What is the XML rule for Block modifies for failed password publish operations if reset password is false?

<rule>    <description>Block modifies for failed password publish operations if reset password is false</description>    <conditions>        <and>            <if-global-variable mode="nocase" name="reset-external-password-on-failure" op="equal">false</if-global-variable>            <if-operation op="equal">modify</if-operation>            <if-xpath op="true">modify-attr[@attr-name='urn:ietf:params:scim:schemas:ilm:static:1.0:User:nspmDistributionPassword' and @failed-sync='true']</if-xpath>          </and>      </conditions>    <actions>        <!-- Block a password reset -->        <do-veto/>      </actions>  </rule>