latest installment of xacml goodness

See commit notes for details. The delegate is at the stage of working through ITs for basic roles policies..