What is the XML rule for Prevent unassociated users from being removed from groups?

<rule xmlns:query="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.XdsQueryProcessor">    <description>Prevent unassociated users from being removed from groups</description>    <conditions>        <and>            <if-operation op="equal">modify</if-operation>            <if-class-name op="equal">Group</if-class-name>            <if-op-attr name="urn:ietf:params:scim:schemas:core:2.0:Group:members.$ref" op="changing"/>          </and>      </conditions>    <actions>        <do-for-each>            <arg-node-set>                <token-removed-attr name="urn:ietf:params:scim:schemas:core:2.0:Group:members.$ref"/>              </arg-node-set>            <arg-actions>                <do-set-local-variable name="memberDN">                    <arg-node-set>                        <token-local-variable name="current-node"/>                      </arg-node-set>                  </do-set-local-variable>                <do-for-each>                    <arg-node-set>                        <token-xpath expression="query:readObject($destQueryProcessor, '', $memberDN, '', '')[not(association[. != ''])]"/>                      </arg-node-set>                    <arg-actions>                        <do-strip-xpath expression="$memberDN"/>                      </arg-actions>                  </do-for-each>              </arg-actions>          </do-for-each>        <do-strip-xpath expression="modify-attr/remove-value[not(value)]"/>        <do-strip-xpath expression="modify-attr[not(*)]"/>      </actions>  </rule>