ds xacml checks

I'm not sure I follow you on "op/pid/user combo". The xacml hook is checking which ops and only applies on view ops.