One error: for a sequence of strings, function string-length will return its length - an integer. Also - there is no need for a separate sequence-string data type. I think this is a bit of confusion here: As <AtributeDesignator> specifying xs:string type, may return sequence of strings, as well as one string - our functions ALWAYS should be ready to receive a sequence - it is not a separate data type. When there is only one value (in most cases) needed - it is a sequnce of size 1. In my proposal it may be <attributevalue type="xs:string"> <value>Jones</value> <value>Smith</value> </attributevalue> To specify Jones and Smith as convicted felons to use in (integer-equal 0 (string-length (intersection (attributedesignator name="name") ["Jones", "Smith"]). - to specify if any name matches anything in the list It will be <attributevalue type="xs:string"> <value>Engovatov</value> </attributevalue> To specify only one, to use in string-equal function (equal name "Engovatov") If there is only one convicted felon, it will have one value. This is to make it compatible with Designators and Selectors - you do not want to specify two differnet rules for the case when they return several values, or one value - I do not think it is possible. BTW - for those concerned that it is not user friendly to have all those X-length functions - nothing prohibits the management system to ma XACML language into something more user friendly - for example use length() function, that would map into one of type-length ones in the schema - as long as it is always done consistently.