -69,6 +76,13 @@ include::partial$examples/allow-read-all-users-of-company-for-submodel.bnf[]
 include::partial$examples/allow-read-submodels-id-pattern.bnf[]
 ----
 
+== Allow only to add elements to the CertificateSet in any Submodel
+
+[source,bnf,linenums]
+----
+include::partial$examples/allow-create-only-specific.bnf[]
+----
+
 == Example with FILTER statement
 
 [source,bnf,linenums]

documentation/IDTA-01004/modules/ROOT/partials/examples/allow-create-only-specific.bnf

@@ -0,0 +1,12 @@
+ACCESSRULE:
+  ATTRIBUTES:
+    CLAIM("Role")
+  RIGHTS: CREATE
+  ACCESS: ALLOW
+  OBJECTS:
+    IDENTIFIABLE $sm("*")
+  FORMULA:
+    $and(
+      CLAIM("Role") $eq "person with legitimate interest",
+      $sme#semanticId $eq "CertificateSet"
+    )

documentation/IDTA-01004/modules/ROOT/partials/examples/allow-create-only-specific.json

@@ -0,0 +1,48 @@
+{
+  "AllAccessPermissionRules": {
+    "rules": [
+      {
+        "ACL": {
+          "ATTRIBUTES": [
+            {
+              "CLAIM": "Role"
+            }
+          ],
+          "RIGHTS": [
+            "READ"
+          ],
+          "ACCESS": "ALLOW"
+        },
+        "OBJECTS": [
+          {
+            "IDENTIFIABLE": "$sm(\"*\")"
+          }
+        ],
+        "FORMULA": {
+          "$and": [
+            {
+              "$eq": [
+                {
+                  "CLAIM": "Role"
+                },
+                {
+                  "$strVal": "person with legitimate interest"
+                }
+              ]
+            },
+            {
+              "$eq": [
+                {
+                  "$field": "$sme#semanticId"
+                },
+                {
+                  "$strVal": "CertificateSet"
+                }
+              ]
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

documentation/IDTA-01004/modules/ROOT/partials/examples/allow-read-list-semanticids-machinestate.bnf

@@ -0,0 +1,15 @@
+ACCESSRULE:
+  ATTRIBUTES:
+    GLOBAL(ANONYMOUS)
+  RIGHTS: READ
+  ACCESS: ALLOW
+  OBJECTS:
+    ROUTE  "*"
+  FORMULA:
+    $and(
+      REFERENCE($sme("SubmodelID-OperationalData").machineState#value) $eq "not-running",
+      $or(
+        $sm#semanticId $eq "SemanticID-Nameplate",
+        $sm#semanticId $eq "SemanticID-TechnicalData"
+      )
+    )

documentation/IDTA-01004/modules/ROOT/partials/examples/allow-read-list-semanticids-machinestate.json

@@ -0,0 +1,64 @@
+{
+  "AllAccessPermissionRules": {
+    "rules": [
+      {
+        "ACL": {
+          "ATTRIBUTES": [
+            {
+              "GLOBAL": "ANONYMOUS"
+            }
+          ],
+          "RIGHTS": [
+            "READ"
+          ],
+          "ACCESS": "ALLOW"
+        },
+        "OBJECTS": [
+          {
+            "ROUTE": "*"
+          }
+        ],
+        "FORMULA": {
+          "$and": [
+            {
+              "$eq": [
+                {
+                  "REFERENCE": {
+                    "$sme(\"SubmodelID-OperationalData\").machineState#value"
+                  }
+                },
+                {
+                  "$strVal": "not-running"
+                }
+              ]
+            },
+            {
+              "$or": [
+                {
+                  "$eq": [
+                    {
+                      "$field": "$sm#semanticId"
+                    },
+                    {
+                      "$strVal": "SemanticID-Nameplate"
+                    }
+                  ]
+                },
+                {
+                  "$eq": [
+                    {
+                      "$field": "$sm#semanticId"
+                    },
+                    {
+                      "$strVal": "SemanticID-TechnicalData"
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      }
+    ]
+  }
+}