Index: examples/creddy_prover_tests/acme_multi_rt0/README
===================================================================
--- examples/creddy_prover_tests/acme_multi_rt0/README	(revision b07eb3a4b9f2c74bc9a5513aa03e413bfe949747)
+++ examples/creddy_prover_tests/acme_multi_rt0/README	(revision b07eb3a4b9f2c74bc9a5513aa03e413bfe949747)
@@ -0,0 +1,53 @@
+#!/bin/sh
+#
+# The example makes use of 2 principals, Acme and Coyote.
+#
+# This example shows a very simple delegation of roles by Acme with
+# multiple possible solution proofs.  Acme's buy_rockets role includes 
+# all of Acme's preferred customers and those with worst luck. The example
+# creates the principals and 4 credentials.  Credential 1 encodes the policy
+# that all of Acme's preferred customers can buy rockets from Acme and
+# Credential 2 defines the Coyote as an Acme preferred customer.
+# Credential 3 encodes the policy that all of Acme's worst lucked
+# can buy rockets from Acme and Credential 4 defines the Coyote as one of worst
+# lucked.
+
+# The ./run_query script issues queries to show that the Coyote is both a preferred
+# customer and can buy rockets and then continue to find the other solution proof
+# that Coyote is worst lucked and also can buy rocket from Acme.  Two invalid 
+# queries are also made, checking if Acme is the Coyote's friend, which it isn't
+# and whether a query about something other than a principal works (it doesn't).
+
+# acme_multi_rt0
+
+creddy --generate --cn Acme
+creddy --generate --cn Coyote
+
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+# Credential 1
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role buy_rockets \
+       --subject-cert Acme_ID.pem --subject-role preferred_customer \
+       --out Acme_buy_rockets__Acme_preferred_customer_attr.der
+
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+# Credential 2
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Coyote_ID.pem \
+       --out Acme_preferred_customer__Coyote_attr.der
+
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:worst_lucked 
+# Credential 3
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role buy_rockets \
+       --subject-cert Acme_ID.pem --subject-role worst_lucked \
+       --out Acme_buy_rockets__Acme_worst_lucked_attr.der
+
+#[keyid:Acme].role:worst_lucked <- [keyid:Coyote]
+# Credential 4
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role worst_lucked \
+       --subject-cert Coyote_ID.pem \
+       --out Acme_worst_lucked__Coyote_attr.der
+
Index: examples/creddy_prover_tests/acme_multi_rt0/run_query
===================================================================
--- examples/creddy_prover_tests/acme_multi_rt0/run_query	(revision b07eb3a4b9f2c74bc9a5513aa03e413bfe949747)
+++ examples/creddy_prover_tests/acme_multi_rt0/run_query	(revision b07eb3a4b9f2c74bc9a5513aa03e413bfe949747)
@@ -0,0 +1,51 @@
+
+# acme_rockets_rt0_typed
+
+pwd=`pwd`
+eloc=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: abac_prover_yap is not in the search path!!!"
+  exit 1
+fi
+keyloc=$pwd
+
+acme=`creddy --keyid --cert $keyloc/Acme_ID.pem`
+coyote=`creddy --keyid --cert $keyloc/Coyote_ID.pem`
+
+preferred_customer="[keyid:$acme].role:preferred_customer"
+buy_rockets="[keyid:$acme].role:buy_rockets"
+coyote_prin="[keyid:$coyote]"
+friend="[keyid:$acme].role:friend"
+acme_prin="[keyid:$acme]"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Acme].role:preferred_customer <-?- [keyid:Coyote]
+#isMember(pCoyote, role(pAcme,preferred_customer), C).
+echo "  "
+echo "===good============ Acme.preferred_customer <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc \
+      --role "$preferred_customer" --principal "$coyote_prin"
+
+#[keyid:Acme].role:buy_rockets <-?- [keyid:Coyote]
+#isMember(pCoyote, role(pAcme,buy_rockets), C).
+echo "  "
+echo "===good=============== Acme.buy_rockets <- Coyote"
+$eloc/abac_prover_yap  --all --keystore $keyloc \
+        --role "$buy_rockets" --principal "$coyote_prin"
+
+## this is not suppose to work
+#[keyid:Acme].role:buy_rockets <-?- [keyid:Acme].role:preferred_customer
+echo "  "
+echo "===bad=============== Acme.buy_rockets <- Acme.preferred_customer"
+$eloc/abac_prover_yap  --keystore $keyloc \
+        --role "$buy_rockets" --principal "$preferred_customer"
+
+#[keyid:Coyote].role:friend <-?- [keyid:Acme]
+#isMember(pAcme, role(pCoyote,friend), C).
+echo "  "
+echo "===bad=============== Coyote.friend <- Acme"
+$eloc/abac_prover_yap  --all --keystore $keyloc \
+        --role "$friend" --principal "$acme_prin"
+
