2 "sfa-input" specifies the subset of the requestor context that this match needs to see. It is specified as an xpath expression.
3 For this simple match, we just need to look at sfa-input.
5 "rule" specifies an xpath/xquery expression that evaluates the match. In this case, we just check if the requestor's HRN is the same
6 as the one matched by this rule.
11 <!-- Empty context. We _always_ get the hrn of the current user -->
12 <context select="//sfa/current/user@hrn"/>
16 <help>HRN of the user requesting resouces</help>
17 <operand>HRN</operand>
20 <processor filename="hrn.xsl"/>