Index: examples/access_tests/Makefile
===================================================================
--- examples/access_tests/Makefile	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/Makefile	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,30 @@
+
+DIRECTORY=creddy_prover
+
+.PHONY : runcheck clean 
+runcheck: $(DIRECTORY)
+
+clean:
+	@for i in $(DIRECTORY); do \
+	here=`pwd`; \
+	rm -rf allout.tmp; \
+	cd $$i; \
+	./cleanup.sh all \
+	cd $$here; \
+	done 
+	@rm -rf allout.tmp
+
+runcheck:
+	@echo 'running libabac GENI testing...'
+	@for i in $(DIRECTORY); do \
+	here=`pwd`; \
+	cd $$i; \
+	printf "\n ==> RUN on %s\n" "$$i" >> ../allout.tmp ; \
+	./run_test 1 >> ../allout.tmp 2>/dev/null; \
+	cd $$here; \
+	done 
+	@if test -f allout.tmp && test `diff -q allout.save allout.tmp |wc -l ` -eq 0 ; \
+	then echo "   PASSED"; \
+	else echo "   ERROR:got changes!!!"; \
+	fi
+
Index: examples/access_tests/README
===================================================================
--- examples/access_tests/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,17 @@
+
+In this testing suite, a sample of GENI authorization policy
+is used to exercise libabac's capability.
+
+to run,
+
+  runcheck
+
+
+creddy_prover
+-------------
+This directory contains the creddy/prover version
+
+python
+------
+This directory contains the python version
+
Index: examples/access_tests/allout.save
===================================================================
--- examples/access_tests/allout.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/allout.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,14 @@
+
+ ==> RUN on creddy_prover
+---running scenario s1 
+   PASSED
+---running scenario s2 
+   PASSED
+---running scenario s3 
+   PASSED
+---running scenario s4 
+   PASSED
+---running scenario s5 
+   PASSED
+---running scenario s6 
+   PASSED
Index: examples/access_tests/creddy_prover/README
===================================================================
--- examples/access_tests/creddy_prover/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,55 @@
+
+policy.sh is the main policy file. It contains the RT policy
+  rules Ted translated from Jeff's initial GENI authorization
+  writeup.  There are 6 scenario setups and related query tests.
+
+scenario_s1.sh, a simple user and project example
+  s1_query.py and s1_run_query are 2 sets of query calls where
+  the first is in python and 2nd uses the prover bundled with 
+  libabac
+
+scenario_s2.sh, various member, member_(delegated) and 
+  delegate_member_ relations between different users are setup to 
+  show different possible access policy proof solutions 
+  s2_query.py and s2_run_query are the query calls  
+
+scenario_s3.sh, various memberQ, memberQ_(delegated) and 
+  delegate_memberQ_ relations between users are setup similar to 
+  scenario_s2.sh but with the role qualified.
+  s3_query.py and s3_run_query are the query scripts
+
+scenario_s4.sh, various controls, controls_(delegated) and 
+  delegate_controls_ relations between slices and users are setup 
+  to show access permission to slices.
+  s4_query.py and s4_run_query are the query scripts.
+
+scenario_s5.sh, various controlsQ, controlsQ_(delegated) and
+  delegate_controlsQ_ relations between slices and users are setup
+  similar to scenario_s4 but with qualifed role.
+  s5_query.py and s5_run_query are the query scripts
+
+scenario_s6.sh, setup relations to test createSlice and speaksFor
+  s6_query.py and s5_run_query are the query scripts
+
+  Note:   delegate_member_ 
+          delegate_memberQ_
+          delegate_controls_
+          delegate_controlsQ_
+  are needed to avoid the recursing in the original policy rule
+  PA.member_(?P:PA.standard) <- (PA.member_(?P)).member_
+
+run_test, is the main test control script
+
+
+resulting files after ./run_test call,
+    yap_clauses, is the prolog clauses that libabac generated for policy.sh
+    main_yap_clauses, is the prolog clauses in more user friendly form
+    s#_yap_clauses, contains the prolog clauses libabac generated for each
+          of scenario setup
+    my_s#_yap_clauses, is the more user friendly form of s#_yap_clauses
+    s#_result.cn, is the more user friendly proof result
+    s#_result.sha, is the proof result with sha values
+    s#_result.save, is the baseline result used for regression test comparison
+
+
+
Index: examples/access_tests/creddy_prover/cleanup.sh
===================================================================
--- examples/access_tests/creddy_prover/cleanup.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/cleanup.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+# cleanup.sh
+# complete cleanup,  ./cleanup.sh all
+# partial,           ./cleanup.sh
+
+sidx=$1
+
+#complete
+if [ "$sidx" = "all" ]; then
+   rm -rf *.pem
+   rm -rf *.der
+   rm -rf *yap_clauses
+   rm -rf *test.log
+   rm -rf sfile*
+   rm -rf *.cn
+   rm -rf *creds_dump
+#partial
+else
+   rm -rf *.pem
+   rm -rf *.der
+   rm -rf my_*_yap_clauses
+   rm -rf *_creds_dump
+   rm -rf *_result.sha
+   rm -rf sfile*
+fi
+
+
Index: examples/access_tests/creddy_prover/policy.sh
===================================================================
--- examples/access_tests/creddy_prover/policy.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/policy.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,340 @@
+#!/bin/sh 
+
+#####################################################################
+# This policy.sh contains the RT2 policy rules Ted Faber 
+# translated from Jeff Chase's GENI authorization writeup for prolog
+# 
+#
+keyloc=`pwd`
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho G
+makeWho PA
+makeWho SA
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+#####################################################################
+sfile=sfile
+echo "s/$g/G/g "  > $sfile 
+echo "s/$pa/PA/g "  >> $sfile
+echo "s/$sa/SA/g "  >> $sfile
+
+#####################################################################
+pname=yap_clauses
+namespace=access1
+
+#####################################################################
+## G.identityProvider <- (G.geniRoot).identityProvider
+attr="[keyid:$g].role:identityProvider <- [keyid:$g].role:geniRoot.role:identityProvider"
+name=G_idenProver__gRoot_idenProvider_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.sliceAuthority <- (G.geniRoot).sliceAuthority
+attr="[keyid:$g].role:sliceAuthority <- [keyid:$g].role:geniRoot.role:sliceAuthority"
+name=G_sliceAuthority__gRoot_sliceAuthority_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.projectAuthority <- (G.geniRoot).projectAuthority
+attr="[keyid:$g].role:projectAuthority <- [keyid:$g].role:geniRoot.role:projectAuthority"
+name=G_projAuthority__gRoot_projAuthority_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.geniProxy <- (G.geniRoot).geniProxy
+attr="[keyid:$g].role:geniProxy <- [keyid:$g].role:geniRoot.role:geniProxy"
+name=G_geniProxy__gRoot_geniProxy_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.aggregate <- (G.geniRoot).aggregate
+attr="[keyid:$g].role:aggregate <- [keyid:$g].role:geniRoot.role:aggregate"
+name=G_aggr__gRoot_aggr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.gmoc <- (G.geniRoot).gmoc
+attr="[keyid:$g].role:gmoc <- [keyid:$g].role:geniRoot.role:gmoc"
+name=G_gmoc__gRoot_gmoc_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.geniUser <- (G.identityProvider).geniUser
+attr="[keyid:$g].role:geniUser <- [keyid:$g].role:identityProvider.role:geniUser"
+name=G_geniUser__idenProvider_geniUser_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.geniPI <- (G.identityProvider).geniPI
+attr="[keyid:$g].role:geniPI <- [keyid:$g].role:identityProvider.role:geniPI"
+name=G_geniPI__idenProvider_geniPI_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.root(?P) <- (G.projectAuthority).root(?P)
+attr="[keyid:$g].role:root([string:?P]) <- [keyid:$g].role:projectAuthority.role:root([string:?P])"
+name=G_root_qP__projAuthority_root_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.root(?S) <- (G.sliceAuthority).root(?S)
+attr="[keyid:$g].role:root([string:?S]) <- [keyid:$g].role:sliceAuthority.role:root([string:?S])"
+name=G_root_qP__sliceAuthority_root_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## G.qualifiedProject <- (G.root(?this)).project
+attr="[keyid:$g].oset:qualifiedProject <- [keyid:$g].role:root([?this]).oset:project"
+name=G_qualProject__root_qTHIS_proj_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member(?P:PA.standard) <- PA.member_(?P)
+attr="[keyid:$pa].role:member([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:member_([string:?P])"
+name=PA_member_qP_std__PA_memberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member(?P:PA.standard) <- PA.delegate_member_(?P)
+attr="[keyid:$pa].role:member([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:delegate_member_([string:?P])"
+name=PA_member_qP_std__PA_delmemberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member(?P:PA.standard) <- PA.owner(?P)
+attr="[keyid:$pa].role:member([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:owner([string:?P])"
+name=PA_member_qP_std__PA_owner_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member_(?P:PA.standard) <- PA.owner(?P)
+attr="[keyid:$pa].role:member_([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:owner([string:?P])"
+name=PA_memberDel_qP_std__PA_owner_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member(?P:PA.standard) <- (PA.owner(?P)).member(?P)
+attr="[keyid:$pa].role:member([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:owner([string:?P]).role:member([string:?P])"
+name=PA_member_qP_std__PA_owner_qP_member_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member(?P:PA.standard) <- (PA.member_(?P)).member(?P)
+attr="[keyid:$pa].role:member([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:member_([string:?P]).role:member([string:?P])"
+name=PA_member_qP_std__PA_memberDel_qP_member_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.delegate_member_(?P:PA.standard) <- (PA.owner(?P)).delegate_member_(?P)
+attr="[keyid:$pa].role:delegate_member_([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:owner([string:?P]).role:delegate_member_([string:?P])"
+name=PA_delmemberDel_qP_std__PA_owner_qP_delmemberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member_(?P:PA.standard) <- (PA.delegate_member_(?P)).member_(?P)
+attr="[keyid:$pa].role:member_([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:delegate_member_([string:?P]).role:member_([string:?P])"
+name=PA_memberDel_qP_std__PA_delmemberDel_qP_memberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.member_(?P:PA.standard) <- (PA.owner(?P)).member_(?P)
+attr="[keyid:$pa].role:member_([string:?P[keyid:$pa].oset:standard])<-[keyid:$pa].role:owner([string:?P]).role:member_([string:?P])"
+name=PA_memberDel_qP_std__PA_owner_qP_memberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ(?P:PA.standard, ?Priv:PA.std_ops) <- PA.member(?P)
+attr="[keyid:$pa].role:memberQ([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:member([string:?P])"
+name=PA_memberQ_qP_std_qPRIV_stdops__member_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ(?P:PA.standard, ?Priv:PA.std_ops) <- PA.memberQ_(?P, ?Priv)
+attr="[keyid:$pa].role:memberQ([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:memberQ_([string:?P],[string:?Priv])"
+name=PA_memberQ_qP_std_qPRIV_stdops__memberQDel_qP_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ(?P:PA.standard, ?Priv:PA.std_ops) <- PA.delegate_memberQ_(?P, ?Priv)
+attr="[keyid:$pa].role:memberQ([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:delegate_memberQ_([string:?P],[string:?Priv])"
+name=PA_memberQ_qP_std_qPRIV_stdops__delmemberQDel_qP_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ(?P:PA.standard, ?Priv:PA.std_ops) <- (PA.memberQ_(?P, ?Priv)).memberQ(?P, ?Priv)
+attr="[keyid:$pa].role:memberQ([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:memberQ_([string:?P],[string:?Priv]).role:memberQ([string:?P],[string:?Priv])"
+name=PA_memberQ_qP_std_qPRIV_stdops__memberQDel_qP_qPRIV_stdops_memberQ_qP_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ(?P:PA.standard, ?Priv:PA.std_ops) <- (PA.owner(?P)).memberQ(?P, ?Priv)
+attr="[keyid:$pa].role:memberQ([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:owner([string:?P]).role:memberQ([string:?P],[string:?Priv])"
+name=PA_memberQ_qP_std_qPRIV_stdops__owner_qP_memberQ_qP_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.delegate_memberQ_(?P:PA.standard, ?Priv:PA.std_ops) <- (PA.owner(?P)).delegate_memberQ(?P, ?Priv)
+attr="[keyid:$pa].role:delegate_memberQ_([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:owner([string:?P]).role:delegate_memberQ_([string:?P],[string:?Priv])"
+name=PA_delmemberQDel_qP_std_qPRIV_stdops__owner_qP_delmemberQDel_qP_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ_(?P:PA.standard, ?Priv:PA.std_ops) <- (PA.delegate_memberQ_(?P,?Priv)).memberQ_(?P,?Priv)
+attr="[keyid:$pa].role:memberQ_([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops])<-[keyid:$pa].role:delegate_memberQ_([string:?P],[string:?Priv]).role:memberQ_([string:?P],[string:?Priv])"
+name=PA_memberQDel_qP_std_qPRIV_stdops__PA_delmemberQDel_qP_qPRIV_memberQDel_qP_qPRIV_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ_(?P:PA.standard, ?Priv:PA.std_ops) <- (PA.owner(?P)).memberQ_(?P, ?Priv)
+attr="[keyid:$pa].role:memberQ_([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:owner([string:?P]).role:memberQ_([string:?P],[string:?Priv])"
+name=PA_memberQDel_qP_std_qPRIV_stdops__owner_qP_memberQDel_qP_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ_(?P:PA.standard, ?Priv:PA.std_ops) <- PA.member_(?P)
+attr="[keyid:$pa].role:memberQ_([string:?P[keyid:$pa].oset:standard], [string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:member_([string:?P])"
+name=PA_memberQDel_qP_std_qPRIV_stdops__memberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.std_ops <- "info"
+attr="[keyid:$pa].oset:std_ops <- [string:'info']"
+name=PA_stdops__info_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.std_ops <- "instantiate"
+attr="[keyid:$pa].oset:std_ops <- [string:'instantiate']"
+name=PA_stdops__instantiate_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.std_ops <- "stop"
+attr="[keyid:$pa].oset:std_ops <- [string:'stop']"
+name=PA_stdops__stop_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.memberQ_(?P:PA.standard, ?Priv:PA.std_ops) <- PA.member_(?P)
+attr="[keyid:$pa].role:memberQ_([string:?P[keyid:$pa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$pa].role:member_([string:?P])"
+name=PA_memberQDel_qP_std_qPRIV_stdops__memberDel_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls_(?S:SA.standard) <- (SA.delegate_controls_(?S)).controls_(?S)
+attr="[keyid:$sa].role:controls_([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:delegate_controls_([string:?S]).role:controls_([string:?S])"
+name=SA_ctrlsDel_std__delctrlsDel_qS_ctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.delegate_controls_(?S:SA.standard) <- (SA.owner(?S)).delegate_controls_(?S)
+attr="[keyid:$sa].role:delegate_controls_([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:owner([string:?S]).role:delegate_controls_([string:?S])"
+name=SA_delctrlsDel_std__owner_qS_delctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls_(?S:SA.standard) <- (SA.owner(?S)).controls_(?S)
+attr="[keyid:$sa].role:controls_([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:owner([string:?S]).role:controls_([string:?S])"
+name=SA_ctrlsDel_std__owner_qS_ctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls(?S:SA.standard) <- SA.owner(?S)
+attr="[keyid:$sa].role:controls([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:owner([string:?S])"
+name=SA_ctrls_std__owner_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls_(?S:SA.standard) <- SA.owner(?S)
+attr="[keyid:$sa].role:controls_([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:owner([string:?S])"
+name=SA_ctrlsDel_std__owner_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls(?S:SA.standard) <- (SA.owner(?S)).controls(?S)
+attr="[keyid:$sa].role:controls([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:owner([string:?S]).role:controls([string:?S])"
+name=SA_ctrls_std__owner_qS_ctrls_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls(?S:SA.standard) <- (SA.controls_(?S)).controls(?S)
+attr="[keyid:$sa].role:controls([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:controls_([string:?S]).role:controls([string:?S])"
+name=SA_ctrls_std__ctrlsDel_qS_ctrls_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls(?S:SA.standard) <- SA.controls_(?S)
+attr="[keyid:$sa].role:controls([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:controls_([string:?S])"
+name=SA_ctrls_qS_std__ctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controls(?S:SA.standard) <- SA.delegate_controls_(?S)
+attr="[keyid:$sa].role:controls([string:?S[keyid:$sa].oset:standard]) <- [keyid:$sa].role:delegate_controls_([string:?S])"
+name=SA_ctrls_qS_std__delctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ_(?S:SA.standard, ?Priv:PA.std_ops) <- (SA.delegate_controlsQ_(?S, ?Priv)).controlsQ_(?S, ?Priv)
+attr="[keyid:$sa].role:controlsQ_([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:delegate_controlsQ_([string:?S],[string:?Priv]).role:controlsQ_([string:?S],[string:?Priv])"
+name=SA_ctrlsQDel_qS_std_qPRIV_stdops__delctrlsQDel_qS_qPRIV_stdops_ctrlsQDel_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.delegate_controlsQ_(?S:SA.standard, ?Priv:PA.std_ops) <- (SA.owner(?S)).delegate_controlsQ_(?S, ?Priv)
+attr="[keyid:$sa].role:delegate_controlsQ_([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:owner([string:?S]).role:delegate_controlsQ_([string:?S],[string:?Priv])"
+name=SA_delctrlsQDel_qS_std_qPRIV_stdops__owner_qS_delctrlsQDel_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ_(?S:SA.standard, ?Priv:PA.std_ops) <- (SA.owner(?S)).controlsQ_(?S, ?Priv)
+attr="[keyid:$sa].role:controlsQ_([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:owner([string:?S]).role:controlsQ_([string:?S],[string:?Priv])"
+name=SA_ctrlsQDel_qS_std_qPRIV_stdops__owner_qS_ctrlsQDel_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ_(?S:SA.standard, ?Priv:PA.std_ops) <- SA.delegate_controls_(?S)
+attr="[keyid:$sa].role:controlsQ_([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:delegate_controls_([string:?S])"
+name=SA_ctrlsQDel_qS_std_qPRIV_stdops__delctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ_(?S:SA.standard, ?Priv:PA.std_ops) <- SA.controls_(?S)
+attr="[keyid:$sa].role:controlsQ_([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:controls_([string:?S])"
+name=SA_ctrlsQDel_qS_std_qPRIV_stdops__ctrlsDel_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ_(?S:SA.standard, ?Priv:PA.std_ops) <- (SA.delegate_controlsQ_(?S, ?Priv))
+attr="[keyid:$sa].role:controlsQ_([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:delegate_controlsQ_([string:?S],[string:?Priv])"
+name=SA_ctrlsQDel_qS_std_qPRIV_stdops__ctrlsQDel_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.standard, ?Priv:PA.std_ops) <- (SA.controlsQ_(?S, ?Priv)).controlsQ(?S, ?Priv)
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:controlsQ_([string:?S],[string:?Priv]).role:controlsQ([string:?S],[string:?Priv])"
+name=SA_ctrlsQDel_qS_std_qPRIV_stdops__ctrlsQDel_qS_qPRIV_stdops_ctrlsQ_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.standard, ?Priv:PA.std_ops) <- (SA.owner(?S)).controlsQ(?S, ?Priv)
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:owner([string:?S]).role:controlsQ([string:?S],[string:?Priv])"
+name=SA_ctrlsQ_qS_std_qPRIV_stdops__owners_qS_ctrlsQ_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.standard, ?Priv:PA.std_ops) <- SA.controlsQ_(?S, ?Priv)
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:controlsQ_([string:?S],[string:?Priv])"
+name=SA_ctrlsQ_qS_std_qPRIV_stdops__ctrlsQDel_qS_qPRIV_stdops_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.standard, ?Priv:PA.std_ops) <- SA.controls(?S)
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:standard],[string:?Priv[keyid:$pa].oset:std_ops]) <- [keyid:$sa].role:controls([string:?S])"
+name=SA_ctrlsQ_qS_std_qPRIV_stdops__ctrls_qS_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA.createRoot <- PA.GeniPI
+attr="[keyid:$pa].role:createRoot <- [keyid:$pa].role:geniPI"
+name=PA_createRoot__geniPI_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.createSlice(?P:SA.qualifiedProject) <- SA.geniUser & (SA.projectAuthority).memberQ(?P, "instantiate")
+attr="[keyid:$sa].role:createSlice([string:?P[keyid:$sa].oset:qualifiedProject]) <- [keyid:$sa].role:geniUser & [keyid:$sa].role:projectAuthority.role:memberQ([string:?P],[string:'instantiate'])"
+name=SA_createSlice_qP_qualProject__geniUser_projAthority_memberQ_instantiate_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.inStdProject(?P), "info") <- (SA.projectAuthority).memberQ(?P, "info")
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:inStdProject([string:?P])],[string:'info']) <- [keyid:$sa].role:projectAuthority.role:memberQ([string:?P],[string:'info'])" 
+name=SA_ctrlsQ_qS_inStdProj_qP_info__projAuthority_memberQ_qP_info_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.inStdProject(?P), "stop") <- (SA.projectAuthority).owner(?P)
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:inStdProject([string:?P])], [string:'stop']) <- [keyid:$sa].role:projectAuthority.role:owner([string:?P])"
+name=SA_ctrlsQ_qS_inStdProject_qP_stop__projAuthority_owner_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.inStdProject(?P), "info") <- (SA.projectAuthority).owner(?P)
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:inStdProject([string:?P])], [string:'info']) <- [keyid:$sa].role:projectAuthority.role:owner([string:?P])"
+name=SA_ctrlsQ_qS_inStdProject_qP_info__projAuthority_owner_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.standard, "stop") <- SA.gmoc
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:standard], [string:'stop']) <- [keyid:$sa].role:gmoc"
+name=SA_ctrlsQ_qS_std_stop__gmoc_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.controlsQ(?S:SA.standard, "info") <- SA.gmoc
+attr="[keyid:$sa].role:controlsQ([string:?S[keyid:$sa].oset:standard], [string:'info']) <- [keyid:$sa].role:gmoc"
+name=SA_ctrlsQ_qS_std_info__gmoc_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.inStdProject(?P:PA.standard) <- SA.inProjet(?P) & SA.standard
+attr="[keyid:$sa].oset:inStdProject([string:?P[keyid:$pa].oset:standard]) <- [keyid:$sa].oset:inProject([string:?P]) & [keyid:$sa].oset:standard"
+name=SA_inStdProject_qP_std__inProject_qP_std_qP_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA.createSlice(?P:SA.qualifiedProject) <- SA.geniProxy &
+##         SA.speaksFor(?C:(SA.projectAuthority).memberQ(?P, "instantiate"))
+attr="[keyid:$sa].role:createSlice([string:?P[keyid:$sa].oset:qualifiedProject]) <- [keyid:$sa].role:geniProxy & [keyid:$sa].role:speaksFor([principal:?C[keyid:$sa].role:projectAuthority.role:memberQ([string:?P],[string:'instantiate'])])"
+name=SA_createSlice_qP_qualProject__geniProxy_speaksFor_qC_projAuthority_memberQ_qP_instantiate_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
Index: examples/access_tests/creddy_prover/run_test
===================================================================
--- examples/access_tests/creddy_prover/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+#########
+# run_test
+#
+
+unset keystore
+unset ABAC_CN
+
+./cleanup.sh all
+./setup.sh 1>/dev/null 2>&1
+./policy.sh 1>/dev/null 2>&1
+
+sed -f sfile yap_clauses > main_yap_clauses
+
+# run_it s1
+a_run()
+{
+    echo "---running scenario $1 "
+    ./cleanup.sh
+    ./policy.sh 1> /dev/null 2>&1
+    ./scenario_$1.sh 1> /dev/null 2>&1
+    sed -f sfile_$1 $1_yap_clauses > my_$1_yap_clauses
+
+    ./$1_run_query > $1_result.sha
+    ./$1_query.py >> $1_result.sha
+
+    env ABAC_CN=1 ./$1_query.py > $1_result.cn
+    env ABAC_CN=1 ./$1_run_query >> $1_result.cn
+
+    rm -rf sfile*
+
+    result=`diff -I "Restoring file" -I "YAP 6.3" $1_result.cn $1_result.save`
+    if [ $? -eq 0 ]; then
+        if [ "$result" = "" ]; then
+           echo "   PASSED"
+        else
+           echo "   ERROR: geni creddy_prover $1 test result differs!!!"
+        fi
+    else
+        echo "   ERROR: geni creddy_prover $1 test result differs!!!"
+    fi
+}
+
+a_run s1
+a_run s2
+a_run s3
+a_run s4
+a_run s5
+a_run s6
+
Index: examples/access_tests/creddy_prover/s1_query.py
===================================================================
--- examples/access_tests/creddy_prover/s1_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s1_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+"""
+  s1_query.py
+using python api
+
+"""
+
+print("=====================s1_query.py==================")
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set, using current directory...")
+    ctxt.load_directory(".")
+
+##########################################################################
+def get_next(CTXT) :
+    while( 1 ) :
+        print ("\nnext proof:")
+        (success, out) = CTXT.next_proof()
+        if(success) :
+            for c in out:
+                print "%s <- %s" % (c.head_string(), c.tail_string())
+        else:
+            print("no more..\n")
+            return
+
+# dump the loaded principals/policies
+def dump_all(CTXT,msg) :
+    out = CTXT.context_principals()
+    print "\n...%s principal set..." % msg
+    for x in out[1]:
+        print "#PP# %s " % x.string()
+    out = CTXT.context_credentials()
+    print "\n...%s policy attribute set..." %msg
+    for c in out[1]:
+        print "#CC# %s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# retrieve principals' keyid value from local credential files
+gID=ABAC.ID("G_ID.pem");
+g=gID.id_keyid()
+
+paID=ABAC.ID("PA_ID.pem");
+pa=paID.id_keyid()
+
+drdID=ABAC.ID("Drd_ID.pem");
+drd=drdID.id_keyid()
+
+##########################################################################
+#dump_all(ctxt,"initial")
+#ctxt.set_no_partial_proof()
+
+##########################################################################
+# [keyid:G].oset:qualifiedProject <-?- [string:'proj1'] (yes)
+# oset=[keyid:G].oset:qualifiedProject
+# p =[string:'proj1']
+oset = ABAC.Oset(g,"qualifiedProject")
+term=ABAC.DataTerm("string", "'proj1'")
+p = ABAC.Oset(term)
+
+print "\n===good============ G.qualifiedProject <-?- proj1"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:PA].oset:std_ops <-?- [string:'info'] 
+oset = ABAC.Oset(pa,"std_ops")
+term=ABAC.DataTerm("string", "'info'")
+p = ABAC.Oset(term)
+
+print "\n===good============ PA.std_ops <-?- info"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+#get_next(ctxt)
+
+print("\n\n")
Index: examples/access_tests/creddy_prover/s1_result.save
===================================================================
--- examples/access_tests/creddy_prover/s1_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s1_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,49 @@
+=====================s1_query.py==================
+keystore is not set, using current directory...
+
+===good============ G.qualifiedProject <-?- proj1
+YAP query succeed
+pG.qualifiedProject <- pG.root(This).project
+pG.root(P) <- pG.projectAuthority.root(P)
+pG.projectAuthority <- pG.geniRoot.projectAuthority
+pG.geniRoot <- pGR
+pGR.projectAuthority <- pPA
+pPA.root('proj1') <- pDrd
+pDrd.project <- 'proj1'
+
+===good============ PA.std_ops <-?- info
+YAP query succeed
+pPA.std_ops <- 'info'
+
+
+
+=====================s1_run_query==================
+ 
+===good============ PA.std_ops<-?-info
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.std_ops  <- 'info' 
+ 
+===good============ G.qualifiedProject<-?-proj1
+YAP query succeed
+prover success!!
+credentials needed :
+ pG.qualifiedProject  <- pG.root(This).project 
+ pG.root(P)  <- pG.projectAuthority.root(P) 
+ pG.projectAuthority  <- pG.geniRoot.projectAuthority 
+ pG.geniRoot  <- pGR 
+ pGR.projectAuthority  <- pPA 
+ pPA.root('proj1')  <- pDrd 
+ pDrd.project  <- 'proj1' 
+ 
+===bad============ G.qualifiedProject<-?-projX
+YAP query failed
+prover failed!!
+ 
+===bad============ SA.inStdProject<-?-proj1
+YAP query failed
+prover failed!!
+
+
+
Index: examples/access_tests/creddy_prover/s1_run_query
===================================================================
--- examples/access_tests/creddy_prover/s1_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s1_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,54 @@
+#!/bin/sh 
+
+# geni s1_run_query
+# using aba_prover_yap
+
+echo "=====================s1_run_query=================="
+
+pwd=`pwd`
+
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+
+keyloc=$pwd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+## dump all credentials 
+env ABAC_CN=1 $eloc/abac_prover_yap  --keystore $keyloc --dump s1_creds_dump
+
+## PA.std_ops <- "info"
+#[keyid:PA].oset:std_ops <-?- [string:'info'] (yes)
+role="[keyid:$pa].oset:std_ops"
+prin="[string:'info']"
+echo " "
+echo "===good============ PA.std_ops<-?-info"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$role" --principal "$prin"
+
+#[keyid:G].oset:qualifiedProject <-?- [string:'proj1'] (yes)
+role="[keyid:$g].oset:qualifiedProject"
+prin="[string:'proj1']"
+echo " "
+echo "===good============ G.qualifiedProject<-?-proj1"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$role" --principal "$prin"
+
+#[keyid:G].oset:qualifiedProject <-?- [string:'projX'] (no)
+role="[keyid:$g].oset:qualifiedProject"
+prin="[string:'projX']"
+echo " "
+echo "===bad============ G.qualifiedProject<-?-projX"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$role" --principal "$prin"
+
+#[keyid:SA].oset:inStdProject <-?- [string:'proj1']
+role="[keyid:$sa].oset:inStdProject"
+prin="[string:'proj1']"
+echo " "
+echo "===bad============ SA.inStdProject<-?-proj1"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$role" --principal "$prin"
+
+echo "\n\n"
Index: examples/access_tests/creddy_prover/s2_query.py
===================================================================
--- examples/access_tests/creddy_prover/s2_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s2_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,194 @@
+#!/usr/bin/env python
+
+"""
+  s2_query.py
+using python api
+
+"""
+
+print("=====================s2_query.py==================")
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set, using current directory...")
+    ctxt.load_directory(".")
+
+##########################################################################
+def get_next(CTXT) :
+    while( 1 ) :
+        print ("\nnext proof:")
+        (success, out) = CTXT.next_proof()
+        if(success) :
+            for c in out:
+                print "%s <- %s" % (c.head_string(), c.tail_string())
+        else:
+            print("no more..\n")
+            return
+
+# dump the loaded principals/policies
+def dump_all(CTXT,msg) :
+    out = CTXT.context_principals()
+    print "\n...%s principal set..." % msg
+    for x in out[1]:
+        print "#PP# %s " % x.string()
+    out = CTXT.context_credentials()
+    print "\n...%s policy attribute set..." %msg
+    for c in out[1]:
+        print "#CC# %s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# retrieve principals' keyid value from local credential files
+paID=ABAC.ID("PA_ID.pem");
+pa=paID.id_keyid()
+
+jimID=ABAC.ID("Jim_ID.pem");
+jim=jimID.id_keyid()
+
+nancyID=ABAC.ID("Nancy_ID.pem");
+nancy=nancyID.id_keyid()
+
+caryID=ABAC.ID("Cary_ID.pem");
+cary=caryID.id_keyid()
+
+drdID=ABAC.ID("Drd_ID.pem");
+drd=drdID.id_keyid()
+
+frankID=ABAC.ID("Frank_ID.pem");
+frank=frankID.id_keyid()
+
+##########################################################################
+#dump_all(ctxt,"initial")
+#ctxt.set_no_partial_proof()
+
+##########################################################################
+# role=[keyid:PA].role:delegate_member_([string:'proj1'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(pa,"delegate_member_")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(cary)
+
+print "\n===good============ PA.delegate_member_('proj1') <-?- Cary"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:PA].role:member_([string:'proj1'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(pa,"member_")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(cary)
+
+print "\n===bad============ PA.member_('proj1') <-?- Cary"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:PA].role:member([string:'proj1'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(pa,"member")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(cary)
+
+print "\n===good============ PA.member('proj1') <-?- Cary"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:PA].role:member([string:'proj1'])
+# p =[keyid:Drd]
+#
+role=ABAC.Role(pa,"member")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(drd)
+
+print "\n===good============ PA.member('proj1') <-?- Drd"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# role=[keyid:PA].role:member([string:'proj1'])
+# p =[keyid:Frank]
+#
+role=ABAC.Role(pa,"member")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(frank)
+
+print "\n===good============ PA.member('proj1') <-?- Frank"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# role=[keyid:PA].role:delegate_member_([string:'proj1'])
+# p =[keyid:Jim]
+#
+role=ABAC.Role(pa,"delegate_member_")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(jim)
+
+print "\n===good============ PA.delegate_member_('proj1') <-?- Jim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:PA].role:member_([string:'proj1'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(pa,"member_")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(jim)
+
+print "\n===bad============ PA.member_('proj1') <-?- Jim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+
+##########################################################################
+# role=[keyid:PA].role:delegate_member_([string:'proj1'])
+# p =[keyid:Nancy]
+#
+role = ABAC.Role(pa,"delegate_member_")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(nancy)
+
+print "\n===bad============ PA.delegate_member_('proj1') <-?- Nancy"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+print("\n\n")
+
Index: examples/access_tests/creddy_prover/s2_result.save
===================================================================
--- examples/access_tests/creddy_prover/s2_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s2_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,222 @@
+=====================s2_query.py==================
+keystore is not set, using current directory...
+
+===good============ PA.delegate_member_('proj1') <-?- Cary
+YAP query succeed
+pPA.delegate_member_('proj1') <- pCary
+
+===bad============ PA.member_('proj1') <-?- Cary
+YAP query failed
+A partial proof(type:what)
+pPA.member(P:pPA.standard) <- pPA.delegate_member_(P)
+pPA.standard <- 'proj1'
+pPA.delegate_member_('proj1') <- pCary
+
+===good============ PA.member('proj1') <-?- Cary
+YAP query succeed
+pPA.member(P:pPA.standard) <- pPA.delegate_member_(P)
+pPA.standard <- 'proj1'
+pPA.delegate_member_('proj1') <- pCary
+
+===good============ PA.member('proj1') <-?- Drd
+YAP query succeed
+pPA.member(P:pPA.standard) <- pPA.member_(P)
+pPA.standard <- 'proj1'
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+
+next proof:
+pPA.member(P:pPA.standard) <- pPA.owner(P)
+pPA.standard <- 'proj1'
+pPA.owner('proj1') <- pDrd
+
+next proof:
+no more..
+
+
+===good============ PA.member('proj1') <-?- Frank
+YAP query succeed
+pPA.member(P:pPA.standard) <- pPA.member_(P).member(P)
+pPA.standard <- 'proj1'
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+pDrd.member('proj1') <- pFrank
+
+next proof:
+pPA.member(P:pPA.standard) <- pPA.owner(P).member(P)
+pPA.standard <- 'proj1'
+pPA.owner('proj1') <- pDrd
+pDrd.member('proj1') <- pFrank
+
+next proof:
+no more..
+
+
+===good============ PA.delegate_member_('proj1') <-?- Jim
+YAP query succeed
+pPA.delegate_member_(P:pPA.standard) <- pPA.owner(P).delegate_member_(P)
+pPA.standard <- 'proj1'
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_member_('proj1') <- pJim
+
+===bad============ PA.member_('proj1') <-?- Jim
+YAP query failed
+A partial proof(type:what)
+pPA.delegate_member_(P:pPA.standard) <- pPA.owner(P).delegate_member_(P)
+pPA.standard <- 'proj1'
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_member_('proj1') <- pJim
+
+===bad============ PA.delegate_member_('proj1') <-?- Nancy
+YAP query failed
+A partial proof(type:what)
+pPA.member_(P:pPA.standard) <- pPA.delegate_member_(P).member_(P)
+pPA.standard <- 'proj1'
+pPA.delegate_member_(P:pPA.standard) <- pPA.owner(P).delegate_member_(P)
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_member_('proj1') <- pJim
+pJim.member_('proj1') <- pNancy
+
+
+
+=====================s2_run_query==================
+ 
+===bad============ PA.member_(proj1)<-?-Frank
+YAP query failed
+prover failed!!
+ 
+===good============ PA.member(proj1)<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.member_(P).member(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.member('proj1')  <- pFrank 
+ 
+===good============ PA.member_(proj1)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P).member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.member_('proj1')  <- pDan 
+ 
+===good============ PA.member(proj1)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P).member_(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.member_('proj1')  <- pDan 
+ 
+===good============ PA.member_(proj2)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member_('proj2')  <- pDan 
+ 
+===good============ PA.member(proj2)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.member_(P) 
+ pPA.standard  <- 'proj2' 
+ pPA.member_('proj2')  <- pDan 
+ 
+===bad============ PA.member_(proj1)<-?-Jim
+YAP query failed
+prover failed!!
+ 
+===good============ PA.member(proj1)<-?-Jim
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.delegate_member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.delegate_member_(P:pPA.standard)  <- pPA.owner(P).delegate_member_(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.delegate_member_('proj1')  <- pJim 
+ 
+===good============ PA.member_(proj1)<-?-Nancy
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member_(P:pPA.standard)  <- pPA.delegate_member_(P).member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.delegate_member_(P:pPA.standard)  <- pPA.owner(P).delegate_member_(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.delegate_member_('proj1')  <- pJim 
+ pJim.member_('proj1')  <- pNancy 
+ 
+===good============ PA.member(proj1)<-?-Nancy
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.member_(P:pPA.standard)  <- pPA.delegate_member_(P).member_(P) 
+ pPA.delegate_member_(P:pPA.standard)  <- pPA.owner(P).delegate_member_(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.delegate_member_('proj1')  <- pJim 
+ pJim.member_('proj1')  <- pNancy 
+ 
+===bad============ PA.member_(proj1)<-?-Lisa
+YAP query failed
+prover failed!!
+ 
+===good============ PA.member(proj1)<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member('proj1')  <- pLisa 
+ 
+===bad============ PA.member_(proj1)<-?-Cary
+YAP query failed
+prover failed!!
+ 
+===good============ PA.member(proj1)<-?-Cary
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.delegate_member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.delegate_member_('proj1')  <- pCary 
+ 
+===good============ PA.member_(proj1)<-?-Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member_('proj1')  <- pAlice 
+ 
+===good============ PA.member(proj1)<-?-Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.member_('proj1')  <- pAlice 
+ 
+===good============ PA.member_(proj1)<-?-Drd
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.owner('proj1')  <- pDrd 
+ 
+===good============ PA.member(proj1)<-?-Drd
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.member(P:pPA.standard)  <- pPA.member_(P) 
+ pPA.standard  <- 'proj1' 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.owner('proj1')  <- pDrd 
+
+
+
Index: examples/access_tests/creddy_prover/s2_run_query
===================================================================
--- examples/access_tests/creddy_prover/s2_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s2_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,67 @@
+#!/bin/sh 
+
+# geni s2_run_query
+# using aba_prover_yap
+
+echo "=====================s2_run_query=================="
+
+pwd=`pwd`
+
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+
+keyloc=$pwd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+jim=`creddy --keyid --cert $keyloc/Jim_ID.pem`
+nancy=`creddy --keyid --cert $keyloc/Nancy_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+cary=`creddy --keyid --cert $keyloc/Cary_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+
+## dump all credentials 
+env ABAC_CN=1 $eloc/abac_prover_yap  --keystore $keyloc --dump s2_creds_dump
+
+#  runMember Cary $cary good bad
+runMember() {
+   id=$2 
+   proj="'$3'"
+   role="[keyid:$pa].role:member_([string:$proj])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$4============ PA.member_($3)<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+   role="[keyid:$pa].role:member([string:$proj])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$5============ PA.member("$3")<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+}
+
+
+## PA.member_("proj1") <- Cary
+#[keyid:PA].role:member_([string:'proj1']) <-?- [keyid:Cary] 
+## PA.member("proj1") <- Cary
+#[keyid:PA].role:member([string:'proj1']) <-?- [keyid:Cary] 
+
+runMember Frank $frank proj1 bad good
+runMember Dan $dan proj1 good good
+runMember Dan $dan proj2 good good
+runMember Jim $jim proj1 bad good
+runMember Nancy $nancy proj1 good good
+runMember Lisa $lisa proj1 bad good
+runMember Cary $cary proj1 bad good
+runMember Alice $alice proj1 good good
+runMember Drd $drd proj1 good good
+
+echo "\n\n"
Index: examples/access_tests/creddy_prover/s3_query.py
===================================================================
--- examples/access_tests/creddy_prover/s3_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s3_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,181 @@
+#!/usr/bin/env python
+
+"""
+  s3_query.py
+using python api
+
+"""
+
+print("=====================s3_query.py==================")
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set, using current directory...")
+    ctxt.load_directory(".")
+
+##########################################################################
+def get_next(CTXT) :
+    while( 1 ) :
+        print ("\nnext proof:")
+        (success, out) = CTXT.next_proof()
+        if(success) :
+            for c in out:
+                print "%s <- %s" % (c.head_string(), c.tail_string())
+        else:
+            print("no more..\n")
+            return
+
+# dump the loaded principals/policies
+def dump_all(CTXT,msg) :
+    out = CTXT.context_principals()
+    print "\n...%s principal set..." % msg
+    for x in out[1]:
+        print "#PP# %s " % x.string()
+    out = CTXT.context_credentials()
+    print "\n...%s policy attribute set..." %msg
+    for c in out[1]:
+        print "#CC# %s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# retrieve principals' keyid value from local credential files
+gID=ABAC.ID("G_ID.pem");
+g=gID.id_keyid()
+
+paID=ABAC.ID("PA_ID.pem");
+pa=paID.id_keyid()
+
+drdID=ABAC.ID("Drd_ID.pem");
+drd=drdID.id_keyid()
+
+johnID=ABAC.ID("John_ID.pem");
+john=johnID.id_keyid()
+
+timID=ABAC.ID("Tim_ID.pem");
+tim=timID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joe=joeID.id_keyid()
+
+lisaID=ABAC.ID("Lisa_ID.pem");
+lisa=lisaID.id_keyid()
+
+jamesID=ABAC.ID("James_ID.pem");
+james=jamesID.id_keyid()
+##########################################################################
+##########################################################################
+#dump_all(ctxt,"initial")
+#ctxt.set_no_partial_proof()
+
+##########################################################################
+# [keyid:PA].role:memberQ_([string:'proj2'],[string:'info']) <-?- [keyid:James] 
+role = ABAC.Role(pa,"memberQ_")
+param1=ABAC.DataTerm("string", "'proj2'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(james)
+
+print "\n===good============ PA.memberQ_('proj2','info') <-?- James"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+# [keyid:PA].role:memberQ([string:'proj1'],[string:'info']) <-?- [keyid:Lisa] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj1'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(lisa)
+
+print "\n===good============ PA.memberQ('proj1','info') <-?- Lisa"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# [keyid:PA].role:memberQ([string:'proj1'],[string:'info']) <-?- [keyid:John] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj1'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(john)
+
+print "\n===good============ PA.memberQ('proj1','info') <-?- John"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# [keyid:PA].role:memberQ([string:'proj2'],[string:'instantiate']) <-?- [keyid:John] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj2'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(john)
+
+print "\n===bad============ PA.memberQ('proj2','instantiate') <-?- John"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:PA].role:memberQ([string:'proj1'],[string:'instantiate']) <-?- [keyid:Tim] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj1'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(tim)
+
+print "\n===good============ PA.memberQ('proj1','instantiate') <-?- Tim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# [keyid:PA].role:memberQ([string:'proj2'],[string:'info']) <-?- [keyid:Tim] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj2'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(tim)
+
+print "\n===bad============ PA.memberQ('proj2','info') <-?- Tim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:PA].role:memberQ([string:'proj2'],[string:'info']) <-?- [keyid:Joe] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj2'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(john)
+
+print "\n===good============ PA.memberQ('proj2','info') <-?- Joe"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+
+print("\n\n")
Index: examples/access_tests/creddy_prover/s3_result.save
===================================================================
--- examples/access_tests/creddy_prover/s3_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s3_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,255 @@
+=====================s3_query.py==================
+keystore is not set, using current directory...
+
+===good============ PA.memberQ_('proj2','info') <-?- James
+YAP query succeed
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.delegate_memberQ_(P,Priv).memberQ_(P,Priv)
+pPA.standard <- 'proj2'
+pPA.std_ops <- 'info'
+pPA.delegate_memberQ_('proj2','info') <- pJohn
+pJohn.memberQ_('proj2','info') <- pJames
+
+next proof:
+no more..
+
+
+===good============ PA.memberQ('proj1','info') <-?- Lisa
+YAP query succeed
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'info'
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','info') <- pLisa
+
+next proof:
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'info'
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','info') <- pLisa
+
+next proof:
+no more..
+
+
+===good============ PA.memberQ('proj1','info') <-?- John
+YAP query succeed
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.delegate_memberQ_(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'info'
+pPA.delegate_memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).delegate_memberQ_(P,Priv)
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_memberQ_('proj1','info') <- pJohn
+
+next proof:
+no more..
+
+
+===bad============ PA.memberQ('proj2','instantiate') <-?- John
+YAP query failed
+A partial proof(type:what)
+pPA.delegate_memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).delegate_memberQ_(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'info'
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_memberQ_('proj1','info') <- pJohn
+
+===good============ PA.memberQ('proj1','instantiate') <-?- Tim
+YAP query succeed
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.delegate_memberQ_(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.delegate_memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).delegate_memberQ_(P,Priv)
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_memberQ_('proj1','instantiate') <- pTim
+
+next proof:
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member(P)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.member('proj1') <- pTim
+
+next proof:
+no more..
+
+
+===bad============ PA.memberQ('proj2','info') <-?- Tim
+YAP query failed
+A partial proof(type:what)
+pPA.delegate_memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).delegate_memberQ_(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.owner('proj1') <- pDrd
+pDrd.delegate_memberQ_('proj1','instantiate') <- pTim
+
+===good============ PA.memberQ('proj2','info') <-?- Joe
+YAP query succeed
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.delegate_memberQ_(P,Priv)
+pPA.standard <- 'proj2'
+pPA.std_ops <- 'info'
+pPA.delegate_memberQ_('proj2','info') <- pJohn
+
+
+
+=====================s3_run_query==================
+ 
+===bad============ PA.memberQ_(proj1,'info')<-?-Dan
+YAP query failed
+prover failed!!
+ 
+===good============ PA.memberQ(proj1,'info')<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ('proj1','info')  <- pDan 
+ 
+===bad============ PA.memberQ_(proj1,'stop')<-?-Dan
+YAP query failed
+prover failed!!
+ 
+===good============ PA.memberQ(proj1,'stop')<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ('proj1','stop')  <- pDan 
+ 
+===good============ PA.memberQ_(proj1,'info')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ_('proj1','info')  <- pFrank 
+ 
+===good============ PA.memberQ(proj1,'info')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'info' 
+ pPA.memberQ_('proj1','info')  <- pFrank 
+ 
+===good============ PA.memberQ_(proj1,'stop')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ_('proj1','stop')  <- pFrank 
+ 
+===good============ PA.memberQ(proj1,'stop')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'stop' 
+ pPA.memberQ_('proj1','stop')  <- pFrank 
+ 
+===bad============ PA.memberQ_(proj1,'info')<-?-James
+YAP query failed
+prover failed!!
+ 
+===good============ PA.memberQ(proj1,'info')<-?-James
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.delegate_memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'info' 
+ pPA.delegate_memberQ_('proj1','info')  <- pJames 
+ 
+===bad============ PA.memberQ_(proj1,'stop')<-?-James
+YAP query failed
+prover failed!!
+ 
+===good============ PA.memberQ(proj1,'stop')<-?-James
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv).memberQ(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'stop' 
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.member_(P) 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ('proj1','stop')  <- pJames 
+ 
+===bad============ PA.memberQ_(proj1,'info')<-?-Lisa
+YAP query failed
+prover failed!!
+ 
+===good============ PA.memberQ(proj1,'info')<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv).memberQ(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'info' 
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.member_(P) 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ('proj1','info')  <- pLisa 
+ 
+===bad============ PA.memberQ_(proj1,'stop')<-?-Lisa
+YAP query failed
+prover failed!!
+ 
+===good============ PA.memberQ(proj1,'stop')<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.delegate_memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'stop' 
+ pPA.delegate_memberQ_('proj1','stop')  <- pLisa 
+ 
+===good============ PA.memberQ_(proj1,'info')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.owner(P).memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'info' 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ_('proj1','info')  <- pTim 
+ 
+===good============ PA.memberQ(proj1,'info')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'info' 
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.owner(P).memberQ_(P,Priv) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ_('proj1','info')  <- pTim 
+ 
+===good============ PA.memberQ_(proj1,'stop')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.owner(P).memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'stop' 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ_('proj1','stop')  <- pTim 
+ 
+===good============ PA.memberQ(proj1,'stop')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv) 
+ pPA.standard  <- 'proj1' 
+ pPA.std_ops  <- 'stop' 
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.owner(P).memberQ_(P,Priv) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ_('proj1','stop')  <- pTim 
+ 
+===good============ John.memberQ(proj2,info)<-?-$ Joe
+YAP query succeed
+prover success!!
+credentials needed :
+ pJohn.memberQ('proj2','info')  <- pJoe 
+
+
+
Index: examples/access_tests/creddy_prover/s3_run_query
===================================================================
--- examples/access_tests/creddy_prover/s3_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s3_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,73 @@
+#!/bin/sh 
+
+# geni s3_run_query
+# using aba_prover_yap
+
+echo "=====================s3_run_query=================="
+
+pwd=`pwd`
+
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+
+keyloc=$pwd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+john=`creddy --keyid --cert $keyloc/John_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+tim=`creddy --keyid --cert $keyloc/Tim_ID.pem`
+james=`creddy --keyid --cert $keyloc/James_ID.pem`
+
+## dump all credentials 
+env ABAC_CN=1 $eloc/abac_prover_yap  --keystore $keyloc --dump s3_creds_dump
+
+#  runMember John $john what good bad
+runMember() {
+   id=$2 
+   what="'$3'"
+   role="[keyid:$pa].role:memberQ_([string:'proj1'],[string:$what])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$4============ PA.memberQ_("proj1",$what)<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+   role="[keyid:$pa].role:memberQ([string:'proj1'],[string:$what])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$5============ PA.memberQ("proj1",$what)<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+}
+
+
+runMember Dan $dan 'info' bad good
+runMember Dan $dan 'stop' bad good
+runMember Frank $frank 'info' good good
+runMember Frank $frank 'stop' good good
+runMember James $james 'info' bad good
+runMember James $james 'stop' bad good
+runMember Lisa $lisa 'info' bad good
+runMember Lisa $lisa 'stop' bad good
+runMember Tim $tim 'info' good good
+runMember Tim $tim 'stop' good good
+
+## special case,
+role="[keyid:$john].role:memberQ([string:'proj2'],[string:'info'])"
+prin="[keyid:$joe]"
+echo " "
+echo "===good============ John.memberQ("proj2","info")<-?-$ Joe"
+$eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+
+echo "\n\n"
+
+
Index: examples/access_tests/creddy_prover/s4_query.py
===================================================================
--- examples/access_tests/creddy_prover/s4_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s4_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,193 @@
+#!/usr/bin/env python
+
+"""
+  s4_query.py
+using python api
+
+"""
+
+print("=====================s4_query.py==================")
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set, using current directory...")
+    ctxt.load_directory(".")
+
+##########################################################################
+def get_next(CTXT) :
+    while( 1 ) :
+        print ("\nnext proof:")
+        (success, out) = CTXT.next_proof()
+        if(success) :
+            for c in out:
+                print "%s <- %s" % (c.head_string(), c.tail_string())
+        else:
+            print("no more..\n")
+            return
+
+# dump the loaded principals/policies
+def dump_all(CTXT,msg) :
+    out = CTXT.context_principals()
+    print "\n...%s principal set..." % msg
+    for x in out[1]:
+        print "#PP# %s " % x.string()
+    out = CTXT.context_credentials()
+    print "\n...%s policy attribute set..." %msg
+    for c in out[1]:
+        print "#CC# %s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# retrieve principals' keyid value from local credential files
+saID=ABAC.ID("SA_ID.pem");
+sa=saID.id_keyid()
+
+jimID=ABAC.ID("Jim_ID.pem");
+jim=jimID.id_keyid()
+
+nancyID=ABAC.ID("Nancy_ID.pem");
+nancy=nancyID.id_keyid()
+
+caryID=ABAC.ID("Cary_ID.pem");
+cary=caryID.id_keyid()
+
+drdID=ABAC.ID("Drd_ID.pem");
+drd=drdID.id_keyid()
+
+frankID=ABAC.ID("Frank_ID.pem");
+frank=frankID.id_keyid()
+
+##########################################################################
+#dump_all(ctxt,"initial")
+#ctxt.set_no_partial_proof()
+
+##########################################################################
+# role=[keyid:SA].role:controls([string:'sliceA'])
+# p =[keyid:Frank]
+#
+role=ABAC.Role(sa,"controls")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(frank)
+
+print "\n===good============ SA.controls('sliceA') <-?- Frank"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# role=[keyid:SA].role:delegate_controls_([string:'sliceA'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(sa,"delegate_controls_")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(cary)
+
+print "\n===good============ SA.delegate_controls_('sliceA') <-?- Cary"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:SA].role:controls_([string:'sliceA'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(sa,"controls_")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(cary)
+
+print "\n===bad============ SA.controls_('sliceA') <-?- Cary"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:SA].role:controls([string:'sliceA'])
+# p =[keyid:Drd]
+role=ABAC.Role(sa,"controls")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(drd)
+
+print "\n===good============ SA.controls('sliceA') <-?- Drd"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# role=[keyid:SA].role:controls([string:'sliceA'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(sa,"controls")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(cary)
+
+print "\n===good============ SA.controls('sliceA') <-?- Cary"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:SA].role:delegate_controls_([string:'sliceA'])
+# p =[keyid:Jim]
+#
+role=ABAC.Role(sa,"delegate_controls_")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(jim)
+
+print "\n===good============ SA.delegate_controls_('sliceA') <-?- Jim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# role=[keyid:SA].role:controls_([string:'sliceA'])
+# p =[keyid:Cary]
+#
+role=ABAC.Role(sa,"controls_")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(jim)
+
+print "\n===bad============ SA.controls_('sliceA') <-?- Jim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+
+##########################################################################
+# role=[keyid:SA].role:delegate_controls_([string:'sliceA'])
+# p =[keyid:Nancy]
+#
+role = ABAC.Role(sa,"delegate_controls_")
+param=ABAC.DataTerm("string", "'sliceA'")
+role.role_add_data_term(param)
+p = ABAC.Role(nancy)
+
+print "\n===bad============ SA.delegate_controls_('sliceA') <-?- Nancy"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+print("\n\n")
+
Index: examples/access_tests/creddy_prover/s4_result.save
===================================================================
--- examples/access_tests/creddy_prover/s4_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s4_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,223 @@
+=====================s4_query.py==================
+keystore is not set, using current directory...
+
+===good============ SA.controls('sliceA') <-?- Frank
+YAP query succeed
+pSA.controls(S:pSA.standard) <- pSA.controls_(S).controls(S)
+pSA.standard <- 'sliceA'
+pSA.controls_(S:pSA.standard) <- pSA.owner(S)
+pSA.owner('sliceA') <- pDrd
+pDrd.controls('sliceA') <- pFrank
+
+next proof:
+pSA.controls(S:pSA.standard) <- pSA.owner(S).controls(S)
+pSA.standard <- 'sliceA'
+pSA.owner('sliceA') <- pDrd
+pDrd.controls('sliceA') <- pFrank
+
+next proof:
+no more..
+
+
+===good============ SA.delegate_controls_('sliceA') <-?- Cary
+YAP query succeed
+pSA.delegate_controls_('sliceA') <- pCary
+
+===bad============ SA.controls_('sliceA') <-?- Cary
+YAP query failed
+A partial proof(type:what)
+pSA.controls(S:pSA.standard) <- pSA.delegate_controls_(S)
+pSA.standard <- 'sliceA'
+pSA.delegate_controls_('sliceA') <- pCary
+
+===good============ SA.controls('sliceA') <-?- Drd
+YAP query succeed
+pSA.controls(S:pSA.standard) <- pSA.controls_(S)
+pSA.standard <- 'sliceA'
+pSA.controls_(S:pSA.standard) <- pSA.owner(S)
+pSA.owner('sliceA') <- pDrd
+
+next proof:
+pSA.controls(S:pSA.standard) <- pSA.owner(S)
+pSA.standard <- 'sliceA'
+pSA.owner('sliceA') <- pDrd
+
+next proof:
+no more..
+
+
+===good============ SA.controls('sliceA') <-?- Cary
+YAP query succeed
+pSA.controls(S:pSA.standard) <- pSA.delegate_controls_(S)
+pSA.standard <- 'sliceA'
+pSA.delegate_controls_('sliceA') <- pCary
+
+===good============ SA.delegate_controls_('sliceA') <-?- Jim
+YAP query succeed
+pSA.delegate_controls_(S:pSA.standard) <- pSA.owner(S).delegate_controls_(S)
+pSA.standard <- 'sliceA'
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controls_('sliceA') <- pJim
+
+===bad============ SA.controls_('sliceA') <-?- Jim
+YAP query failed
+A partial proof(type:what)
+pSA.controls(S:pSA.standard) <- pSA.delegate_controls_(S)
+pSA.standard <- 'sliceA'
+pSA.delegate_controls_(S:pSA.standard) <- pSA.owner(S).delegate_controls_(S)
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controls_('sliceA') <- pJim
+
+===bad============ SA.delegate_controls_('sliceA') <-?- Nancy
+YAP query failed
+A partial proof(type:what)
+pSA.controls_(S:pSA.standard) <- pSA.delegate_controls_(S).controls_(S)
+pSA.standard <- 'sliceA'
+pSA.delegate_controls_(S:pSA.standard) <- pSA.owner(S).delegate_controls_(S)
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controls_('sliceA') <- pJim
+pJim.controls_('sliceA') <- pNancy
+
+
+
+=====================s4_run_query==================
+ 
+===bad============ SA.controls_(sliceA)<-?-Frank
+YAP query failed
+prover failed!!
+ 
+===good============ SA.controls(sliceA)<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.controls_(S).controls(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controls('sliceA')  <- pFrank 
+ 
+===good============ SA.controls_(sliceA)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S).controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controls_('sliceA')  <- pDan 
+ 
+===good============ SA.controls(sliceA)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S).controls_(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controls_('sliceA')  <- pDan 
+ 
+===good============ SA.controls_(sliceB)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls_('sliceB')  <- pDan 
+ 
+===good============ SA.controls(sliceB)<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.controls_(S) 
+ pSA.standard  <- 'sliceB' 
+ pSA.controls_('sliceB')  <- pDan 
+ 
+===bad============ SA.controls_(sliceA)<-?-Jim
+YAP query failed
+prover failed!!
+ 
+===good============ SA.controls(sliceA)<-?-Jim
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.delegate_controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.delegate_controls_(S:pSA.standard)  <- pSA.owner(S).delegate_controls_(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.delegate_controls_('sliceA')  <- pJim 
+ 
+===good============ SA.controls_(sliceA)<-?-Nancy
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls_(S:pSA.standard)  <- pSA.delegate_controls_(S).controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.delegate_controls_(S:pSA.standard)  <- pSA.owner(S).delegate_controls_(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.delegate_controls_('sliceA')  <- pJim 
+ pJim.controls_('sliceA')  <- pNancy 
+ 
+===good============ SA.controls(sliceA)<-?-Nancy
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.controls_(S:pSA.standard)  <- pSA.delegate_controls_(S).controls_(S) 
+ pSA.delegate_controls_(S:pSA.standard)  <- pSA.owner(S).delegate_controls_(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.delegate_controls_('sliceA')  <- pJim 
+ pJim.controls_('sliceA')  <- pNancy 
+ 
+===bad============ SA.controls_(sliceA)<-?-Lisa
+YAP query failed
+prover failed!!
+ 
+===good============ SA.controls(sliceA)<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls('sliceA')  <- pLisa 
+ 
+===bad============ SA.controls_(sliceA)<-?-Cary
+YAP query failed
+prover failed!!
+ 
+===good============ SA.controls(sliceA)<-?-Cary
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.delegate_controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.delegate_controls_('sliceA')  <- pCary 
+ 
+===good============ SA.controls_(sliceA)<-?-Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls_('sliceA')  <- pAlice 
+ 
+===good============ SA.controls(sliceA)<-?-Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.controls_('sliceA')  <- pAlice 
+ 
+===good============ SA.controls_(sliceA)<-?-Drd
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.owner('sliceA')  <- pDrd 
+ 
+===good============ SA.controls(sliceA)<-?-Drd
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controls(S:pSA.standard)  <- pSA.controls_(S) 
+ pSA.standard  <- 'sliceA' 
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S) 
+ pSA.owner('sliceA')  <- pDrd 
+
+
+
Index: examples/access_tests/creddy_prover/s4_run_query
===================================================================
--- examples/access_tests/creddy_prover/s4_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s4_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,66 @@
+#!/bin/sh 
+
+# geni s4_run_query
+# using aba_prover_yap
+
+echo "=====================s4_run_query=================="
+
+pwd=`pwd`
+
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+
+keyloc=$pwd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+jim=`creddy --keyid --cert $keyloc/Jim_ID.pem`
+nancy=`creddy --keyid --cert $keyloc/Nancy_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+cary=`creddy --keyid --cert $keyloc/Cary_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+
+## dump all credentials 
+env ABAC_CN=1 $eloc/abac_prover_yap  --keystore $keyloc --dump s4_creds_dump
+
+#  runControls Cary $cary slice good bad
+runControls() {
+   id=$2 
+   slice="'$3'"
+   role="[keyid:$sa].role:controls_([string:$slice])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$4============ SA.controls_($3)<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+   role="[keyid:$sa].role:controls([string:$slice])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$5============ SA.controls("$3")<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+}
+
+
+## SA.controls_("sliceA") <- Cary
+#[keyid:SA].role:controls_([string:'sliceA']) <-?- [keyid:Cary] 
+## SA.controls("sliceA") <- Cary
+#[keyid:SA].role:controls([string:'sliceA']) <-?- [keyid:Cary] 
+
+runControls Frank $frank sliceA bad good
+runControls Dan $dan sliceA good good
+runControls Dan $dan sliceB good good
+runControls Jim $jim sliceA bad good
+runControls Nancy $nancy sliceA good good
+runControls Lisa $lisa sliceA bad good
+runControls Cary $cary sliceA bad good
+runControls Alice $alice sliceA good good
+runControls Drd $drd sliceA good good
+
+echo "\n\n"
Index: examples/access_tests/creddy_prover/s5_query.py
===================================================================
--- examples/access_tests/creddy_prover/s5_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s5_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,209 @@
+#!/usr/bin/env python
+
+"""
+  s5_query.py
+using python api
+
+"""
+
+print("=====================s5_query.py==================")
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set, using current directory...")
+    ctxt.load_directory(".")
+
+##########################################################################
+def get_next(CTXT) :
+    while( 1 ) :
+        print ("\nnext proof:")
+        (success, out) = CTXT.next_proof()
+        if(success) :
+            for c in out:
+                print "%s <- %s" % (c.head_string(), c.tail_string())
+        else:
+            print("no more..\n")
+            return
+
+# dump the loaded principals/policies
+def dump_all(CTXT,msg) :
+    out = CTXT.context_principals()
+    print "\n...%s principal set..." % msg
+    for x in out[1]:
+        print "#PP# %s " % x.string()
+    out = CTXT.context_credentials()
+    print "\n...%s policy attribute set..." %msg
+    for c in out[1]:
+        print "#CC# %s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# retrieve principals' keyid value from local credential files
+gID=ABAC.ID("G_ID.pem");
+g=gID.id_keyid()
+
+saID=ABAC.ID("SA_ID.pem");
+sa=saID.id_keyid()
+
+drdID=ABAC.ID("Drd_ID.pem");
+drd=drdID.id_keyid()
+
+johnID=ABAC.ID("John_ID.pem");
+john=johnID.id_keyid()
+
+timID=ABAC.ID("Tim_ID.pem");
+tim=timID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joe=joeID.id_keyid()
+
+danID=ABAC.ID("Dan_ID.pem");
+dan=danID.id_keyid()
+
+jamesID=ABAC.ID("James_ID.pem");
+james=jamesID.id_keyid()
+
+lisaID=ABAC.ID("Lisa_ID.pem");
+lisa=lisaID.id_keyid()
+##########################################################################
+#dump_all(ctxt,"initial")
+#ctxt.set_no_partial_proof()
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceA'],[string:'info']) <-?- [keyid:Lisa] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceA'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(lisa)
+
+print "\n===good============ SA.controlsQ('sliceA','info') <-?- lisa"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# [keyid:SA].role:controlsQ_([string:'sliceB'],[string:'info']) <-?- [keyid:Lisa] 
+role = ABAC.Role(sa,"controlsQ_")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(lisa)
+
+print "\n===good============ SA.controlsQ_('sliceB','info') <-?- lisa"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ_([string:'sliceB'],[string:'info']) <-?- [keyid:James] 
+role = ABAC.Role(sa,"controlsQ_")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(james)
+
+print "\n===good============ SA.controlsQ_('sliceB','info') <-?- James"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceB'],[string:'info']) <-?- [keyid:Dan] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(dan)
+
+print "\n===good============ SA.controlsQ('sliceB','info') <-?- Dan"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceA'],[string:'info']) <-?- [keyid:John] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceA'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(john)
+
+print "\n===good============ SA.controlsQ('sliceA','info') <-?- John"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceB'],[string:'instantiate']) <-?- [keyid:John] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(john)
+
+print "\n===bad============ SA.controlsQ('sliceB','instantiate') <-?- John"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceB'],[string:'instantiate']) <-?- [keyid:Tim] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(tim)
+
+print "\n===bad============ SA.controlsQ('sliceB','instantiate') <-?- Tim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceB'],[string:'info']) <-?- [keyid:Tim] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(tim)
+
+print "\n===bad============ SA.controlsQ('sliceB','info') <-?- Tim"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:controlsQ([string:'sliceB'],[string:'info']) <-?- [keyid:Joe] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceB'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(john)
+
+print "\n===good============ SA.controlsQ('sliceB','info') <-?- Joe"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+
+print("\n\n")
Index: examples/access_tests/creddy_prover/s5_result.save
===================================================================
--- examples/access_tests/creddy_prover/s5_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s5_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,268 @@
+=====================s5_query.py==================
+keystore is not set, using current directory...
+
+===good============ SA.controlsQ('sliceA','info') <-?- lisa
+YAP query succeed
+pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controlsQ_(S,Priv).controlsQ(S,Priv)
+pSA.standard <- 'sliceA'
+pPA.std_ops <- 'info'
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controls_(S)
+pSA.controls_(S:pSA.standard) <- pSA.owner(S)
+pSA.owner('sliceA') <- pDrd
+pDrd.controlsQ('sliceA','info') <- pLisa
+
+next proof:
+pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).controlsQ(S,Priv)
+pSA.standard <- 'sliceA'
+pPA.std_ops <- 'info'
+pSA.owner('sliceA') <- pDrd
+pDrd.controlsQ('sliceA','info') <- pLisa
+
+next proof:
+no more..
+
+
+===good============ SA.controlsQ_('sliceB','info') <-?- lisa
+YAP query succeed
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controls_(S)
+pSA.standard <- 'sliceB'
+pPA.std_ops <- 'info'
+pSA.delegate_controls_('sliceB') <- pLisa
+
+===good============ SA.controlsQ_('sliceB','info') <-?- James
+YAP query succeed
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv).controlsQ_(S,Priv)
+pSA.standard <- 'sliceB'
+pPA.std_ops <- 'info'
+pSA.delegate_controlsQ_('sliceB','info') <- pJohn
+pJohn.controlsQ_('sliceB','info') <- pJames
+
+===good============ SA.controlsQ('sliceB','info') <-?- Dan
+YAP query succeed
+pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controls(S)
+pSA.standard <- 'sliceB'
+pPA.std_ops <- 'info'
+pSA.controls('sliceB') <- pDan
+
+===good============ SA.controlsQ('sliceA','info') <-?- John
+YAP query succeed
+pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controlsQ_(S,Priv)
+pSA.standard <- 'sliceA'
+pPA.std_ops <- 'info'
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv)
+pSA.delegate_controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).delegate_controlsQ_(S,Priv)
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controlsQ_('sliceA','info') <- pJohn
+
+===bad============ SA.controlsQ('sliceB','instantiate') <-?- John
+YAP query failed
+A partial proof(type:what)
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv)
+pSA.standard <- 'sliceA'
+pPA.std_ops <- 'info'
+pSA.delegate_controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).delegate_controlsQ_(S,Priv)
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controlsQ_('sliceA','info') <- pJohn
+
+===bad============ SA.controlsQ('sliceB','instantiate') <-?- Tim
+YAP query failed
+A partial proof(type:what)
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv)
+pSA.standard <- 'sliceA'
+pPA.std_ops <- 'instantiate'
+pSA.delegate_controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).delegate_controlsQ_(S,Priv)
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controlsQ_('sliceA','instantiate') <- pTim
+
+===bad============ SA.controlsQ('sliceB','info') <-?- Tim
+YAP query failed
+A partial proof(type:what)
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv)
+pSA.standard <- 'sliceA'
+pPA.std_ops <- 'instantiate'
+pSA.delegate_controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).delegate_controlsQ_(S,Priv)
+pSA.owner('sliceA') <- pDrd
+pDrd.delegate_controlsQ_('sliceA','instantiate') <- pTim
+
+===good============ SA.controlsQ('sliceB','info') <-?- Joe
+YAP query succeed
+pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controlsQ_(S,Priv)
+pSA.standard <- 'sliceB'
+pPA.std_ops <- 'info'
+pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv)
+pSA.delegate_controlsQ_('sliceB','info') <- pJohn
+
+
+
+=====================s5_run_query==================
+ 
+===bad============ PA.controlsQ_(sliceA,'info')<-?-Dan
+YAP query failed
+prover failed!!
+ 
+===good============ PA.controlsQ(sliceA,'info')<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ('sliceA','info')  <- pDan 
+ 
+===bad============ PA.controlsQ_(sliceA,'stop')<-?-Dan
+YAP query failed
+prover failed!!
+ 
+===good============ PA.controlsQ(sliceA,'stop')<-?-Dan
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ('sliceA','stop')  <- pDan 
+ 
+===good============ PA.controlsQ_(sliceA,'info')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ_('sliceA','info')  <- pFrank 
+ 
+===good============ PA.controlsQ(sliceA,'info')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'info' 
+ pSA.controlsQ_('sliceA','info')  <- pFrank 
+ 
+===good============ PA.controlsQ_(sliceA,'stop')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ_('sliceA','stop')  <- pFrank 
+ 
+===good============ PA.controlsQ(sliceA,'stop')<-?-Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'stop' 
+ pSA.controlsQ_('sliceA','stop')  <- pFrank 
+ 
+===bad============ PA.controlsQ_(sliceA,'info')<-?-James
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.delegate_controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'info' 
+ pSA.delegate_controlsQ_('sliceA','info')  <- pJames 
+ 
+===good============ PA.controlsQ(sliceA,'info')<-?-James
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'info' 
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.delegate_controlsQ_(S,Priv) 
+ pSA.delegate_controlsQ_('sliceA','info')  <- pJames 
+ 
+===bad============ PA.controlsQ_(sliceA,'stop')<-?-James
+YAP query failed
+prover failed!!
+ 
+===good============ PA.controlsQ(sliceA,'stop')<-?-James
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv).controlsQ(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'stop' 
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controls_(S) 
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controlsQ('sliceA','stop')  <- pJames 
+ 
+===bad============ PA.controlsQ_(sliceA,'info')<-?-Lisa
+YAP query failed
+prover failed!!
+ 
+===good============ PA.controlsQ(sliceA,'info')<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv).controlsQ(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'info' 
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controls_(S) 
+ pSA.controls_(S:pSA.standard)  <- pSA.owner(S) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controlsQ('sliceA','info')  <- pLisa 
+ 
+===good============ PA.controlsQ_(sliceA,'stop')<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.delegate_controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'stop' 
+ pSA.delegate_controlsQ_('sliceA','stop')  <- pLisa 
+ 
+===good============ PA.controlsQ(sliceA,'stop')<-?-Lisa
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'stop' 
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.delegate_controlsQ_(S,Priv) 
+ pSA.delegate_controlsQ_('sliceA','stop')  <- pLisa 
+ 
+===good============ PA.controlsQ_(sliceA,'info')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.owner(S).controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'info' 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controlsQ_('sliceA','info')  <- pTim 
+ 
+===good============ PA.controlsQ(sliceA,'info')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'info' 
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.owner(S).controlsQ_(S,Priv) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controlsQ_('sliceA','info')  <- pTim 
+ 
+===good============ PA.controlsQ_(sliceA,'stop')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.owner(S).controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'stop' 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controlsQ_('sliceA','stop')  <- pTim 
+ 
+===good============ PA.controlsQ(sliceA,'stop')<-?-Tim
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.controlsQ_(S,Priv) 
+ pSA.standard  <- 'sliceA' 
+ pPA.std_ops  <- 'stop' 
+ pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops)  <- pSA.owner(S).controlsQ_(S,Priv) 
+ pSA.owner('sliceA')  <- pDrd 
+ pDrd.controlsQ_('sliceA','stop')  <- pTim 
+ 
+===good============ John.controlsQ(sliceB,info)<-?-$ Joe
+YAP query succeed
+prover success!!
+credentials needed :
+ pJohn.controlsQ('sliceB','info')  <- pJoe 
+
+
+
Index: examples/access_tests/creddy_prover/s5_run_query
===================================================================
--- examples/access_tests/creddy_prover/s5_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s5_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,73 @@
+#!/bin/sh 
+
+# geni s5_run_query
+# using aba_prover_yap
+
+echo "=====================s5_run_query=================="
+
+pwd=`pwd`
+
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+
+keyloc=$pwd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+john=`creddy --keyid --cert $keyloc/John_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+tim=`creddy --keyid --cert $keyloc/Tim_ID.pem`
+james=`creddy --keyid --cert $keyloc/James_ID.pem`
+
+## dump all credentials 
+env ABAC_CN=1 $eloc/abac_prover_yap  --keystore $keyloc --dump s5_creds_dump
+
+#  runMember John $john what good bad
+runMember() {
+   id=$2 
+   what="'$3'"
+   role="[keyid:$sa].role:controlsQ_([string:'sliceA'],[string:$what])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$4============ PA.controlsQ_("sliceA",$what)<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+   role="[keyid:$sa].role:controlsQ([string:'sliceA'],[string:$what])"
+   prin="[keyid:$id]"
+   echo " "
+   echo "===$5============ PA.controlsQ("sliceA",$what)<-?-$1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+}
+
+
+runMember Dan $dan 'info' bad good
+runMember Dan $dan 'stop' bad good
+runMember Frank $frank 'info' good good
+runMember Frank $frank 'stop' good good
+runMember James $james 'info' bad good
+runMember James $james 'stop' bad good
+runMember Lisa $lisa 'info' bad good
+runMember Lisa $lisa 'stop' good good
+runMember Tim $tim 'info' good good
+runMember Tim $tim 'stop' good good
+
+## special case,
+role="[keyid:$john].role:controlsQ([string:'sliceB'],[string:'info'])"
+prin="[keyid:$joe]"
+echo " "
+echo "===good============ John.controlsQ("sliceB","info")<-?-$ Joe"
+$eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+
+echo "\n\n"
+
+
Index: examples/access_tests/creddy_prover/s6_query.py
===================================================================
--- examples/access_tests/creddy_prover/s6_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s6_query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,199 @@
+#!/usr/bin/env python
+
+"""
+  s6_query.py
+using python api
+
+"""
+
+print("=====================s6_query.py==================")
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set, using current directory...")
+    ctxt.load_directory(".")
+
+##########################################################################
+def get_next(CTXT) :
+    while( 1 ) :
+        print ("\nnext proof:")
+        (success, out) = CTXT.next_proof()
+        if(success) :
+            for c in out:
+                print "%s <- %s" % (c.head_string(), c.tail_string())
+        else:
+            print("no more..\n")
+            return
+
+# dump the loaded principals/policies
+def dump_all(CTXT,msg) :
+    out = CTXT.context_principals()
+    print "\n...%s principal set..." % msg
+    for x in out[1]:
+        print "#PP# %s " % x.string()
+    out = CTXT.context_credentials()
+    print "\n...%s policy attribute set..." %msg
+    for c in out[1]:
+        print "#CC# %s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# retrieve principals' keyid value from local credential files
+gID=ABAC.ID("G_ID.pem");
+g=gID.id_keyid()
+
+saID=ABAC.ID("SA_ID.pem");
+sa=saID.id_keyid()
+
+paID=ABAC.ID("PA_ID.pem");
+pa=paID.id_keyid()
+
+drdID=ABAC.ID("Drd_ID.pem");
+drd=drdID.id_keyid()
+
+frankID=ABAC.ID("Frank_ID.pem");
+frank=frankID.id_keyid()
+
+danID=ABAC.ID("Dan_ID.pem");
+dan=danID.id_keyid()
+
+aliceID=ABAC.ID("Alice_ID.pem");
+alice=aliceID.id_keyid()
+
+lisaID=ABAC.ID("Lisa_ID.pem");
+lisa=lisaID.id_keyid()
+
+##########################################################################
+dump_all(ctxt,"initial")
+#ctxt.set_no_partial_proof()
+
+##########################################################################
+# [keyid:SA].role:controlsQ(string:'sliceA'],[string:'info']) <-?- [keyid:Drd] 
+role = ABAC.Role(sa,"controlsQ")
+param1=ABAC.DataTerm("string", "'sliceA'")
+param2=ABAC.DataTerm("string", "'info'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(drd)
+print "\n===good============ SA.controlsQ('sliceA','info') <-?- Drd"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+#get_next(ctxt)
+
+##########################################################################
+# [keyid:SA].role:createSlice(string:'proj1']) <-?- [keyid:Drd] 
+role = ABAC.Role(sa,"createSlice")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(drd)
+print "\n===good============ SA.createSlice('proj1') <-?- Drd"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+oset = ABAC.Oset(sa,"Standard")
+term=ABAC.DataTerm("string", "'sliceA'")
+p = ABAC.Oset(term)
+print "\n===good============ SA.Stanard <-?- 'sliceA'"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+oset = ABAC.Oset(sa,"inProject")
+param=ABAC.DataTerm("string", "'proj1'")
+oset.oset_add_data_term(param)
+term=ABAC.DataTerm("string", "'sliceA'")
+p = ABAC.Oset(term)
+print "\n===good============ SA.inProject('proj1') <-?- 'sliceA'"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].oset:inStdProject("proj1") <- "sliceA"
+oset = ABAC.Oset(sa,"inStdProject")
+param=ABAC.DataTerm("string", "'proj1'")
+oset.oset_add_data_term(param)
+term=ABAC.DataTerm("string", "'sliceA'")
+p = ABAC.Oset(term)
+print "\n===good============ SA.inStdProject('proj1') <-?- 'sliceA'"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# [keyid:SA].role:createSlice(string:'proj1']) <-?- [keyid:lisa] 
+role = ABAC.Role(sa,"createSlice")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(lisa)
+print "\n===good============ SA.createSlice('proj1') <-?- lisa"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# [keyid:SA].role:createSlice(string:'proj1']) <-?- [keyid:Dan] 
+role = ABAC.Role(sa,"createSlice")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(dan)
+print "\n===good============ SA.createSlice('proj1') <-?- Dan"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# [keyid:SA].role:createSlice(string:'proj1']) <-?- [keyid:Frank] 
+role = ABAC.Role(sa,"createSlice")
+param=ABAC.DataTerm("string", "'proj1'")
+role.role_add_data_term(param)
+p = ABAC.Role(frank)
+print "\n===bad============ SA.createSlice('proj1') <-?- Frank"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+#(SA.projectAuthority).memberQ(?P, "instantiate")
+# [keyid:PA].role:memberQ(string:'proj1'],[string:'instantiate']) <-?- [keyid:Dan] 
+role = ABAC.Role(pa,"memberQ")
+param1=ABAC.DataTerm("string", "'proj1'")
+param2=ABAC.DataTerm("string", "'instantiate'")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+p = ABAC.Role(dan)
+print "\n===good============ PA.memberQ('proj1','instantiate') <-?- Dan"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+##########################################################################
+# speaksFor((SA.projectAuthority).memberQ(?P, "instantiate")
+# attr="[keyid:$sa].role:speaksFor([keyid:$dan]) <- [keyid:$frank]"
+role = ABAC.Role(sa,"speaksFor")
+param=ABAC.DataTerm(danID)
+role.role_add_data_term(param)
+p = ABAC.Role(frank)
+print "\n===bad============ SA.speaksFor(Dan) <-?- Frank"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+get_next(ctxt)
+
+
+print("\n\n")
Index: examples/access_tests/creddy_prover/s6_result.save
===================================================================
--- examples/access_tests/creddy_prover/s6_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s6_result.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,328 @@
+=====================s6_query.py==================
+keystore is not set, using current directory...
+
+...initial principal set...
+#PP# (pAlice,keyid,y) 
+#PP# (pDan,keyid,y) 
+#PP# (pDrd,keyid,y) 
+#PP# (pEXO,keyid,y) 
+#PP# (pFrank,keyid,y) 
+#PP# (pGM,keyid,y) 
+#PP# (pGR,keyid,y) 
+#PP# (pG,keyid,y) 
+#PP# (pIDP,keyid,y) 
+#PP# (pLisa,keyid,y) 
+#PP# (pPA,keyid,y) 
+#PP# (pSA,keyid,y) 
+
+...initial policy attribute set...
+#CC# pG.aggregate <- pG.geniRoot.aggregate
+#CC# pG.geniPI <- pG.identityProvider.geniPI
+#CC# pG.geniProxy <- pG.geniRoot.geniProxy
+#CC# pG.geniUser <- pG.identityProvider.geniUser
+#CC# pG.gmoc <- pG.geniRoot.gmoc
+#CC# pG.identityProvider <- pG.geniRoot.identityProvider
+#CC# pG.projectAuthority <- pG.geniRoot.projectAuthority
+#CC# pG.qualifiedProject <- pG.root(This).project
+#CC# pG.root(P) <- pG.projectAuthority.root(P)
+#CC# pG.root(S) <- pG.sliceAuthority.root(S)
+#CC# pG.sliceAuthority <- pG.geniRoot.sliceAuthority
+#CC# pPA.createRoot <- pPA.geniPI
+#CC# pPA.delegate_member_(P:pPA.standard) <- pPA.owner(P).delegate_member_(P)
+#CC# pPA.delegate_memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).delegate_memberQ_(P,Priv)
+#CC# pPA.member_(P:pPA.standard) <- pPA.delegate_member_(P).member_(P)
+#CC# pPA.member_(P:pPA.standard) <- pPA.owner(P)
+#CC# pPA.member_(P:pPA.standard) <- pPA.owner(P).member_(P)
+#CC# pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.delegate_memberQ_(P,Priv).memberQ_(P,Priv)
+#CC# pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+#CC# pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).memberQ_(P,Priv)
+#CC# pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.delegate_memberQ_(P,Priv)
+#CC# pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv)
+#CC# pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv).memberQ(P,Priv)
+#CC# pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member(P)
+#CC# pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).memberQ(P,Priv)
+#CC# pPA.member(P:pPA.standard) <- pPA.delegate_member_(P)
+#CC# pPA.member(P:pPA.standard) <- pPA.member_(P)
+#CC# pPA.member(P:pPA.standard) <- pPA.member_(P).member(P)
+#CC# pPA.member(P:pPA.standard) <- pPA.owner(P)
+#CC# pPA.member(P:pPA.standard) <- pPA.owner(P).member(P)
+#CC# pPA.std_ops <- 'info'
+#CC# pPA.std_ops <- 'instantiate'
+#CC# pPA.std_ops <- 'stop'
+#CC# pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniProxy & pSA.speaksFor(C:pSA.projectAuthority.memberQ(P,'instantiate'))
+#CC# pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniUser & pSA.projectAuthority.memberQ(P,'instantiate')
+#CC# pSA.controls_(S:pSA.standard) <- pSA.delegate_controls_(S).controls_(S)
+#CC# pSA.controls_(S:pSA.standard) <- pSA.owner(S)
+#CC# pSA.controls_(S:pSA.standard) <- pSA.owner(S).controls_(S)
+#CC# pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controls_(S)
+#CC# pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv)
+#CC# pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controlsQ_(S,Priv).controlsQ(S,Priv)
+#CC# pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controls_(S)
+#CC# pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.delegate_controlsQ_(S,Priv).controlsQ_(S,Priv)
+#CC# pSA.controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).controlsQ_(S,Priv)
+#CC# pSA.controlsQ(S:pSA.inStdProject(P),'info') <- pSA.projectAuthority.memberQ(P,'info')
+#CC# pSA.controlsQ(S:pSA.inStdProject(P),'info') <- pSA.projectAuthority.owner(P)
+#CC# pSA.controlsQ(S:pSA.inStdProject(P),'stop') <- pSA.projectAuthority.owner(P)
+#CC# pSA.controlsQ(S:pSA.standard,'info') <- pSA.gmoc
+#CC# pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controlsQ_(S,Priv)
+#CC# pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.controls(S)
+#CC# pSA.controlsQ(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).controlsQ(S,Priv)
+#CC# pSA.controlsQ(S:pSA.standard,'stop') <- pSA.gmoc
+#CC# pSA.controls(S:pSA.standard) <- pSA.controls_(S)
+#CC# pSA.controls(S:pSA.standard) <- pSA.delegate_controls_(S)
+#CC# pSA.controls(S:pSA.standard) <- pSA.controls_(S).controls(S)
+#CC# pSA.controls(S:pSA.standard) <- pSA.owner(S)
+#CC# pSA.controls(S:pSA.standard) <- pSA.owner(S).controls(S)
+#CC# pSA.delegate_controls_(S:pSA.standard) <- pSA.owner(S).delegate_controls_(S)
+#CC# pSA.delegate_controlsQ_(S:pSA.standard,Priv:pPA.std_ops) <- pSA.owner(S).delegate_controlsQ_(S,Priv)
+#CC# pSA.inStdProject(P:pPA.standard) <- pSA.inProject(P) & pSA.standard
+#CC# pDrd.project <- 'proj1'
+#CC# pDrd.slice <- 'sliceA'
+#CC# pGR.aggregate <- pEXO
+#CC# pGR.identityProvider <- pIDP
+#CC# pGR.projectAuthority <- pPA
+#CC# pGR.sliceAuthority <- pSA
+#CC# pG.geniRoot <- pGR
+#CC# pIDP.geniPI <- pDrd
+#CC# pDrd.memberQ('proj1','info') <- pFrank
+#CC# pDrd.memberQ('proj1','instantiate') <- pDan
+#CC# pPA.owner('proj1') <- pDrd
+#CC# pPA.root('proj1') <- pDrd
+#CC# pPA.standard <- 'proj1'
+#CC# pSA.geniProxy <- pLisa
+#CC# pSA.geniUser <- pDan
+#CC# pSA.geniUser <- pDrd
+#CC# pSA.geniUser <- pFrank
+#CC# pSA.gmoc <- pAlice
+#CC# pSA.inProject('proj1') <- 'sliceA'
+#CC# pSA.owner('sliceA') <- pDrd
+#CC# pSA.projectAuthority <- pPA
+#CC# pSA.qualifiedProject <- 'proj1'
+#CC# pSA.root('sliceA') <- pDrd
+#CC# pSA.speaksFor(pDan) <- pLisa
+#CC# pSA.standard <- 'sliceA'
+
+===good============ SA.controlsQ('sliceA','info') <-?- Drd
+YAP query succeed
+pSA.controlsQ(S:pSA.inStdProject(P),'info') <- pSA.projectAuthority.memberQ(P,'info')
+pSA.inStdProject(P:pPA.standard) <- pSA.inProject(P) & pSA.standard
+pPA.standard <- 'proj1'
+pSA.inProject('proj1') <- 'sliceA'
+pSA.standard <- 'sliceA'
+pSA.projectAuthority <- pPA
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv)
+pPA.std_ops <- 'info'
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+
+===good============ SA.createSlice('proj1') <-?- Drd
+YAP query succeed
+pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniUser & pSA.projectAuthority.memberQ(P,'instantiate')
+pSA.qualifiedProject <- 'proj1'
+pSA.geniUser <- pDrd
+pSA.projectAuthority <- pPA
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+
+===good============ SA.Stanard <-?- 'sliceA'
+YAP query succeed
+pSA.standard <- 'sliceA'
+
+===good============ SA.inProject('proj1') <-?- 'sliceA'
+YAP query succeed
+pSA.inProject('proj1') <- 'sliceA'
+
+===good============ SA.inStdProject('proj1') <-?- 'sliceA'
+YAP query succeed
+pSA.inStdProject(P:pPA.standard) <- pSA.inProject(P) & pSA.standard
+pPA.standard <- 'proj1'
+pSA.inProject('proj1') <- 'sliceA'
+pSA.standard <- 'sliceA'
+
+===good============ SA.createSlice('proj1') <-?- lisa
+YAP query succeed
+pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniProxy & pSA.speaksFor(C:pSA.projectAuthority.memberQ(P,'instantiate'))
+pSA.qualifiedProject <- 'proj1'
+pSA.projectAuthority <- pPA
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','instantiate') <- pDan
+pSA.geniProxy <- pLisa
+pSA.speaksFor(pDan) <- pLisa
+
+next proof:
+pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniProxy & pSA.speaksFor(C:pSA.projectAuthority.memberQ(P,'instantiate'))
+pSA.qualifiedProject <- 'proj1'
+pSA.projectAuthority <- pPA
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','instantiate') <- pDan
+pSA.geniProxy <- pLisa
+pSA.speaksFor(pDan) <- pLisa
+
+next proof:
+no more..
+
+
+===good============ SA.createSlice('proj1') <-?- Dan
+YAP query succeed
+pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniUser & pSA.projectAuthority.memberQ(P,'instantiate')
+pSA.qualifiedProject <- 'proj1'
+pSA.geniUser <- pDan
+pSA.projectAuthority <- pPA
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','instantiate') <- pDan
+
+next proof:
+pSA.createSlice(P:pSA.qualifiedProject) <- pSA.geniUser & pSA.projectAuthority.memberQ(P,'instantiate')
+pSA.qualifiedProject <- 'proj1'
+pSA.geniUser <- pDan
+pSA.projectAuthority <- pPA
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','instantiate') <- pDan
+
+next proof:
+no more..
+
+
+===bad============ SA.createSlice('proj1') <-?- Frank
+YAP query failed
+A partial proof(type:what_default)
+pSA.geniUser <- pFrank
+
+===good============ PA.memberQ('proj1','instantiate') <-?- Dan
+YAP query succeed
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.memberQ_(P,Priv).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops) <- pPA.member_(P)
+pPA.member_(P:pPA.standard) <- pPA.owner(P)
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','instantiate') <- pDan
+
+next proof:
+pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops) <- pPA.owner(P).memberQ(P,Priv)
+pPA.standard <- 'proj1'
+pPA.std_ops <- 'instantiate'
+pPA.owner('proj1') <- pDrd
+pDrd.memberQ('proj1','instantiate') <- pDan
+
+next proof:
+no more..
+
+
+===bad============ SA.speaksFor(Dan) <-?- Frank
+YAP query failed
+A partial proof(type:what_default)
+pSA.geniUser <- pFrank
+
+next proof:
+A partial proof(type:who)
+pSA.speaksFor(pDan) <- pLisa
+
+next proof:
+no more..
+
+
+
+
+=====================s6_run_query==================
+
+
+===good============ SA.controlsQ('sliceA','info') <-?- Drd
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.inStdProject(P),'info')  <- pSA.projectAuthority.memberQ(P,'info') 
+ pSA.inStdProject(P:pPA.standard)  <- pSA.inProject(P) & pSA.standard 
+ pPA.standard  <- 'proj1' 
+ pSA.inProject('proj1')  <- 'sliceA' 
+ pSA.standard  <- 'sliceA' 
+ pSA.projectAuthority  <- pPA 
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv) 
+ pPA.std_ops  <- 'info' 
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.member_(P) 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.owner('proj1')  <- pDrd 
+
+===good============ SA.controlsQ('sliceA','stop') <-?- Drd
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.inStdProject(P),'stop')  <- pSA.projectAuthority.owner(P) 
+ pSA.inStdProject(P:pPA.standard)  <- pSA.inProject(P) & pSA.standard 
+ pPA.standard  <- 'proj1' 
+ pSA.inProject('proj1')  <- 'sliceA' 
+ pSA.standard  <- 'sliceA' 
+ pSA.projectAuthority  <- pPA 
+ pPA.owner('proj1')  <- pDrd 
+
+
+===good============ SA.controlsQ('sliceA','info') <-?- Frank
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.inStdProject(P),'info')  <- pSA.projectAuthority.memberQ(P,'info') 
+ pSA.inStdProject(P:pPA.standard)  <- pSA.inProject(P) & pSA.standard 
+ pPA.standard  <- 'proj1' 
+ pSA.inProject('proj1')  <- 'sliceA' 
+ pSA.standard  <- 'sliceA' 
+ pSA.projectAuthority  <- pPA 
+ pPA.memberQ(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.memberQ_(P,Priv).memberQ(P,Priv) 
+ pPA.std_ops  <- 'info' 
+ pPA.memberQ_(P:pPA.standard,Priv:pPA.std_ops)  <- pPA.member_(P) 
+ pPA.member_(P:pPA.standard)  <- pPA.owner(P) 
+ pPA.owner('proj1')  <- pDrd 
+ pDrd.memberQ('proj1','info')  <- pFrank 
+
+===bad============ SA.controlsQ('sliceA','stop') <-?- Frank
+YAP query failed
+prover failed!!
+
+
+===bad============ SA.controlsQ('sliceA','info') <-?- Dan
+YAP query failed
+prover failed!!
+
+===bad============ SA.controlsQ('sliceA','stop') <-?- Dan
+YAP query failed
+prover failed!!
+
+
+===good============ SA.controlsQ('sliceA','info') <-?- Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,'info')  <- pSA.gmoc 
+ pSA.standard  <- 'sliceA' 
+ pSA.gmoc  <- pAlice 
+
+===good============ SA.controlsQ('sliceA','stop') <-?- Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pSA.controlsQ(S:pSA.standard,'stop')  <- pSA.gmoc 
+ pSA.standard  <- 'sliceA' 
+ pSA.gmoc  <- pAlice 
+
+
+
Index: examples/access_tests/creddy_prover/s6_run_query
===================================================================
--- examples/access_tests/creddy_prover/s6_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/s6_run_query	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,53 @@
+#!/bin/sh 
+
+# geni s6_run_query
+# using aba_prover_yap
+
+echo "=====================s6_run_query=================="
+
+pwd=`pwd`
+
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+
+keyloc=$pwd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+
+## dump all credentials 
+env ABAC_CN=1 $eloc/abac_prover_yap  --keystore $keyloc --dump s6_creds_dump
+
+# [keyid:SA].role:controlsQ("sliceA","info") <-?- [keyid:Frank]
+#  runControlsQ Frank $frank good bad
+runControlsQ() {
+   id=$2
+   role="[keyid:$sa].role:controlsQ([string:'sliceA'],[string:'info'])"
+   prin="[keyid:$id]"
+   echo "\n\n===$3============ SA.controlsQ('sliceA','info') <-?- $1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+
+   role="[keyid:$sa].role:controlsQ([string:'sliceA'],[string:'stop'])"
+   prin="[keyid:$id]"
+   echo "\n===$4============ SA.controlsQ('sliceA','stop') <-?- $1"
+   $eloc/abac_prover_yap --keystore $keyloc --role "$role" --principal "$prin"
+}
+
+
+runControlsQ Drd $drd good good
+runControlsQ Frank $frank good bad
+runControlsQ Dan $dan bad bad
+runControlsQ Alice $alice good good
+
+echo "\n\n"
+
+
Index: examples/access_tests/creddy_prover/scenario_s1.sh
===================================================================
--- examples/access_tests/creddy_prover/scenario_s1.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/scenario_s1.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,94 @@
+#!/bin/sh 
+
+#####################################################################
+# scenario #1
+#    Explore simple user and project relationship
+#
+#  Drd, a geniPI, created a project 'proj1' 
+#
+unset ABAC_CN
+keyloc=`pwd`
+sidx=s1
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho GR
+makeWho IDP
+makeWho EXO
+makeWho Drd
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+gr=`creddy --keyid --cert $keyloc/GR_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+idp=`creddy --keyid --cert $keyloc/IDP_ID.pem`
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+
+pname=${sidx}_yap_clauses
+namespace=access1
+sfile=sfile_${sidx}
+
+idp_gUser()
+{
+eval "namename=[keyid:\$$1]"
+attr="[keyid:$idp].role:geniUser <- $namename"
+name=${sidx}_IDP_gUser__$1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+###############################################################################
+echo "s/$g/G/g "  > $sfile 
+echo "s/$gr/GR/g "  >> $sfile 
+echo "s/$pa/PA/g "  >> $sfile
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$idp/IDP/g "  >> $sfile
+echo "s/$drd/Drd/g "  >> $sfile
+
+# G.geniRoot <- GR 
+attr="[keyid:$g].role:geniRoot <- [keyid:$gr]"
+name=${sidx}_G_geniRoot__gr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.sliceAuthority <- SA
+attr="[keyid:$gr].role:sliceAuthority <- [keyid:$sa]"
+name=${sidx}_GR_sliceAuthority__sa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.identityProvider <- IDP
+attr="[keyid:$gr].role:identityProvider <- [keyid:$idp]"
+name=${sidx}_GR_identityProvider__idp_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.projectAuthority <- PA
+attr="[keyid:$gr].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_GR_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# IDP.geniUser <- Drd
+idp_gUser drd
+
+# IDP.geniPI <- Drd
+attr="[keyid:$idp].role:geniPI <- [keyid:$drd]"
+name=${sidx}_IDP_geniPI__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## drd requesting a proj1 from pa
+# Drd.project <- 'proj1'
+attr="[keyid:$drd].oset:project <- [string:'proj1']"
+name=${sidx}_Drd_project__proj1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.standard <- 'proj1'
+attr="[keyid:$pa].oset:standard <- [string:'proj1']"
+name=${sidx}_PA_standard__proj1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.owner('proj1') <- Drd 
+attr="[keyid:$pa].role:owner([string:'proj1']) <- [keyid:$drd]"
+name=${sidx}_PA_owner_proj1__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.root('proj1') <-Drd
+attr="[keyid:$pa].role:root([string:'proj1']) <- [keyid:$drd]"
+name=${sidx}_PA_root_proj1__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
Index: examples/access_tests/creddy_prover/scenario_s2.sh
===================================================================
--- examples/access_tests/creddy_prover/scenario_s2.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/scenario_s2.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,208 @@
+#!/bin/sh 
+
+#####################################################################
+# scenario #2
+#     Explores relationship between project and member
+#
+#  Drd, a geniPI, created(owner of) projects 'proj1' and 'proj2'
+#  Drd grant Frank, a geniUser, member permission on 'proj1'
+#  Drd grant Dan, a geniUser, member_ permission on 'proj1'
+#  Drd grant Jim, a geniUser, delegate_member_ permission on 'proj1'
+#  Jim grant Nancy, a geniUser, member_ permission on 'proj1'
+#  PA grant Lisa, a geniUser, member permission on 'proj1'
+#  PA grant Dan, a geniUser, member_ permission on 'proj1'
+#  PA grant Dan, a geniUser, member_ permission on 'proj2'
+#  PA grant Cary, a geniUser, delegate_member_ permission on 'proj1'
+#  PA grant Alice, a geniUser, member_ permission on 'proj2'
+#  PA grant Alice, a geniUser, member_ permission on 'proj1'
+#
+unset ABAC_CN
+keyloc=`pwd`
+sidx=s2
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho GR
+makeWho IDP
+makeWho EXO
+makeWho Drd
+makeWho Frank
+makeWho Dan
+makeWho Lisa
+makeWho Cary
+makeWho Jim
+makeWho Nancy
+makeWho Alice
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+gr=`creddy --keyid --cert $keyloc/GR_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+idp=`creddy --keyid --cert $keyloc/IDP_ID.pem`
+exo=`creddy --keyid --cert $keyloc/EXO_ID.pem`
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+cary=`creddy --keyid --cert $keyloc/Cary_ID.pem`
+jim=`creddy --keyid --cert $keyloc/Jim_ID.pem`
+nancy=`creddy --keyid --cert $keyloc/Nancy_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+
+pname=${sidx}_yap_clauses
+namespace=access1
+sfile=sfile_${sidx}
+
+idp_gUser()
+{
+eval "namename=[keyid:\$$1]"
+attr="[keyid:$idp].role:geniUser <- $namename"
+name=${sidx}_IDP_gUser__$1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+## drd requesting a proj1 from pa
+## makeProject $drd proj1 Drd
+makeProject() {
+   what="'$2'"
+# Drd.project <- 'proj1'
+   attr="[keyid:$1].oset:project <- [string:$what]"
+   name=${sidx}_$3_project__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.standard <- 'proj1'
+   attr="[keyid:$pa].oset:standard <- [string:$what]"
+   name=${sidx}_PA_standard__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.owner('proj1') <- Drd
+   attr="[keyid:$pa].role:owner([string:$what]) <- [keyid:$1]"
+   name=${sidx}_PA_owner_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.root('proj1') <-Drd
+   attr="[keyid:$pa].role:root([string:$what]) <- [keyid:$1]"
+   name=${sidx}_PA_root_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+###############################################################################
+echo "s/$g/G/g "  > $sfile 
+echo "s/$gr/GR/g "  >> $sfile 
+echo "s/$pa/PA/g "  >> $sfile
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$idp/IDP/g "  >> $sfile
+echo "s/$exo/EXO/g "  >> $sfile
+echo "s/$drd/Drd/g "  >> $sfile
+echo "s/$frank/Frank/g "  >> $sfile
+echo "s/$dan/Dan/g "  >> $sfile
+echo "s/$lisa/Lisa/g "  >> $sfile
+echo "s/$cary/Cary/g "  >> $sfile
+echo "s/$jim/Jim/g "  >> $sfile
+echo "s/$nancy/Nancy/g "  >> $sfile
+echo "s/$alice/Alice/g "  >> $sfile
+
+# G.geniRoot <- GR 
+attr="[keyid:$g].role:geniRoot <- [keyid:$gr]"
+name=${sidx}_G_geniRoot__gr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.sliceAuthorith <- SA
+attr="[keyid:$gr].role:sliceAuthority <- [keyid:$sa]"
+name=${sidx}_GR_sliceAuthority__sa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.identityProvider <- IDP
+attr="[keyid:$gr].role:identityProvider <- [keyid:$idp]"
+name=${sidx}_GR_identityProvider__idp_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.projectAuthority <- PA
+attr="[keyid:$gr].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_GR_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.aggregate <- EXO
+attr="[keyid:$gr].role:aggregate <- [keyid:$exo]"
+name=${sidx}_GR_aggregate__exo_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# IDP.geniUser <- Drd
+idp_gUser drd
+# IDP.geniUser <- Frank
+idp_gUser frank
+# IDP.geniUser <- Dan
+idp_gUser dan
+# IDP.geniUser <- Lisa
+idp_gUser lisa
+# IDP.geniUser <- Cary
+idp_gUser cary
+# IDP.geniUser <- Jim
+idp_gUser jim
+# IDP.geniUser <- Nancy
+idp_gUser nancy
+# IDP.geniUser <- Alice
+idp_gUser alice 
+
+# IDP.geniPI <- Drd
+attr="[keyid:$idp].role:geniPI <- [keyid:$drd]"
+name=${sidx}_IDP_geniPI__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## drd requesting a proj1 from pa
+makeProject $drd proj1 Drd
+## drd requesting a proj2 from pa
+makeProject $drd proj2 Drd
+
+## Drd gives member permission on proj1 to Frank
+attr="[keyid:$drd].role:member([string:'proj1']) <- [keyid:$frank]"
+name=${sidx}_Drd_member_proj1__frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives member_ permission on proj1 to Dan
+attr="[keyid:$drd].role:member_([string:'proj1']) <- [keyid:$dan]"
+name=${sidx}_Drd_memberDel_proj1__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives a delegate_member_ permission on proj1 to Jim
+attr="[keyid:$drd].role:delegate_member_([string:'proj1']) <- [keyid:$jim]"
+name=${sidx}_Drd_delmemberDel_proj1__jim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Jim gives a member_ permission on proj1 to Nancy
+attr="[keyid:$jim].role:member_([string:'proj1']) <- [keyid:$nancy]"
+name=${sidx}_Jim_memberDel_proj1__nancy_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives member permission on proj1 to Lisa 
+attr="[keyid:$pa].role:member([string:'proj1']) <- [keyid:$lisa]"
+name=${sidx}_PA_member_proj1__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives member_ permission on proj1 to Dan
+attr="[keyid:$pa].role:member_([string:'proj2']) <- [keyid:$dan]"
+name=${sidx}_PA_memberDel_proj2__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives a delegate_member_ permission on proj1 to Cary
+attr="[keyid:$pa].role:delegate_member_([string:'proj1']) <- [keyid:$cary]"
+name=${sidx}_PA_delmemberDel_proj1__cary_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives member_ permission on proj1 to Dan
+attr="[keyid:$pa].role:member_([string:'proj1']) <- [keyid:$dan]"
+name=${sidx}_PA_memberDel_proj1__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives member_ permission on proj2 to Alice
+attr="[keyid:$pa].role:member_([string:'proj2']) <- [keyid:$alice]"
+name=${sidx}_PA_memberDel_proj2__alice_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives member_ permission on proj1 to Alice
+attr="[keyid:$pa].role:member_([string:'proj1']) <- [keyid:$alice]"
+name=${sidx}_PA_memberDel_proj1__alice_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
+
Index: examples/access_tests/creddy_prover/scenario_s3.sh
===================================================================
--- examples/access_tests/creddy_prover/scenario_s3.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/scenario_s3.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,250 @@
+#!/bin/sh 
+
+#####################################################################
+# scenario #3
+#     Explores relationship between project and qualified member
+#
+#  Drd, a geniPI, created a project 'proj1' and 'proj2'
+#  Drd grants memberQ/info to Lisa on proj1, memberQ/stop to James on proj1
+#  Drd grants memberQ_/info and memberQ_/stop to Tim
+#  Drd grants delegate_memberQ_/info to John and 
+#                                 delegate_memberQ_/instantiate to Tim
+#  PA grants member/info to Tim
+#  PA grants memberQ/info and memberQ/stop to Dan
+#  PA grants memberQ_/info and memberQ_/stop to Frank and
+#           memberQ_/instantiate to Frank
+#  PA grants delegate_memberQ_/info to James and delegate_memberQ_/stop to Lisa
+#  PA grants delegate_memberQ_/info (proj2) to John
+#  John grants memberQ_/info (proj2) to James
+#  John grants memberQ/info (proj2) to Joe
+#
+unset ABAC_CN
+keyloc=`pwd`
+sidx=s3
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho GR
+makeWho IDP
+makeWho EXO
+makeWho Drd
+makeWho Frank
+makeWho Dan
+makeWho Lisa
+makeWho John
+makeWho Joe
+makeWho Tim
+makeWho James
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+gr=`creddy --keyid --cert $keyloc/GR_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+idp=`creddy --keyid --cert $keyloc/IDP_ID.pem`
+exo=`creddy --keyid --cert $keyloc/EXO_ID.pem`
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+john=`creddy --keyid --cert $keyloc/John_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+tim=`creddy --keyid --cert $keyloc/Tim_ID.pem`
+james=`creddy --keyid --cert $keyloc/James_ID.pem`
+
+pname=${sidx}_yap_clauses
+namespace=access1
+sfile=sfile_${sidx}
+
+idp_gUser()
+{
+eval "namename=[keyid:\$$1]"
+attr="[keyid:$idp].role:geniUser <- $namename"
+name=${sidx}_IDP_gUser__$1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+## drd requesting a proj1 from pa
+## makeProject $drd proj1 Drd
+makeProject() {
+   what="'$2'"
+# Drd.project <- 'proj1'
+   attr="[keyid:$1].oset:project <- [string:$what]"
+   name=${sidx}_$3_project__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.standard <- 'proj1'
+   attr="[keyid:$pa].oset:standard <- [string:$what]"
+   name=${sidx}_PA_standard__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.owner('proj1') <- Drd
+   attr="[keyid:$pa].role:owner([string:$what]) <- [keyid:$1]"
+   name=${sidx}_PA_owner_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.root('proj1') <-Drd
+   attr="[keyid:$pa].role:root([string:$what]) <- [keyid:$1]"
+   name=${sidx}_PA_root_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+###############################################################################
+echo "s/$g/G/g "  > $sfile 
+echo "s/$gr/GR/g "  >> $sfile 
+echo "s/$pa/PA/g "  >> $sfile
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$idp/IDP/g "  >> $sfile
+echo "s/$exo/EXO/g "  >> $sfile
+echo "s/$drd/Drd/g "  >> $sfile
+echo "s/$frank/Frank/g "  >> $sfile
+echo "s/$dan/Dan/g "  >> $sfile
+echo "s/$lisa/Lisa/g "  >> $sfile
+echo "s/$john/John/g "  >> $sfile 
+echo "s/$joe/Joe/g "  >> $sfile
+echo "s/$tim/Tim/g "  >> $sfile
+echo "s/$james/James/g "  >> $sfile
+
+# G.geniRoot <- GR 
+attr="[keyid:$g].role:geniRoot <- [keyid:$gr]"
+name=${sidx}_G_geniRoot__gr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.sliceAuthorithority <- SA
+attr="[keyid:$gr].role:sliceAuthority <- [keyid:$sa]"
+name=${sidx}_GR_sliceAuthority__sa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.identityProvider <- IDP
+attr="[keyid:$gr].role:identityProvider <- [keyid:$idp]"
+name=${sidx}_GR_identityProvider__idp_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.projectAuthority <- PA
+attr="[keyid:$gr].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_GR_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.aggregate <- EXO
+attr="[keyid:$gr].role:aggregate <- [keyid:$exo]"
+name=${sidx}_GR_aggregate__exo_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# IDP.geniUser <- Drd
+idp_gUser drd
+# IDP.geniUser <- Frank
+idp_gUser frank
+# IDP.geniUser <- Dan
+idp_gUser dan
+# IDP.geniUser <- Lisa
+idp_gUser lisa
+# IDP.geniUser <- John
+idp_gUser john
+# IDP.geniUser <- Joe
+idp_gUser joe
+# IDP.geniUser <- Tim
+idp_gUser tim 
+# IDP.geniUser <- James
+idp_gUser james
+
+# IDP.geniPI <- Drd
+attr="[keyid:$idp].role:geniPI <- [keyid:$drd]"
+name=${sidx}_IDP_geniPI__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## drd requesting a proj2 from pa
+makeProject $drd proj2 Drd
+## drd requesting a proj1 from pa
+makeProject $drd proj1 Drd
+
+## PA gives member permission on proj1 to Tim
+attr="[keyid:$pa].role:member([string:'proj1']) <- [keyid:$tim]"
+name=${sidx}_PA_member_proj1__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives memberQ/info permission on proj1 to Dan
+attr="[keyid:$pa].role:memberQ([string:'proj1'],[string:'info']) <- [keyid:$dan]"
+name=${sidx}_PA_memberQ_proj1_info__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives memberQ/stop permission on proj1 to Dan
+attr="[keyid:$pa].role:memberQ([string:'proj1'],[string:'stop']) <- [keyid:$dan]"
+name=${sidx}_PA_memberQ_proj1_stop__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives memberQ/instantiate permission on proj1 to Frank
+attr="[keyid:$pa].role:memberQ([string:'proj1'],[string:'instantiate']) <- [keyid:$frank]"
+name=${sidx}_PA_memberQ_proj1_instantiate__frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives memberQ_/info permission on proj1 to Frank
+attr="[keyid:$pa].role:memberQ_([string:'proj1'],[string:'info']) <- [keyid:$frank]"
+name=${sidx}_PA_memberQDel_proj1__info_frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives memberQ_/stop permission on proj1 to Frank
+attr="[keyid:$pa].role:memberQ_([string:'proj1'],[string:'stop']) <- [keyid:$frank]"
+name=${sidx}_PA_memberQDel_proj1__stop_frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives memberQ_/instantiate permission on proj1 to John
+attr="[keyid:$pa].role:memberQ_([string:'proj1'],[string:'instantiate']) <- [keyid:$john]"
+name=${sidx}_PA_memberQDel_proj1_instantiate__john_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives delegate_memberQ_/info permission on proj1 to James
+attr="[keyid:$pa].role:delegate_memberQ_([string:'proj1'],[string:'info']) <- [keyid:$james]"
+name=${sidx}_PA_delmemberQDel_proj1_info__james_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## PA gives delegate_memberQ_/stop permission on proj1 to Lisa
+attr="[keyid:$pa].role:delegate_memberQ_([string:'proj1'],[string:'stop']) <- [keyid:$lisa]"
+name=${sidx}_PA_delmemberQDel_proj1_stop__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives memberQ/info permission on proj1 to Lisa
+attr="[keyid:$drd].role:memberQ([string:'proj1'],[string:'info']) <- [keyid:$lisa]"
+name=${sidx}_Drd_memberQ_proj1_info__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives memberQ/stop permission on proj1 to James
+attr="[keyid:$drd].role:memberQ([string:'proj1'],[string:'stop']) <- [keyid:$james]"
+name=${sidx}_Drd_memberQ_proj1_stop__james_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives memberQ_/info permission on proj1 to Tim
+attr="[keyid:$drd].role:memberQ_([string:'proj1'],[string:'info']) <- [keyid:$tim]"
+name=${sidx}_Drd_memberQDel_proj1_info__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives memberQ_/stop permission on proj1 to Tim
+attr="[keyid:$drd].role:memberQ_([string:'proj1'],[string:'stop']) <- [keyid:$tim]"
+name=${sidx}_Drd_memberQDel_proj1_stop__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives delegate_memberQ_/info permission on proj1 to John
+attr="[keyid:$drd].role:delegate_memberQ_([string:'proj1'],[string:'info']) <- [keyid:$john]"
+name=${sidx}_Drd_delmemberQDel_proj1_info__john_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives delegate_memberQ_/instantiate permission on proj1 to Tim
+attr="[keyid:$drd].role:delegate_memberQ_([string:'proj1'],[string:'instantiate']) <- [keyid:$tim]"
+name=${sidx}_Drd_delmemberQDel_proj1_instantiate__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
+## PA gives info delegate_memberQ_/info permission on proj2 to John 
+attr="[keyid:$pa].role:delegate_memberQ_([string:'proj2'],[string:'info']) <- [keyid:$john]"
+name=${sidx}_Drd_delmemberQDel_proj2_info__john_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## John gives memberQ_/info permission on proj2 to James 
+attr="[keyid:$john].role:memberQ_([string:'proj2'],[string:'info']) <- [keyid:$james]"
+name=${sidx}_PA_memberQDel_proj2_info__james_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## John gives memberQ/info permission on proj2 to Joe 
+attr="[keyid:$john].role:memberQ([string:'proj2'],[string:'info']) <- [keyid:$joe]"
+name=${sidx}_PA_memberQ_proj2_info__joe_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
Index: examples/access_tests/creddy_prover/scenario_s4.sh
===================================================================
--- examples/access_tests/creddy_prover/scenario_s4.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/scenario_s4.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,208 @@
+#!/bin/sh 
+
+#####################################################################
+# scenario #4
+#     Explores relationship between slice and controls
+#
+#  Drd, a geniPI, created(owner of) slices 'sliceA' and 'sliceB'
+#  Drd grant Frank, a geniUser, controls permission on 'sliceA'
+#  Drd grant Dan, a geniUser, controls_ permission on 'sliceA'
+#  Drd grant Jim, a geniUser, delegate_controls_ permission on 'sliceA'
+#  Jim grant Nancy, a geniUser, controls_ permission on 'sliceA'
+#  SA grant Lisa, a geniUser, controls permission on 'sliceA'
+#  SA grant Dan, a geniUser, controls_ permission on 'sliceA'
+#  SA grant Dan, a geniUser, controls_ permission on 'sliceB'
+#  SA grant Cary, a geniUser, delegate_controls_ permission on 'sliceA'
+#  SA grant Alice, a geniUser, controls_ permission on 'sliceB'
+#  SA grant Alice, a geniUser, controls_ permission on 'sliceA'
+#
+unset ABAC_CN
+keyloc=`pwd`
+sidx=s4
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho GR
+makeWho IDP
+makeWho EXO
+makeWho Drd
+makeWho Frank
+makeWho Dan
+makeWho Lisa
+makeWho Cary
+makeWho Jim
+makeWho Nancy
+makeWho Alice
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+gr=`creddy --keyid --cert $keyloc/GR_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+idp=`creddy --keyid --cert $keyloc/IDP_ID.pem`
+exo=`creddy --keyid --cert $keyloc/EXO_ID.pem`
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+cary=`creddy --keyid --cert $keyloc/Cary_ID.pem`
+jim=`creddy --keyid --cert $keyloc/Jim_ID.pem`
+nancy=`creddy --keyid --cert $keyloc/Nancy_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+
+pname=${sidx}_yap_clauses
+namespace=access1
+sfile=sfile_${sidx}
+
+idp_gUser()
+{
+eval "namename=[keyid:\$$1]"
+attr="[keyid:$idp].role:geniUser <- $namename"
+name=${sidx}_IDP_gUser__$1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+## drd requesting a sliceA from ps
+## makeSlice $drd sliceA Drd
+makeSlice() {
+   what="'$2'"
+# Drd.slice <- 'sliceA'
+   attr="[keyid:$1].oset:slice <- [string:$what]"
+   name=${sidx}_$3_slice__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.standard <- 'sliceA'
+   attr="[keyid:$sa].oset:standard <- [string:$what]"
+   name=${sidx}_SA_standard__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.owner('sliceA') <- Drd
+   attr="[keyid:$sa].role:owner([string:$what]) <- [keyid:$1]"
+   name=${sidx}_SA_owner_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.root('sliceA') <-Drd
+   attr="[keyid:$sa].role:root([string:$what]) <- [keyid:$1]"
+   name=${sidx}_SA_root_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+###############################################################################
+echo "s/$g/G/g "  > $sfile 
+echo "s/$gr/GR/g "  >> $sfile 
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$idp/IDP/g "  >> $sfile
+echo "s/$exo/EXO/g "  >> $sfile
+echo "s/$drd/Drd/g "  >> $sfile
+echo "s/$frank/Frank/g "  >> $sfile
+echo "s/$dan/Dan/g "  >> $sfile
+echo "s/$lisa/Lisa/g "  >> $sfile
+echo "s/$cary/Cary/g "  >> $sfile
+echo "s/$jim/Jim/g "  >> $sfile
+echo "s/$nancy/Nancy/g "  >> $sfile
+echo "s/$alice/Alice/g "  >> $sfile
+
+# G.geniRoot <- GR 
+attr="[keyid:$g].role:geniRoot <- [keyid:$gr]"
+name=${sidx}_G_geniRoot__gr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.sliceAuthority <- SA
+attr="[keyid:$gr].role:sliceAuthority <- [keyid:$sa]"
+name=${sidx}_GR_sliceAuthority__sa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.identityProvider <- IDP
+attr="[keyid:$gr].role:identityProvider <- [keyid:$idp]"
+name=${sidx}_GR_identityProvider__idp_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.projectAuthority <- PA
+attr="[keyid:$gr].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_GR_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.aggregate <- EXO
+attr="[keyid:$gr].role:aggregate <- [keyid:$exo]"
+name=${sidx}_GR_aggregate__exo_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# IDP.geniUser <- Drd
+idp_gUser drd
+# IDP.geniUser <- Frank
+idp_gUser frank
+# IDP.geniUser <- Dan
+idp_gUser dan
+# IDP.geniUser <- Lisa
+idp_gUser lisa
+# IDP.geniUser <- Cary
+idp_gUser cary
+# IDP.geniUser <- Jim
+idp_gUser jim
+# IDP.geniUser <- Nancy
+idp_gUser nancy
+# IDP.geniUser <- Alice
+idp_gUser alice 
+
+# IDP.geniPI <- Drd
+attr="[keyid:$idp].role:geniPI <- [keyid:$drd]"
+name=${sidx}_IDP_geniPI__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## drd requesting a sliceA from sa
+makeSlice $drd sliceA Drd
+## drd requesting a sliceB from sa 
+makeSlice $drd sliceB Drd
+
+## Drd gives controls permission on sliceA to Frank
+attr="[keyid:$drd].role:controls([string:'sliceA']) <- [keyid:$frank]"
+name=${sidx}_Drd_controls_sliceA__frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives controls_ permission on sliceA to Dan
+attr="[keyid:$drd].role:controls_([string:'sliceA']) <- [keyid:$dan]"
+name=${sidx}_Drd_controlsDel_sliceA__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives a delegate_controls_ permission on sliceA to Jim
+attr="[keyid:$drd].role:delegate_controls_([string:'sliceA']) <- [keyid:$jim]"
+name=${sidx}_Drd_delcontrolsDel_sliceA__jim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Jim gives a controls_ permission on sliceA to Nancy
+attr="[keyid:$jim].role:controls_([string:'sliceA']) <- [keyid:$nancy]"
+name=${sidx}_Jim_controlsDel_sliceA__nancy_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controls permission on sliceA to Lisa 
+attr="[keyid:$sa].role:controls([string:'sliceA']) <- [keyid:$lisa]"
+name=${sidx}_SA_controls_sliceA__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controls_ permission on sliceA to Dan
+attr="[keyid:$sa].role:controls_([string:'sliceB']) <- [keyid:$dan]"
+name=${sidx}_SA_controlsDel_sliceB__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives a delegate_controls_ permission on sliceA to Cary
+attr="[keyid:$sa].role:delegate_controls_([string:'sliceA']) <- [keyid:$cary]"
+name=${sidx}_SA_delcontrolsDel_sliceA__cary_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controls_ permission on sliceA to Dan
+attr="[keyid:$sa].role:controls_([string:'sliceA']) <- [keyid:$dan]"
+name=${sidx}_SA_controlsDel_sliceA__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controls_ permission on sliceB to Alice
+attr="[keyid:$sa].role:controls_([string:'sliceB']) <- [keyid:$alice]"
+name=${sidx}_SA_controlsDel_sliceB__alice_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controls_ permission on sliceA to Alice
+attr="[keyid:$sa].role:controls_([string:'sliceA']) <- [keyid:$alice]"
+name=${sidx}_SA_controlsDel_sliceA__alice_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
+
Index: examples/access_tests/creddy_prover/scenario_s5.sh
===================================================================
--- examples/access_tests/creddy_prover/scenario_s5.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/scenario_s5.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,261 @@
+#!/bin/sh 
+
+#####################################################################
+# scenario #5
+#     Explores relationship between slice and qualified controls
+#
+#  Drd, a geniPI, created slices 'sliceA' and 'sliceB'
+#  Drd grants controlsQ/info to Lisa
+#  Drd grants controlsQ_/info and controlsQ_/stop to Tim
+#  Drd grants delegate_controlsQ_/info to John and 
+#                                 delegate_controlsQ_/instantiate to Tim
+#  SA grants controlsQ/info and controlsQ/stop to Dan
+#  SA grants controlsQ_/info and controlsQ_/stop to Frank and
+#           controlsQ_/instantiate to Frank
+#  SA grants delegate_controlsQ_/info to James and delegate_controlsQ_/stop to Lisa
+#  SA grants delegate_controlsQ_/info (sliceB) to John
+#  SA grants controls(sliceB) to Dan
+#  SA grants delegate_controls_(sliceB) to Lisa
+#  John grants controlsQ_/info (sliceB) to James
+#  John grants controlsQ/info (sliceB) to Joe
+#
+unset ABAC_CN
+keyloc=`pwd`
+sidx=s5
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho GR
+makeWho IDP
+makeWho EXO
+makeWho Drd
+makeWho Frank
+makeWho Dan
+makeWho Lisa
+makeWho John
+makeWho Joe
+makeWho Tim
+makeWho James
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+gr=`creddy --keyid --cert $keyloc/GR_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+idp=`creddy --keyid --cert $keyloc/IDP_ID.pem`
+exo=`creddy --keyid --cert $keyloc/EXO_ID.pem`
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+john=`creddy --keyid --cert $keyloc/John_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+tim=`creddy --keyid --cert $keyloc/Tim_ID.pem`
+james=`creddy --keyid --cert $keyloc/James_ID.pem`
+
+pname=${sidx}_yap_clauses
+namespace=access1
+sfile=sfile_${sidx}
+
+idp_gUser()
+{
+eval "namename=[keyid:\$$1]"
+attr="[keyid:$idp].role:geniUser <- $namename"
+name=${sidx}_IDP_gUser__$1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+## drd requesting a sliceA from sa
+## makeSlice $drd sliceA Drd
+makeSlice() {
+   what="'$2'"
+# Drd.slice <- 'sliceA'
+   attr="[keyid:$1].oset:slice <- [string:$what]"
+   name=${sidx}_$3_slice__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.standard <- 'sliceA'
+   attr="[keyid:$sa].oset:standard <- [string:$what]"
+   name=${sidx}_SA_standard__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.owner('sliceA') <- Drd
+   attr="[keyid:$sa].role:owner([string:$what]) <- [keyid:$1]"
+   name=${sidx}_SA_owner_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.root('sliceA') <-Drd
+   attr="[keyid:$sa].role:root([string:$what]) <- [keyid:$1]"
+   name=${sidx}_SA_root_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+###############################################################################
+echo "s/$g/G/g "  > $sfile 
+echo "s/$gr/GR/g "  >> $sfile 
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$idp/IDP/g "  >> $sfile
+echo "s/$exo/EXO/g "  >> $sfile
+echo "s/$drd/Drd/g "  >> $sfile
+echo "s/$frank/Frank/g "  >> $sfile
+echo "s/$dan/Dan/g "  >> $sfile
+echo "s/$lisa/Lisa/g "  >> $sfile
+echo "s/$john/John/g "  >> $sfile 
+echo "s/$joe/Joe/g "  >> $sfile
+echo "s/$tim/Tim/g "  >> $sfile
+echo "s/$james/James/g "  >> $sfile
+
+# G.geniRoot <- GR 
+attr="[keyid:$g].role:geniRoot <- [keyid:$gr]"
+name=${sidx}_G_geniRoot__gr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.sliceAuthorithority <- SA
+attr="[keyid:$gr].role:sliceAuthority <- [keyid:$sa]"
+name=${sidx}_GR_sliceAuthority__sa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.identityProvider <- IDP
+attr="[keyid:$gr].role:identityProvider <- [keyid:$idp]"
+name=${sidx}_GR_identityProvider__idp_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.projectAuthority <- PA
+attr="[keyid:$gr].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_GR_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.aggregate <- EXO
+attr="[keyid:$gr].role:aggregate <- [keyid:$exo]"
+name=${sidx}_GR_aggregate__exo_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# IDP.geniUser <- Drd
+idp_gUser drd
+# IDP.geniUser <- Frank
+idp_gUser frank
+# IDP.geniUser <- Dan
+idp_gUser dan
+# IDP.geniUser <- Lisa
+idp_gUser lisa
+# IDP.geniUser <- John
+idp_gUser john
+# IDP.geniUser <- Joe
+idp_gUser joe
+# IDP.geniUser <- Tim
+idp_gUser tim 
+# IDP.geniUser <- James
+idp_gUser james
+
+# IDP.geniPI <- Drd
+attr="[keyid:$idp].role:geniPI <- [keyid:$drd]"
+name=${sidx}_IDP_geniPI__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## drd requesting a sliceB from sa
+makeSlice $drd sliceB Drd
+## drd requesting a sliceA from sa 
+makeSlice $drd sliceA Drd
+
+## SA gives controlsQ/info permission on sliceA to Dan
+attr="[keyid:$sa].role:controlsQ([string:'sliceA'],[string:'info']) <- [keyid:$dan]"
+name=${sidx}_SA_controlsQ_sliceA_info__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controlsQ/stop permission on sliceA to Dan
+attr="[keyid:$sa].role:controlsQ([string:'sliceA'],[string:'stop']) <- [keyid:$dan]"
+name=${sidx}_SA_controlsQ_sliceA_stop__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controlsQ/instantiate permission on sliceA to Frank
+attr="[keyid:$sa].role:controlsQ([string:'sliceA'],[string:'instantiate']) <- [keyid:$frank]"
+name=${sidx}_SA_controlsQ_sliceA_instantiate__frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controlsQ_/info permission on sliceA to Frank
+attr="[keyid:$sa].role:controlsQ_([string:'sliceA'],[string:'info']) <- [keyid:$frank]"
+name=${sidx}_SA_controlsQDel_sliceA__info_frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controlsQ_/stop permission on sliceA to Frank
+attr="[keyid:$sa].role:controlsQ_([string:'sliceA'],[string:'stop']) <- [keyid:$frank]"
+name=${sidx}_SA_controlsQDel_sliceA__stop_frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controlsQ_/instantiate permission on sliceA to John
+attr="[keyid:$sa].role:controlsQ_([string:'sliceA'],[string:'instantiate']) <- [keyid:$john]"
+name=${sidx}_SA_controlsQDel_sliceA_instantiate__john_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives delegate_controlsQ_/info permission on sliceA to James
+attr="[keyid:$sa].role:delegate_controlsQ_([string:'sliceA'],[string:'info']) <- [keyid:$james]"
+name=${sidx}_SA_delcontrolsQDel_sliceA_info__james_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives delegate_controlsQ_/stop permission on sliceA to Lisa
+attr="[keyid:$sa].role:delegate_controlsQ_([string:'sliceA'],[string:'stop']) <- [keyid:$lisa]"
+name=${sidx}_SA_delcontrolsQDel_sliceA_stop__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA gives controls permission on sliceB to Dan
+attr="[keyid:$sa].role:controls([string:'sliceB']) <- [keyid:$dan]"
+name=${sidx}_SA_controls_sliceB__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+#  SA grants delegate_controls_(sliceB) to Lisa
+attr="[keyid:$sa].role:delegate_controls_([string:'sliceB']) <- [keyid:$lisa]"
+name=${sidx}_SA_delcontrols_sliceB__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives controlsQ/info permission on sliceA to Lisa
+attr="[keyid:$drd].role:controlsQ([string:'sliceA'],[string:'info']) <- [keyid:$lisa]"
+name=${sidx}_Drd_controlsQ_sliceA_info__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives controlsQ/stop permission on sliceA to James
+attr="[keyid:$drd].role:controlsQ([string:'sliceA'],[string:'stop']) <- [keyid:$james]"
+name=${sidx}_Drd_controlsQ_sliceA_stop__james_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives controlsQ_/info permission on sliceA to Tim
+attr="[keyid:$drd].role:controlsQ_([string:'sliceA'],[string:'info']) <- [keyid:$tim]"
+name=${sidx}_Drd_controlsQDel_sliceA_info__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives controlsQ/info permission on sliceA to Lisa
+attr="[keyid:$drd].role:controlsQ([string:'sliceA'],[string:'info']) <- [keyid:$lisa]"
+name=${sidx}_Drd_controlsQ_sliceA_info__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives controlsQ_/stop permission on sliceA to Tim
+attr="[keyid:$drd].role:controlsQ_([string:'sliceA'],[string:'stop']) <- [keyid:$tim]"
+name=${sidx}_Drd_controlsQDel_sliceA_stop__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives delegate_controlsQ_/info permission on sliceA to John
+attr="[keyid:$drd].role:delegate_controlsQ_([string:'sliceA'],[string:'info']) <- [keyid:$john]"
+name=${sidx}_Drd_delcontrolsQDel_sliceA_info__john_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives delegate_controlsQ_/instantiate permission on sliceA to Tim
+attr="[keyid:$drd].role:delegate_controlsQ_([string:'sliceA'],[string:'instantiate']) <- [keyid:$tim]"
+name=${sidx}_Drd_delcontrolsQDel_sliceA_instantiate__tim_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
+## SA gives info delegate_controlsQ_/info permission on sliceB to John 
+attr="[keyid:$sa].role:delegate_controlsQ_([string:'sliceB'],[string:'info']) <- [keyid:$john]"
+name=${sidx}_Drd_delcontrolsQDel_sliceB_info__john_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## John gives controlsQ_/info permission on sliceB to James 
+attr="[keyid:$john].role:controlsQ_([string:'sliceB'],[string:'info']) <- [keyid:$james]"
+name=${sidx}_SA_controlsQDel_sliceB_info__james_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## John gives controlsQ/info permission on sliceB to Joe 
+attr="[keyid:$john].role:controlsQ([string:'sliceB'],[string:'info']) <- [keyid:$joe]"
+name=${sidx}_SA_controlsQ_sliceB_info__joe_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
Index: examples/access_tests/creddy_prover/scenario_s6.sh
===================================================================
--- examples/access_tests/creddy_prover/scenario_s6.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/scenario_s6.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,203 @@
+#!/bin/sh 
+
+#####################################################################
+# scenario #6
+#     Explores relationship between slice, createSlice, and gmoc and 
+#     projects
+#
+# Drd is the owner of proj1, a standard project
+# Drd grants memberQ/instantiate permission to Dan
+# Drd grants memberQ/info permission to Frank
+# SA let Dan be a geniProxy
+# SA accepts PA as the projectAuthority
+# SA accepts Alice as a gmoc
+# SA accepts SliceA as a stadard slice and proj1 as standard project
+# SA let Dan speaks for Drd
+# Lisa is a geniProxy and speaks for Frank
+#
+unset ABAC_CN
+keyloc=`pwd`
+sidx=s6
+
+makeWho() {
+    WHO=$1
+    rm -rf ${WHO}_*.pem
+    creddy --generate --cn ${WHO}
+}
+makeWho GR
+makeWho IDP
+makeWho EXO
+makeWho GM
+makeWho Drd
+makeWho Dan
+makeWho Frank
+makeWho Alice
+makeWho Lisa
+
+g=`creddy --keyid --cert $keyloc/G_ID.pem`
+gr=`creddy --keyid --cert $keyloc/GR_ID.pem`
+pa=`creddy --keyid --cert $keyloc/PA_ID.pem`
+sa=`creddy --keyid --cert $keyloc/SA_ID.pem`
+idp=`creddy --keyid --cert $keyloc/IDP_ID.pem`
+exo=`creddy --keyid --cert $keyloc/EXO_ID.pem`
+gm=`creddy --keyid --cert $keyloc/GM_ID.pem`
+drd=`creddy --keyid --cert $keyloc/Drd_ID.pem`
+dan=`creddy --keyid --cert $keyloc/Dan_ID.pem`
+frank=`creddy --keyid --cert $keyloc/Frank_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+lisa=`creddy --keyid --cert $keyloc/Lisa_ID.pem`
+
+pname=${sidx}_yap_clauses
+namespace=access1
+sfile=sfile_${sidx}
+
+sa_gUser()
+{
+eval "namename=[keyid:\$$1]"
+attr="[keyid:$sa].role:geniUser <- $namename"
+name=${sidx}_SA_gUser__$1_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+## drd requesting a sliceA from sa 
+## makeSlice $drd proj1 sliceA Drd
+makeSlice() {
+   proj="'$2'"
+   what="'$3'"
+# SA.qualifiedProject <- 'proj1'
+   attr="[keyid:$sa].oset:qualifiedProject <- [string:$proj]"
+   name=${sidx}_SA_qualProject__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.inProject('proj1') <- 'sliceA'
+   attr="[keyid:$sa].oset:inProject([string:$proj]) <- [string:$what]"
+   name=${sidx}_SA_inProject_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# Drd.slice <- 'sliceA'
+   attr="[keyid:$1].oset:slice <- [string:$what]"
+   name=${sidx}_$4_slice__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.standard <- 'sliceA'
+   attr="[keyid:$sa].oset:standard <- [string:$what]"
+   name=${sidx}_SA_standard__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.owner('sliceA') <- Drd
+   attr="[keyid:$sa].role:owner([string:$what]) <- [keyid:$1]"
+   name=${sidx}_SA_owner_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# SA.root('sliceA') <-Drd
+   attr="[keyid:$sa].role:root([string:$what]) <- [keyid:$1]"
+   name=${sidx}_SA_root_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+## drd requesting a proj1 from pa
+## makeProject $drd proj1 Drd
+makeProject() {
+   what="'$2'"
+# Drd.project <- 'proj1'
+   attr="[keyid:$1].oset:project <- [string:$what]"
+   name=${sidx}_$3_project__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.standard <- 'proj1'
+   attr="[keyid:$pa].oset:standard <- [string:$what]"
+   name=${sidx}_PA_standard__$2_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.owner('proj1') <- Drd
+   attr="[keyid:$pa].role:owner([string:$what]) <- [keyid:$1]"
+   name=${sidx}_PA_owner_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+# PA.root('proj1') <-Drd
+   attr="[keyid:$pa].role:root([string:$what]) <- [keyid:$1]"
+   name=${sidx}_PA_root_$2__$3_attr.der
+   creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+}
+
+
+###############################################################################
+echo "s/$g/G/g "  > $sfile 
+echo "s/$gr/GR/g "  >> $sfile 
+echo "s/$sa/SA/g "  >> $sfile
+echo "s/$pa/PA/g "  >> $sfile
+echo "s/$idp/IDP/g "  >> $sfile
+echo "s/$exo/EXO/g "  >> $sfile
+echo "s/$gm/GM/g "  >> $sfile
+echo "s/$drd/Drd/g "  >> $sfile
+echo "s/$dan/Dan/g "  >> $sfile
+echo "s/$frank/Frank/g "  >> $sfile
+echo "s/$alice/Alice/g "  >> $sfile
+echo "s/$lisa/Lisa/g "  >> $sfile
+
+# SA.geniProxy <- Lisa
+attr="[keyid:$sa].role:geniProxy <- [keyid:$lisa]"
+name=${sidx}_SA_gProxy__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# G.geniRoot <- GR 
+attr="[keyid:$g].role:geniRoot <- [keyid:$gr]"
+name=${sidx}_G_geniRoot__gr_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.sliceAuthorithority <- SA
+attr="[keyid:$gr].role:sliceAuthority <- [keyid:$sa]"
+name=${sidx}_GR_sliceAuthority__sa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.identityProvider <- IDP
+attr="[keyid:$gr].role:identityProvider <- [keyid:$idp]"
+name=${sidx}_GR_identityProvider__idp_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# GR.projectAuthority <- PA
+attr="[keyid:$gr].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_GR_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+#???, SA trusts PA as the projectAuthority
+# SA.projectAuthority <- PA
+attr="[keyid:$sa].role:projectAuthority <- [keyid:$pa]"
+name=${sidx}_SA_projAuthority__pa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# SA.gmoc <- Alice
+attr="[keyid:$sa].role:gmoc <- [keyid:$alice]"
+name=${sidx}_SA_gmoc__alice_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
+# GR.aggregate <- EXO
+attr="[keyid:$gr].role:aggregate <- [keyid:$exo]"
+name=${sidx}_GR_aggregate__exo_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+# IDP.geniUser <- Drd
+sa_gUser drd
+sa_gUser dan
+sa_gUser frank
+
+makeProject $drd proj1 Drd
+makeSlice $drd proj1 sliceA Drd
+
+# IDP.geniPI <- Drd
+attr="[keyid:$idp].role:geniPI <- [keyid:$drd]"
+name=${sidx}_IDP_geniPI__drd_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives memberQ/instantiate permission on proj1 to Dan
+attr="[keyid:$drd].role:memberQ([string:'proj1'],[string:'instantiate']) <- [keyid:$dan]"
+name=${sidx}_PA_memberQ_proj1_instantiate__dan_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## Drd gives memberQ/info permission on proj1 to Frank
+attr="[keyid:$drd].role:memberQ([string:'proj1'],[string:'info']) <- [keyid:$frank]"
+name=${sidx}_PA_memberQ_proj1_info__frank_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+## SA let Dan speaks for Drd
+## SA.speaksFor(?C:(SA.projectAuthority).memberQ(?P, "instantiate"))
+attr="[keyid:$sa].role:speaksFor([keyid:$dan]) <- [keyid:$lisa]"
+name=${sidx}_SA_speaksfor_dan__lisa_attr.der
+creddy --attrnow --string "$attr" --out $name --out_prolog $pname --namespace $namespace
+
+
+
+
Index: examples/access_tests/creddy_prover/setup.sh
===================================================================
--- examples/access_tests/creddy_prover/setup.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/access_tests/creddy_prover/setup.sh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,9 @@
+#/bin/sh
+
+###############################
+#  setup.sh
+
+creddy --generate --cn G
+creddy --generate --cn PA 
+creddy --generate --cn SA
+
