Natural language policy
formalised as
Authorisation/Obligation Policy
combines with
Attack Schema class
to instantiate an
Attack Schema
devolved as
Detection Goals
(event, action, ...)