From 101291d55e47679e578aff70f260d89d5aafb66a Mon Sep 17 00:00:00 2001
From: Martin Stemmer <52048213+Martin187187@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:12:52 +0200
Subject: [PATCH] init

---
 .../access-control-rules-attributes.svg       |  55 +++++--
 .../modules/ROOT/pages/access-rule-model.adoc | 129 ++++++++++++++-
 .../annex/json-access-rule-examples.adoc      |   6 +
 .../annex/text-access-rule-examples.adoc      |  33 ++++
 .../modules/ROOT/pages/changelog.adoc         |   1 +
 .../ROOT/partials/bnf/access-rules.bnf        |  58 +++++--
 .../modules/ROOT/partials/bnf/attributes.bnf  |   6 +
 .../modules/ROOT/partials/bnf/formulas.bnf    |  34 ++--
 .../partials/diagrams/access-rule-model.puml  |   7 +
 .../partials/examples/nested-claim-path.bnf   |  16 ++
 .../partials/examples/nested-claim-path.json  |  86 ++++++++++
 .../aas-queries-and-access-rules-schema.json  | 132 ++++++++++++++--
 .../ROOT/partials/json/access-rule-model.json |  24 +++
 .../formulas-and-logical-expressions.json     | 108 +++++++++++--
 tools/validate_spec_artifacts.py              | 148 +++++++++++++++++-
 15 files changed, 777 insertions(+), 66 deletions(-)
 create mode 100644 documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.bnf
 create mode 100644 documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.json

diff --git a/documentation/IDTA-01004/modules/ROOT/images/access-control-rules-attributes.svg b/documentation/IDTA-01004/modules/ROOT/images/access-control-rules-attributes.svg
index 96276e4..8c94329 100644
--- a/documentation/IDTA-01004/modules/ROOT/images/access-control-rules-attributes.svg
+++ b/documentation/IDTA-01004/modules/ROOT/images/access-control-rules-attributes.svg
@@ -3,7 +3,7 @@
   xmlns='http://www.w3.org/2000/svg'
   xmlns:xlink='http://www.w3.org/1999/xlink'
 
-  width='1000' height='700' viewBox='0 0 1000 700'>
+  width='1000' height='800' viewBox='0 0 1000 800'>
 
   <style>
     rect, line, path { stroke-width: 1.5px; stroke: black; fill: transparent; }
@@ -21,22 +21,26 @@
     <path d='M260.5 14 v12 m 4 0 v-12' class='station'/>
     <rect x='70' y='10' height='20' width='130' rx='0' ry='0' class='rule'/>
     <text x='135' y='25' text-anchor='middle' class='rule'>ClaimAttribute</text>
-    <rect x='70' y='40' height='20' width='130' rx='0' ry='0' class='rule'/>
-    <text x='135' y='55' text-anchor='middle' class='rule'>GlobalAttribute</text>
-    <rect x='60' y='70' height='20' width='150' rx='0' ry='0' class='rule'/>
-    <text x='135' y='85' text-anchor='middle' class='rule'>ReferenceAttribute</text>
-    <path d='M230 30 v40'/>
-    <path d='M210 80 h10 q10 0 10 -10'/>
-    <path d='M40 70 q0 10 10 10 h10'/>
-    <path d='M200 50 h20 q10 0 10 -10'/>
-    <path d='M40 40 q0 10 10 10 h20'/>
+    <rect x='60' y='40' height='20' width='150' rx='0' ry='0' class='rule'/>
+    <text x='135' y='55' text-anchor='middle' class='rule'>ClaimPathAttribute</text>
+    <rect x='70' y='70' height='20' width='130' rx='0' ry='0' class='rule'/>
+    <text x='135' y='85' text-anchor='middle' class='rule'>GlobalAttribute</text>
+    <rect x='60' y='100' height='20' width='150' rx='0' ry='0' class='rule'/>
+    <text x='135' y='115' text-anchor='middle' class='rule'>ReferenceAttribute</text>
+    <path d='M230 30 v70'/>
+    <path d='M210 110 h10 q10 0 10 -10'/>
+    <path d='M40 100 q0 10 10 10 h10'/>
+    <path d='M200 80 h20 q10 0 10 -10'/>
+    <path d='M40 70 q0 10 10 10 h20'/>
+    <path d='M210 50 h10 q10 0 10 -10'/>
+    <path d='M40 40 q0 10 10 10 h10'/>
     <path d='M230 30 q0 -10 10 -10'/>
     <path d='M200 20 h60'/>
-    <path d='M30 20 q10 0 10 10 v40'/>
+    <path d='M30 20 q10 0 10 10 v70'/>
     <path d='M10 20 h60'/>
   </g>
 
-  <g transform='translate(40 190)'>
+  <g transform='translate(40 220)'>
     <text x='-30' y='-10'>ClaimAttribute:</text>
     <path d='M5.5 14 v12 m 4 0 v-12' class='station'/>
     <path d='M530.5 14 v12 m 4 0 v-12' class='station'/>
@@ -64,7 +68,7 @@
     <path d='M10 20 h20'/>
   </g>
 
-  <g transform='translate(40 270)'>
+  <g transform='translate(40 300)'>
     <text x='-30' y='-10'>GlobalAttribute:</text>
     <path d='M5.5 14 v12 m 4 0 v-12' class='station'/>
     <path d='M590.5 14 v12 m 4 0 v-12' class='station'/>
@@ -107,7 +111,7 @@
     <path d='M10 20 h20'/>
   </g>
 
-  <g transform='translate(40 440)'>
+  <g transform='translate(40 470)'>
     <text x='-30' y='-10'>ReferenceAttribute:</text>
     <path d='M5.5 14 v12 m 4 0 v-12' class='station'/>
     <path d='M690.5 14 v12 m 4 0 v-12' class='station'/>
@@ -180,7 +184,28 @@
     <path d='M10 20 h90'/>
   </g>
 
-  <g transform='translate(40 610)'>
+  <g transform='translate(40 640)'>
+    <text x='-30' y='-10'>ClaimPathAttribute:</text>
+    <path d='M5.5 14 v12 m 4 0 v-12' class='station'/>
+    <path d='M570.5 14 v12 m 4 0 v-12' class='station'/>
+    <rect x='30' y='10' height='20' width='90' rx='8' ry='8' class='literal'/>
+    <text x='75' y='25' text-anchor='middle' class='literal'>CLAIMPATH</text>
+    <rect x='140' y='10' height='20' width='50' rx='0' ry='0' class='rule'/>
+    <text x='165' y='25' text-anchor='middle' class='rule'>Ws</text>
+    <rect x='210' y='10' height='20' width='20' rx='8' ry='8' class='literal'/>
+    <text x='220' y='25' text-anchor='middle' class='literal'>(</text>
+    <rect x='250' y='10' height='20' width='50' rx='0' ry='0' class='rule'/>
+    <text x='275' y='25' text-anchor='middle' class='rule'>Ws</text>
+    <rect x='320' y='10' height='20' width='130' rx='0' ry='0' class='rule'/>
+    <text x='385' y='25' text-anchor='middle' class='rule'>ClaimPathLiteral</text>
+    <rect x='470' y='10' height='20' width='50' rx='0' ry='0' class='rule'/>
+    <text x='495' y='25' text-anchor='middle' class='rule'>Ws</text>
+    <rect x='540' y='10' height='20' width='20' rx='8' ry='8' class='literal'/>
+    <text x='550' y='25' text-anchor='middle' class='literal'>)</text>
+    <path d='M120 20 h20 M190 20 h20 M230 20 h20 M300 20 h20 M450 20 h20 M520 20 h20 M560 20 h10 M10 20 h20'/>
+  </g>
+
+  <g transform='translate(40 720)'>
     <text x='-30' y='-10'>ClaimLiteral:</text>
     <path d='M5.5 14 v12 m 4 0 v-12' class='station'/>
     <path d='M160.5 14 v12 m 4 0 v-12' class='station'/>
diff --git a/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc b/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc
index c3e9eb2..43de642 100644
--- a/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc
+++ b/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc
@@ -379,17 +379,22 @@ image::access-control-rules-attributes.svg[width=642]
 Table <<table-attribute-types>> describes the available ABAC attribute types.
 
 [[table-attribute-types]]
-.<ClaimAttribute>, <GlobalAttribute> and <ReferenceAttribute>
+.<ClaimAttribute>, <ClaimPathAttribute>, <GlobalAttribute> and <ReferenceAttribute>
 [cols="1,3",options="header"]
 |===
 |Attribute enumeration
 |Description
 
 |`"CLAIM"`
-|ABAC attribute of the subject/requestor provided as a claim in the access token to the AAS interface (see xref:access-rule-model.adoc#access-tokens[Access token]).
+|ABAC attribute of the subject/requestor provided as a top-level claim in the access token to the AAS interface (see xref:access-rule-model.adoc#access-tokens[Access token]). The <ClaimLiteral> identifies the top-level claim by its member name. When used without a cast as a <StringOperand>, the selected claim value shall be a JSON string.
 
 EXAMPLE See xref:annex/text-access-rule-examples.adoc#example-authenticated-users[authenticated users] and xref:annex/text-access-rule-examples.adoc#example-business-partner-number[BusinessPartnerNumber].
 
+|`"CLAIMPATH"`
+|ABAC attribute selected from the verified JWT Claims Set with a non-empty JSON Pointer defined by https://www.rfc-editor.org/rfc/rfc6901.html[RFC 6901]. The text representation encodes the pointer as a JSON string; quotation mark, reverse solidus, and control characters use JSON escaping, while pointer separators are written as `/`. A <ClaimPathAttribute> can select any JSON value, including a nested scalar, object, or complete array; its value type is determined only after the pointer is resolved. It is not JSONPath and the URI-fragment form beginning with `#` shall not be used.
+
+EXAMPLE `CLAIMPATH("/realm_access/roles")` selects the `roles` value in the nested `realm_access` object. See xref:annex/text-access-rule-examples.adoc#example-nested-claim-path[Nested and multi-valued access-token claims].
+
 |`"GLOBAL"`
 |Global/environment condition available to the AAS interface, e.g., time. 
 
@@ -401,6 +406,12 @@ EXAMPLE See xref:annex/text-access-rule-examples.adoc#example-authenticated-user
 Single Attributes are either claims from an Access Token provided by an Identity Provider, global attributes like actual DATETIME or references to a model field, e.g. to a SubmodelElement property for a machine state.
 An Attribute Group defines a list of single attributes and/or a list of names of other attribute groups.
 
+A <ClaimAttribute> and a <ClaimPathAttribute> are selectors, not declarations of the runtime type of the selected JSON value. <ClaimAttribute> selects one top-level member by its member name. <ClaimPathAttribute> shall be evaluated against the root of the verified JWT Claims Set. JSON Pointer reference tokens shall be decoded and evaluated as specified by RFC 6901. In particular, `~1` represents `/`, `~0` represents `~`, object member names are compared without Unicode normalization, and array indices use zero-based decimal notation without leading zeros. A pointer containing an invalid escape, a pointer that does not resolve, the `-` array token, or a leading-zero token applied to an array does not resolve to an attribute value.
+
+The ATTRIBUTES section declares the attributes that a formula may use; declaration alone does not require a claim to be present. An attribute is resolved when its occurrence is evaluated by the formula. If a <ClaimAttribute> or <ClaimPathAttribute> is absent, does not resolve, resolves to `null`, or has a JSON type that is not accepted by the consuming operation, that operation shall be indeterminate. The enclosing logical expression shall handle that result according to the three-valued logic defined in <<formulas>>.
+
+Implementations shall make claims available to attribute evaluation only after all applicable access-token validation has succeeded. This includes cryptographic validation with an explicitly allowed algorithm and validation of the issuer, audience, temporal claims, and token type or purpose according to https://www.rfc-editor.org/rfc/rfc8725.html[RFC 8725] and the applicable access-token profile, such as https://www.rfc-editor.org/rfc/rfc9068.html[RFC 9068].
+
 A REFERENCE attribute addresses a field by identifier, independently of the object currently evaluated.
 This is useful when a rule for one object needs state data from another model context, for example checking a machine state from an OperationalData Submodel while filtering maintenance documents in a different Submodel.
 EXAMPLE See xref:annex/text-access-rule-examples.adoc#example-reference-machine-state-filter[Reference Attribute and state-dependent filtering].
@@ -559,7 +570,7 @@ Table <<table-field-identifiers>> enumerates the available identifiers.
 
 Any <LogicalExpression> described using the AAS query language defined by link:https://industrialdigitaltwin.io/aas-specifications/IDTA-01002/v3.2/query-language.html[IDTA-01002, Query Language] may be used in a formula for access control.
 
-The logical expression used as condition shall evaluate to either true or false. If the expression evaluates to true the respective <<access-permission-rules,Access Permission Rule>> shall be enforced, otherwise the rule is ignored.
+The logical expression used as condition shall evaluate to true, false, or indeterminate. If the expression evaluates to true the respective <<access-permission-rules,Access Permission Rule>> shall be enforced. A false or indeterminate result shall not grant access.
 
 Arithmetic in Formulas is currently not supported.
 
@@ -567,10 +578,82 @@ Nested logical expressions create combinations of several logical expressions, w
 
 String Comparison Operations compare or match the first given argument (left argument) with the second given argument (right argument). *$eq, $ne, $gt, $lt, $ge, $le* make an alphabetic string comparison. $**starts-with, $ends-with, $contains and $regex** check, if the first given argument is part of the second argument or if the first argument matches with the given REGEX.
 
+Two operations additionally accept an uncast <ClaimPathAttribute>:
+
+* In `<ClaimPathAttribute> $eq <ClaimPathStringOperand>` (or the reverse order), the selected claim value shall be a JSON string. `$eq` is true only when the complete selected string and the other string operand are equal. Equality is case-sensitive and performs no JSON serialization or type coercion. A selected value of another JSON type makes the operation indeterminate.
+* In `$contains(<ClaimPathAttribute>, <ClaimPathStringOperand>)`, the selected claim value shall be an array containing only JSON strings. `$contains` is true only when one complete array element is equal to the other string operand. Array order and duplicate elements do not affect the result. An empty array produces false. A non-array value or an array containing a non-string element makes the operation indeterminate. This overload is exact array membership; it is not a substring search.
+
+The existing string forms of `$eq` and `$contains` are unchanged. The ClaimPath-specific `$contains` form is directional: <ClaimPathAttribute> is the first operand. An uncast <ClaimPathAttribute> is not valid with `$ne`, ordered comparisons, `$starts-with`, `$ends-with`, or `$regex`.
+
+<ClaimPathStringOperand> deliberately excludes an uncast <FieldIdentifier>. A field value shall establish its string type explicitly, for example `CLAIMPATH("/department/name") $eq str($sme#value)` or `$contains(CLAIMPATH("/realm_access/roles"), str($sme#requiredRole))`.
+
+For a verified Claims Set containing `{"realm_access":{"roles":["reader","admin"]}}`, the following results apply:
+
+[cols="2,1,3",options="header"]
+|===
+|Expression
+|Result
+|Reason
+
+|`$contains(CLAIMPATH("/realm_access/roles"), "admin")`
+|true
+|One complete string-array element is equal.
+
+|`$contains(CLAIMPATH("/realm_access/roles"), "min")`
+|false
+|Substrings within array elements do not match.
+
+|`CLAIMPATH("/realm_access/roles/1") $eq "admin"`
+|true
+|The array index selects the scalar string `admin`.
+
+|`CLAIMPATH("/realm_access/roles") $eq "admin"`
+|indeterminate
+|The selected value is an array, but this overload requires a string.
+
+|`$contains(CLAIMPATH("/realm_access/missing"), "admin")`
+|indeterminate
+|The path does not resolve.
+|===
+
 Numerical Comparison Operations compare the first given argument (left argument) with the second given argument (right argument).
 Since AAS also supports XS Datatypes Hex, Bool, DateTime and Time, related comparisons are available accordingly.
 
 For specific comparisons datatypes can be casted to the other datatypes.
+All explicit casts may take a <ClaimAttribute> or <ClaimPathAttribute> as input. For claim values, casts are strict type assertions followed, where applicable, by validation of the selected string's lexical representation. They do not coerce between JSON strings, numbers, and booleans. The following source types are accepted:
+
+[cols="1,2,3",options="header"]
+|===
+|Cast
+|Required selected JSON value
+|Result
+
+|`str(...)`
+|string
+|The unchanged string.
+
+|`num(...)`
+|number
+|The JSON number, subject to the implementation's supported numeric range and precision.
+
+|`bool(...)`
+|boolean
+|The unchanged Boolean value.
+
+|`hex(...)`
+|string conforming to <HexLiteral>
+|The corresponding hex value.
+
+|`dateTime(...)`
+|string conforming to <DateTimeLiteral>
+|The corresponding DateTime value.
+
+|`time(...)`
+|string conforming to <TimeLiteral>
+|The corresponding Time value.
+|===
+
+A JSON array, object, or `null` cannot be cast. A string containing `"3"` is therefore not accepted by `num(...)`, and a string containing `"true"` is not accepted by `bool(...)`. Consequently, `str(CLAIMPATH("/name"))`, `num(CLAIMPATH("/assurance/level"))`, `hex(CLAIMPATH("/flags"))`, `bool(CLAIMPATH("/active"))`, `dateTime(CLAIMPATH("/validUntil"))`, and `time(CLAIMPATH("/accessTime"))` can be used wherever the corresponding typed operand is allowed. Casts do not implicitly select the first array element or serialize arrays or objects to text. A selected number whose value cannot be represented without violating the implementation's documented numeric limits shall produce an indeterminate result.
 If a FieldIdentifier is used directly in a typed comparison, it is implicitly interpreted as the comparison type.
 This implicit conversion is tried for all values addressed by the FieldIdentifier.
 Values that cannot be converted are ignored for this FieldIdentifier evaluation.
@@ -584,7 +667,36 @@ An important special operation is $match, which can be used with any element con
 The list element is written with [] to express, that $match shall check if a certain expression is true for at least one element in the list.
 FILTER defines one fragment restriction for a returned object, while FILTERLIST defines several fragment restrictions with independent conditions.
 
-A formula can use all ABAC attributes defined in the ATTRIBUTES: section of the <<acl,ACL>>. A formula referring to undefined attributes shall result in false. Any type of error during the evaluation of a formula shall be treated as if the formula resulted in false.
+A formula can use all ABAC attributes defined in the ATTRIBUTES: section of the <<acl,ACL>>. A formula referring to an undefined attribute shall be indeterminate. Any type of error during the evaluation of an operation, including an unresolved <ClaimAttribute> or <ClaimPathAttribute>, a wrong selected JSON type, a non-string member of an array used by the ClaimPath-specific `$contains`, or an invalid cast, shall make that operation indeterminate.
+
+Indeterminate is distinct from Boolean false and shall not be converted to false before evaluating an enclosing logical expression. In particular, `$not(indeterminate)` is indeterminate and cannot activate an ALLOW rule. Logical operators shall retain a result that has already been determined independently of an indeterminate operand:
+
+[cols="2,1",options="header"]
+|===
+|Expression
+|Result
+
+|`$not(indeterminate)`
+|indeterminate
+
+|`$or(true, indeterminate)`
+|true
+
+|`$or(false, indeterminate)`
+|indeterminate
+
+|`$and(false, indeterminate)`
+|false
+
+|`$and(true, indeterminate)`
+|indeterminate
+|===
+
+For logical operators with more than two operands, `$or` is true if any operand is true and is indeterminate if no operand is true and at least one operand is indeterminate. `$and` is false if any operand is false and is indeterminate if no operand is false and at least one operand is indeterminate. Formula evaluation is declarative. Implementations may short-circuit evaluation when the result has already been determined; an operand skipped by short-circuit evaluation is not considered to have produced an error.
+
+The result of evaluating an ALLOW rule is Permit if its formula is true, NotApplicable if its formula is false, and Indeterminate if its formula is indeterminate. When multiple rules cover a request, the access rule model uses deny-unless-permit combination: access shall be granted if at least one applicable ALLOW rule evaluates to Permit; otherwise access shall be denied. An error in one rule therefore cannot by itself negate a separate rule that independently evaluates to Permit.
+
+Implementations MAY impose limits on JSON Pointer length, nesting depth, or the number of array elements inspected to protect authorization evaluation from resource exhaustion. Such limits shall be documented. Exceeding a limit shall make the affected operation indeterminate; if no independently applicable rule evaluates to Permit, the final deny-unless-permit decision is Deny. Selected claim values SHOULD NOT be written to logs unless the deployment's data-protection policy explicitly permits it.
 
 USEFORMULAS can be used to refer to a predefined formula (see <<reusable-definitions,Reusable Definitions>>).
 
@@ -660,7 +772,7 @@ For example, the Time value `12:00:00` shall be interpreted and serialized as `1
 _Value_ is used for comparisons and _StringValue_ is used for the specific string operations.
 For type safety and automatic code generation, each possible type is available as an own object:
 
-* String values can be given by _$field_, $__strVal__, $__attribute__ oder $__strCast__.
+* String values can be given by _$field_, $__strVal__, a scalar $__attribute__ or $__strCast__.
 * Numerical values can be given by $__numVal__ or $__numCast__.
 * Hex values can be given by $__hexVal__ or $__hexCast__.
 * Bool values can be given by _$boolean_ or $__boolCast__.
@@ -669,6 +781,7 @@ For type safety and automatic code generation, each possible type is available a
 
 Casts convert values to the given type if possible.
 DateTime casts use string operands; Time casts use string or DateTime operands.
+The input of any cast may also be a $__attribute__ containing CLAIM or CLAIMPATH. Claim-value casts use the strict source-type rules defined in <<formulas>>; arrays, objects and `null` are invalid cast inputs.
 Direct comparisons between two FieldIdentifier operands are not valid because the type of both fields would be implicit.
 To compare two fields, at least one operand shall use an explicit cast, e.g. compare _$field_ to $__strCast__, $__numCast__, $__dateTimeCast__, or $__timeCast__.
 
@@ -677,13 +790,15 @@ Parts of DateTime values can be extracted as numbers:
 * _$dayOfWeek_ extracts the day of week as number, starting with 0 for Sunday.
 * _$dayOfMonth_, _$month_, _$year_ extract the related part as number.
 
-Except for direct FieldIdentifier operands in typed comparisons, if a conversion or any other operation is invalid, the complete expression has to be treated as invalid.
-An error message shall be generated and the result of the complete expression becomes FALSE, so that the access is not allowed and/or the filter is empty.
+Except for direct FieldIdentifier operands in typed comparisons, if a conversion or any other evaluated operation is invalid, that operation shall be indeterminate. An enclosing logical expression shall combine the result according to the three-valued logic defined in <<formulas>>.
+Implementations SHOULD make a diagnostic available for an evaluated error without including selected claim values unless the deployment's data-protection policy permits their disclosure. An indeterminate final result shall not allow access and shall not expose filtered data.
 
 To allow the use of different types in operations, arrays are used for parameters. _comparisonItems_ is used for comparisons and _stringItems_ is used for specific string operations.
 
 _logicalExpressions_ and _match_ can be recursively nested.
 
+For CLAIMPATH, _$eq_ additionally accepts a _claimPathValue_ paired with a _claimPathStringValue_. _$contains_ additionally accepts a _claimPathValue_ followed by a _claimPathStringValue_ and performs exact string-array membership. _claimPathStringValue_ excludes an uncast _$field_; a _$strCast_ is required for field values. Other direct typed operations exclude _claimPathValue_; an explicit cast shall be used instead.
+
 == Exchange of Access Rules
 
 Business Partners may be interested to exchange Access Rules.
diff --git a/documentation/IDTA-01004/modules/ROOT/pages/annex/json-access-rule-examples.adoc b/documentation/IDTA-01004/modules/ROOT/pages/annex/json-access-rule-examples.adoc
index ac6f1c9..0e11167 100644
--- a/documentation/IDTA-01004/modules/ROOT/pages/annex/json-access-rule-examples.adoc
+++ b/documentation/IDTA-01004/modules/ROOT/pages/annex/json-access-rule-examples.adoc
@@ -98,3 +98,9 @@ include::partial$examples/filter.json[]
 include::partial$examples/reference-machine-state-filter.json[]
 ----
 
+== EXAMPLE 13: Nested and multi-valued access-token claims
+
+[source,json,linenums]
+----
+include::partial$examples/nested-claim-path.json[]
+----
diff --git a/documentation/IDTA-01004/modules/ROOT/pages/annex/text-access-rule-examples.adoc b/documentation/IDTA-01004/modules/ROOT/pages/annex/text-access-rule-examples.adoc
index 14ad40a..1b15b27 100644
--- a/documentation/IDTA-01004/modules/ROOT/pages/annex/text-access-rule-examples.adoc
+++ b/documentation/IDTA-01004/modules/ROOT/pages/annex/text-access-rule-examples.adoc
@@ -190,3 +190,36 @@ In case the machine is not running all maintenance documents are returned (no FI
 ----
 include::partial$examples/reference-machine-state-filter.bnf[]
 ----
+
+[[example-nested-claim-path]]
+== EXAMPLE 13: Nested and multi-valued access-token claims
+
+For a user whose access token contains the role `admin` in the nested
+`/realm_access/roles` string array, whose department name is `engineering`,
+and whose assurance level is at least `3`:
+
+[source,json]
+----
+{
+  "realm_access": {
+    "roles": ["reader", "admin"]
+  },
+  "department": {
+    "name": "engineering"
+  },
+  "assurance": {
+    "level": 3
+  }
+}
+----
+
+Allow READ access to a `departmentData` SubmodelElement when its value equals
+the department from the access token. The role uses exact array membership,
+the department uses both literal equality and an explicitly string-cast
+FieldIdentifier comparison, and the assurance level is explicitly cast to a
+number before the ordered comparison.
+
+[source,bnf,linenums]
+----
+include::partial$examples/nested-claim-path.bnf[]
+----
diff --git a/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc b/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc
index 131af76..11cc9e3 100644
--- a/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc
+++ b/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc
@@ -19,6 +19,7 @@ Bugfixes:
 
 Minor Changes:
 
+* added: `CLAIMPATH` selects nested JWT claim values using RFC 6901 JSON Pointer syntax. Direct `$eq` supports scalar-string equality, direct `$contains` supports exact string-array membership, and strict explicit casts make scalar claim values available to other typed operations. Missing or wrongly typed values are indeterminate and final authorization uses deny-unless-permit combination.
 * Improved documentation of access rule examples
 * new access rule examples for DPP related rules, access rule 10 updated to better reflect the purpose
 
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/bnf/access-rules.bnf b/documentation/IDTA-01004/modules/ROOT/partials/bnf/access-rules.bnf
index 4103cca..a3d0a23 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/bnf/access-rules.bnf
+++ b/documentation/IDTA-01004/modules/ROOT/partials/bnf/access-rules.bnf
@@ -67,10 +67,14 @@
 
 <Access> ::= "ALLOW" | "DISABLED"
 
-<SingleAttribute> ::= <ClaimAttribute> | <GlobalAttribute> | <ReferenceAttribute>
+<SingleAttribute> ::= <ClaimAttribute> | <ClaimPathAttribute> | <GlobalAttribute> | <ReferenceAttribute>
+
+<ScalarAttribute> ::= <ClaimAttribute> | <GlobalAttribute> | <ReferenceAttribute>
 
 <ClaimAttribute> ::= "CLAIM" <Ws> "(" <Ws> <ClaimLiteral> <Ws> ")"
 
+<ClaimPathAttribute> ::= "CLAIMPATH" <Ws> "(" <Ws> <ClaimPathLiteral> <Ws> ")"
+
 <GlobalAttribute> ::=
     "GLOBAL" <Ws> "(" <Ws>
     ( "LOCALNOW" | "UTCNOW" | "CLIENTNOW" | "ANONYMOUS" )
@@ -153,6 +157,7 @@
     ")" <Ws>
 
 <SingleComparison> ::=
+    <ClaimPathEqualityComparison> |
     <StringComparison> |
     <NumericalComparison> |
     <HexComparison> |
@@ -162,14 +167,23 @@
 
 <AllComparisons> ::= "$eq" | "$ne" | "$gt" | "$lt" | "$ge" | "$le"
 
+<ClaimPathEqualityComparison> ::=
+    ( <ClaimPathAttribute> <Ws> "$eq" <Ws> <ClaimPathStringOperand> <Ws> ) |
+    ( <ClaimPathStringOperand> <Ws> "$eq" <Ws> <ClaimPathAttribute> <Ws> )
+
 <StringComparison> ::=
+    <ContainsComparison> |
     (
-        ( "$starts-with" | "$ends-with" | "$contains" | "$regex" )
+        ( "$starts-with" | "$ends-with" | "$regex" )
         <Ws> "(" <Ws> <StringOperand> <Ws> "," <Ws> <StringOperand> <Ws> ")" <Ws>
     ) |
     ( <StringOperand> <Ws> <AllComparisons> <Ws> <StringNonFieldOperand> <Ws> ) |
     ( <StringNonFieldOperand> <Ws> <AllComparisons> <Ws> <StringOperand> <Ws> )
 
+<ContainsComparison> ::=
+    ( "$contains" <Ws> "(" <Ws> <StringOperand> <Ws> "," <Ws> <StringOperand> <Ws> ")" <Ws> ) |
+    ( "$contains" <Ws> "(" <Ws> <ClaimPathAttribute> <Ws> "," <Ws> <ClaimPathStringOperand> <Ws> ")" <Ws> )
+
 <NumericalComparison> ::=
     ( <NumericalOperand> <Ws> <AllComparisons> <Ws> <NumericalOperand> <Ws> ) |
     ( <NumericalOperand> <Ws> <AllComparisons> <Ws> <FieldIdentifier> <Ws> ) |
@@ -207,9 +221,11 @@
     <DateTimeOperand> |
     <TimeOperand>
 
-<StringOperand> ::= <FieldIdentifier> | <StringLiteral> | <CastToString> | <SingleAttribute>
+<StringOperand> ::= <FieldIdentifier> | <StringLiteral> | <CastToString> | <ScalarAttribute>
 
-<StringNonFieldOperand> ::= <StringLiteral> | <CastToString> | <SingleAttribute>
+<StringNonFieldOperand> ::= <StringLiteral> | <CastToString> | <ScalarAttribute>
+
+<ClaimPathStringOperand> ::= <StringNonFieldOperand>
 
 <NumericalOperand> ::= <NumericalLiteral> | <CastToNumerical> | <DateTimeToNum>
 
@@ -221,17 +237,21 @@
 
 <TimeOperand> ::= <TimeLiteral> | <CastToTime>
 
-<CastToString> ::= "str" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+<CastOperand> ::= <Operand> | <ClaimPathAttribute>
+
+<StringCastOperand> ::= <StringOperand> | <ClaimPathAttribute>
 
-<CastToNumerical> ::= "num" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+<CastToString> ::= "str" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
-<CastToHex> ::= "hex" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+<CastToNumerical> ::= "num" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
-<CastToBool> ::= "bool" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+<CastToHex> ::= "hex" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
-<CastToDateTime> ::= "dateTime" <Ws> "(" <Ws> <StringOperand> <Ws> ")" <Ws>
+<CastToBool> ::= "bool" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
-<CastToTime> ::= "time" <Ws> "(" <Ws> ( <StringOperand> | <DateTimeOperand> ) <Ws> ")" <Ws>
+<CastToDateTime> ::= "dateTime" <Ws> "(" <Ws> <StringCastOperand> <Ws> ")" <Ws>
+
+<CastToTime> ::= "time" <Ws> "(" <Ws> ( <StringCastOperand> | <DateTimeOperand> ) <Ws> ")" <Ws>
 
 <DateTimeLiteral> ::= <Datetime> <Ws>
 <TimeLiteral> ::= <Time> ( <Timezone> )? <Ws>
@@ -264,6 +284,24 @@
     )+
     "\""
 <ClaimLiteral> ::= <StringLiteral>
+<ClaimPathLiteral> ::= "\"" "/" <ClaimPathToken> ( "/" <ClaimPathToken> )* "\""
+<ClaimPathToken> ::=
+    (
+        <ClaimPathUnescapedCharacter> |
+        <ClaimPathJsonEscape> |
+        "~0" |
+        "~1"
+    )*
+<ClaimPathUnescapedCharacter> ::=
+    [\u0020-\u0021] |
+    [\u0023-\u002E] |
+    [\u0030-\u005B] |
+    [\u005D-\u007D] |
+    [\u007F-\u10FFFF]
+<ClaimPathJsonEscape> ::=
+    "\\" ( "\"" | "\\" | "b" | "f" | "n" | "r" | "t" ) |
+    "\\" "u" "0" "0" ( "0" <HexDigit> | "1" <HexDigit> )
+<HexDigit> ::= [0-9] | [A-F] | [a-f]
 <RouteLiteral> ::= <StringLiteral>
 <IdentifiableLiteral> ::= <StringLiteral>
 <ReferableLiteral> ::= <StringLiteral>
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/bnf/attributes.bnf b/documentation/IDTA-01004/modules/ROOT/partials/bnf/attributes.bnf
index 1368091..7fd7a7a 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/bnf/attributes.bnf
+++ b/documentation/IDTA-01004/modules/ROOT/partials/bnf/attributes.bnf
@@ -1,9 +1,15 @@
 <SingleAttribute> ::=
+    <ClaimAttribute> | <ClaimPathAttribute> | <GlobalAttribute> | <ReferenceAttribute>
+
+<ScalarAttribute> ::=
     <ClaimAttribute> | <GlobalAttribute> | <ReferenceAttribute>
 
 <ClaimAttribute> ::=
     "CLAIM" <Ws> "(" <Ws> <ClaimLiteral> <Ws> ")"
 
+<ClaimPathAttribute> ::=
+    "CLAIMPATH" <Ws> "(" <Ws> <ClaimPathLiteral> <Ws> ")"
+
 <GlobalAttribute> ::=
     "GLOBAL" <Ws> "(" <Ws>
     ( "LOCALNOW" | "UTCNOW" | "CLIENTNOW" | "ANONYMOUS" )
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/bnf/formulas.bnf b/documentation/IDTA-01004/modules/ROOT/partials/bnf/formulas.bnf
index 37ab215..899e568 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/bnf/formulas.bnf
+++ b/documentation/IDTA-01004/modules/ROOT/partials/bnf/formulas.bnf
@@ -11,6 +11,7 @@
 <MatchExpression> ::= ( "$match" <Ws> "(" <Ws> ( <SingleComparison> | <MatchExpression> ) ( "," <Ws> ( <SingleComparison> | <MatchExpression> ) )* ")" <Ws> )
 
 <SingleComparison> ::=
+    <ClaimPathEqualityComparison> |
     <StringComparison> |
     <NumericalComparison> |
     <HexComparison> |
@@ -20,11 +21,20 @@
 
 <AllComparisons> ::= ( "$eq" | "$ne" | "$gt" | "$lt" | "$ge" | "$le" )
 
+<ClaimPathEqualityComparison> ::=
+    ( <ClaimPathAttribute> <Ws> "$eq" <Ws> <ClaimPathStringOperand> <Ws> ) |
+    ( <ClaimPathStringOperand> <Ws> "$eq" <Ws> <ClaimPathAttribute> <Ws> )
+
 <StringComparison> ::=
-    ( ( "$starts-with" | "$ends-with" | "$contains" | "$regex") <Ws> "(" <Ws> <StringOperand> <Ws> "," <Ws> <StringOperand> <Ws> ")" <Ws> ) |
+    <ContainsComparison> |
+    ( ( "$starts-with" | "$ends-with" | "$regex") <Ws> "(" <Ws> <StringOperand> <Ws> "," <Ws> <StringOperand> <Ws> ")" <Ws> ) |
     ( <StringOperand> <Ws> <AllComparisons> <Ws> <StringNonFieldOperand> <Ws> ) |
     ( <StringNonFieldOperand> <Ws> <AllComparisons> <Ws> <StringOperand> <Ws> )
 
+<ContainsComparison> ::=
+    ( "$contains" <Ws> "(" <Ws> <StringOperand> <Ws> "," <Ws> <StringOperand> <Ws> ")" <Ws> ) |
+    ( "$contains" <Ws> "(" <Ws> <ClaimPathAttribute> <Ws> "," <Ws> <ClaimPathStringOperand> <Ws> ")" <Ws> )
+
 <NumericalComparison> ::=
     ( <NumericalOperand> <Ws> <AllComparisons> <Ws> <NumericalOperand> <Ws> ) |
     ( <NumericalOperand> <Ws> <AllComparisons> <Ws> <FieldIdentifier> <Ws> ) |
@@ -56,10 +66,12 @@
 <Operand> ::= <StringOperand> | <NumericalOperand> | <HexOperand> | <BoolOperand> | <DateTimeOperand> | <TimeOperand>
 
 <StringOperand> ::=
-    <FieldIdentifier> | <StringLiteral> | <CastToString> | <SingleAttribute>
+    <FieldIdentifier> | <StringLiteral> | <CastToString> | <ScalarAttribute>
 
 <StringNonFieldOperand> ::=
-    <StringLiteral> | <CastToString> | <SingleAttribute>
+    <StringLiteral> | <CastToString> | <ScalarAttribute>
+
+<ClaimPathStringOperand> ::= <StringNonFieldOperand>
 
 <NumericalOperand> ::=
     <NumericalLiteral> | <CastToNumerical> | <DateTimeToNum>
@@ -76,20 +88,24 @@
 <TimeOperand> ::=
     <TimeLiteral> | <CastToTime>
 
+<CastOperand> ::= <Operand> | <ClaimPathAttribute>
+
+<StringCastOperand> ::= <StringOperand> | <ClaimPathAttribute>
+
 <CastToString> ::=
-    "str" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+    "str" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
 <CastToNumerical> ::=
-    "num" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+    "num" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
 <CastToHex> ::=
-    "hex" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+    "hex" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
 <CastToBool> ::=
-    "bool" <Ws> "(" <Ws> <Operand> <Ws> ")" <Ws>
+    "bool" <Ws> "(" <Ws> <CastOperand> <Ws> ")" <Ws>
 
 <CastToDateTime> ::=
-    "dateTime" <Ws> "(" <Ws> <StringOperand> <Ws> ")" <Ws>
+    "dateTime" <Ws> "(" <Ws> <StringCastOperand> <Ws> ")" <Ws>
 
 <CastToTime> ::=
-    "time" <Ws> "(" <Ws> ( <StringOperand> | <DateTimeOperand> ) <Ws> ")" <Ws>
+    "time" <Ws> "(" <Ws> ( <StringCastOperand> | <DateTimeOperand> ) <Ws> ")" <Ws>
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/diagrams/access-rule-model.puml b/documentation/IDTA-01004/modules/ROOT/partials/diagrams/access-rule-model.puml
index 377075f..2bcac82 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/diagrams/access-rule-model.puml
+++ b/documentation/IDTA-01004/modules/ROOT/partials/diagrams/access-rule-model.puml
@@ -50,6 +50,12 @@ together {
 	further defined in Text
   end note
 
+  class ClaimPath {
+  }
+  note bottom of ClaimPath
+    RFC 6901 JSON Pointer
+  end note
+
   class GlobalAttribute {
   }
   note bottom of GlobalAttribute
@@ -63,6 +69,7 @@ together {
   end note
 
   SingleAttribute <|-- Claim
+  SingleAttribute <|-- ClaimPath
   SingleAttribute <|-- GlobalAttribute
   SingleAttribute <|-- Reference
 }
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.bnf b/documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.bnf
new file mode 100644
index 0000000..0d01e4c
--- /dev/null
+++ b/documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.bnf
@@ -0,0 +1,16 @@
+ACCESSRULE:
+  ATTRIBUTES:
+    CLAIMPATH("/realm_access/roles")
+    CLAIMPATH("/department/name")
+    CLAIMPATH("/assurance/level")
+  RIGHTS: READ
+  ACCESS: ALLOW
+  OBJECTS:
+    REFERABLE $sme("*").departmentData
+  FORMULA:
+    $and(
+      $contains(CLAIMPATH("/realm_access/roles"), "admin"),
+      CLAIMPATH("/department/name") $eq "engineering",
+      CLAIMPATH("/department/name") $eq str($sme#value),
+      num(CLAIMPATH("/assurance/level")) $ge 3
+    )
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.json b/documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.json
new file mode 100644
index 0000000..542e58e
--- /dev/null
+++ b/documentation/IDTA-01004/modules/ROOT/partials/examples/nested-claim-path.json
@@ -0,0 +1,86 @@
+{
+  "AllAccessPermissionRules": {
+    "rules": [
+      {
+        "ACL": {
+          "ATTRIBUTES": [
+            {
+              "CLAIMPATH": "/realm_access/roles"
+            },
+            {
+              "CLAIMPATH": "/department/name"
+            },
+            {
+              "CLAIMPATH": "/assurance/level"
+            }
+          ],
+          "RIGHTS": [
+            "READ"
+          ],
+          "ACCESS": "ALLOW"
+        },
+        "OBJECTS": [
+          {
+            "REFERABLE": "$sme(\"*\").departmentData"
+          }
+        ],
+        "FORMULA": {
+          "$and": [
+            {
+              "$contains": [
+                {
+                  "$attribute": {
+                    "CLAIMPATH": "/realm_access/roles"
+                  }
+                },
+                {
+                  "$strVal": "admin"
+                }
+              ]
+            },
+            {
+              "$eq": [
+                {
+                  "$attribute": {
+                    "CLAIMPATH": "/department/name"
+                  }
+                },
+                {
+                  "$strVal": "engineering"
+                }
+              ]
+            },
+            {
+              "$eq": [
+                {
+                  "$attribute": {
+                    "CLAIMPATH": "/department/name"
+                  }
+                },
+                {
+                  "$strCast": {
+                    "$field": "$sme#value"
+                  }
+                }
+              ]
+            },
+            {
+              "$ge": [
+                {
+                  "$numCast": {
+                    "$attribute": {
+                      "CLAIMPATH": "/assurance/level"
+                    }
+                  }
+                },
+                {
+                  "$numVal": 3
+                }
+              ]
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/json/aas-queries-and-access-rules-schema.json b/documentation/IDTA-01004/modules/ROOT/partials/json/aas-queries-and-access-rules-schema.json
index d52de73..5b822f2 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/json/aas-queries-and-access-rules-schema.json
+++ b/documentation/IDTA-01004/modules/ROOT/partials/json/aas-queries-and-access-rules-schema.json
@@ -79,7 +79,7 @@
           "$ref": "#/definitions/dateTimeLiteralPattern"
         },
         "$dateTimeCast": {
-          "$ref": "#/definitions/stringValue"
+          "$ref": "#/definitions/stringCastValue"
         },
         "$attribute": {
           "$ref": "#/definitions/dateTimeAttributeItem"
@@ -229,7 +229,7 @@
         "$timeCast": {
           "anyOf": [
             {
-              "$ref": "#/definitions/stringValue"
+              "$ref": "#/definitions/stringCastValue"
             },
             {
               "$ref": "#/definitions/dateTimeOperand"
@@ -291,12 +291,12 @@
           "$ref": "#/definitions/Value"
         },
         "$dateTimeCast": {
-          "$ref": "#/definitions/stringValue"
+          "$ref": "#/definitions/stringCastValue"
         },
         "$timeCast": {
           "anyOf": [
             {
-              "$ref": "#/definitions/stringValue"
+              "$ref": "#/definitions/stringCastValue"
             },
             {
               "$ref": "#/definitions/dateTimeOperand"
@@ -423,7 +423,7 @@
           "$ref": "#/definitions/Value"
         },
         "$attribute": {
-          "$ref": "#/definitions/attributeItem"
+          "$ref": "#/definitions/scalarAttributeItem"
         }
       },
       "oneOf": [
@@ -460,7 +460,7 @@
           "$ref": "#/definitions/Value"
         },
         "$attribute": {
-          "$ref": "#/definitions/attributeItem"
+          "$ref": "#/definitions/scalarAttributeItem"
         }
       },
       "oneOf": [
@@ -482,6 +482,31 @@
       ],
       "additionalProperties": false
     },
+    "claimPathValue": {
+      "type": "object",
+      "properties": {
+        "$attribute": {
+          "$ref": "#/definitions/claimPathAttributeItem"
+        }
+      },
+      "required": [
+        "$attribute"
+      ],
+      "additionalProperties": false
+    },
+    "claimPathStringValue": {
+      "$ref": "#/definitions/stringNonFieldValue"
+    },
+    "stringCastValue": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/stringValue"
+        },
+        {
+          "$ref": "#/definitions/claimPathValue"
+        }
+      ]
+    },
     "comparisonItems": {
       "$ref": "#/definitions/equalityComparisonItems"
     },
@@ -515,6 +540,59 @@
         }
       ]
     },
+    "claimPathEqualityItems": {
+      "oneOf": [
+        {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 2,
+          "items": [
+            {
+              "$ref": "#/definitions/claimPathValue"
+            },
+            {
+              "$ref": "#/definitions/claimPathStringValue"
+            }
+          ]
+        },
+        {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 2,
+          "items": [
+            {
+              "$ref": "#/definitions/claimPathStringValue"
+            },
+            {
+              "$ref": "#/definitions/claimPathValue"
+            }
+          ]
+        }
+      ]
+    },
+    "claimPathContainsItems": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "items": [
+        {
+          "$ref": "#/definitions/claimPathValue"
+        },
+        {
+          "$ref": "#/definitions/claimPathStringValue"
+        }
+      ]
+    },
+    "containsItems": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/stringItems"
+        },
+        {
+          "$ref": "#/definitions/claimPathContainsItems"
+        }
+      ]
+    },
     "numericalComparisonItems": {
       "oneOf": [
         {
@@ -734,6 +812,16 @@
         }
       ]
     },
+    "eqComparisonItems": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/equalityComparisonItems"
+        },
+        {
+          "$ref": "#/definitions/claimPathEqualityItems"
+        }
+      ]
+    },
     "matchExpression": {
       "type": "object",
       "properties": {
@@ -745,7 +833,7 @@
           }
         },
         "$eq": {
-          "$ref": "#/definitions/equalityComparisonItems"
+          "$ref": "#/definitions/eqComparisonItems"
         },
         "$ne": {
           "$ref": "#/definitions/equalityComparisonItems"
@@ -763,7 +851,7 @@
           "$ref": "#/definitions/orderedComparisonItems"
         },
         "$contains": {
-          "$ref": "#/definitions/stringItems"
+          "$ref": "#/definitions/containsItems"
         },
         "$starts-with": {
           "$ref": "#/definitions/stringItems"
@@ -862,7 +950,7 @@
           "$ref": "#/definitions/logicalExpression"
         },
         "$eq": {
-          "$ref": "#/definitions/equalityComparisonItems"
+          "$ref": "#/definitions/eqComparisonItems"
         },
         "$ne": {
           "$ref": "#/definitions/equalityComparisonItems"
@@ -880,7 +968,7 @@
           "$ref": "#/definitions/orderedComparisonItems"
         },
         "$contains": {
-          "$ref": "#/definitions/stringItems"
+          "$ref": "#/definitions/containsItems"
         },
         "$starts-with": {
           "$ref": "#/definitions/stringItems"
@@ -983,6 +1071,30 @@
       "additionalProperties": false
     },
     "attributeItem": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/scalarAttributeItem"
+        },
+        {
+          "$ref": "#/definitions/claimPathAttributeItem"
+        }
+      ]
+    },
+    "claimPathAttributeItem": {
+      "type": "object",
+      "properties": {
+        "CLAIMPATH": {
+          "type": "string",
+          "pattern": "^(?:/(?:[^~/]|~[01])*)+$"
+        }
+      },
+      "required": [
+        "CLAIMPATH"
+      ],
+      "additionalProperties": false
+    },
+    "scalarAttributeItem": {
+      "type": "object",
       "oneOf": [
         {
           "required": [
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/json/access-rule-model.json b/documentation/IDTA-01004/modules/ROOT/partials/json/access-rule-model.json
index aca9833..aa4eff3 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/json/access-rule-model.json
+++ b/documentation/IDTA-01004/modules/ROOT/partials/json/access-rule-model.json
@@ -1,6 +1,30 @@
 {
   "definitions": {
     "attributeItem": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/scalarAttributeItem"
+        },
+        {
+          "$ref": "#/definitions/claimPathAttributeItem"
+        }
+      ]
+    },
+    "claimPathAttributeItem": {
+      "type": "object",
+      "properties": {
+        "CLAIMPATH": {
+          "type": "string",
+          "pattern": "^(?:/(?:[^~/]|~[01])*)+$"
+        }
+      },
+      "required": [
+        "CLAIMPATH"
+      ],
+      "additionalProperties": false
+    },
+    "scalarAttributeItem": {
+      "type": "object",
       "oneOf": [
         {
           "required": [
diff --git a/documentation/IDTA-01004/modules/ROOT/partials/json/formulas-and-logical-expressions.json b/documentation/IDTA-01004/modules/ROOT/partials/json/formulas-and-logical-expressions.json
index ca65017..9edd680 100644
--- a/documentation/IDTA-01004/modules/ROOT/partials/json/formulas-and-logical-expressions.json
+++ b/documentation/IDTA-01004/modules/ROOT/partials/json/formulas-and-logical-expressions.json
@@ -27,7 +27,7 @@
           "$ref": "#/definitions/dateTimeLiteralPattern"
         },
         "$dateTimeCast": {
-          "$ref": "#/definitions/stringValue"
+          "$ref": "#/definitions/stringCastValue"
         },
         "$attribute": {
           "$ref": "aas-queries-and-access-rules-schema.json#/definitions/dateTimeAttributeItem"
@@ -177,7 +177,7 @@
         "$timeCast": {
           "anyOf": [
             {
-              "$ref": "#/definitions/stringValue"
+              "$ref": "#/definitions/stringCastValue"
             },
             {
               "$ref": "#/definitions/dateTimeOperand"
@@ -239,12 +239,12 @@
           "$ref": "#/definitions/Value"
         },
         "$dateTimeCast": {
-          "$ref": "#/definitions/stringValue"
+          "$ref": "#/definitions/stringCastValue"
         },
         "$timeCast": {
           "anyOf": [
             {
-              "$ref": "#/definitions/stringValue"
+              "$ref": "#/definitions/stringCastValue"
             },
             {
               "$ref": "#/definitions/dateTimeOperand"
@@ -371,7 +371,7 @@
           "$ref": "#/definitions/Value"
         },
         "$attribute": {
-          "$ref": "aas-queries-and-access-rules-schema.json#/definitions/attributeItem"
+          "$ref": "aas-queries-and-access-rules-schema.json#/definitions/scalarAttributeItem"
         }
       },
       "oneOf": [
@@ -408,7 +408,7 @@
           "$ref": "#/definitions/Value"
         },
         "$attribute": {
-          "$ref": "aas-queries-and-access-rules-schema.json#/definitions/attributeItem"
+          "$ref": "aas-queries-and-access-rules-schema.json#/definitions/scalarAttributeItem"
         }
       },
       "oneOf": [
@@ -430,6 +430,31 @@
       ],
       "additionalProperties": false
     },
+    "claimPathValue": {
+      "type": "object",
+      "properties": {
+        "$attribute": {
+          "$ref": "aas-queries-and-access-rules-schema.json#/definitions/claimPathAttributeItem"
+        }
+      },
+      "required": [
+        "$attribute"
+      ],
+      "additionalProperties": false
+    },
+    "claimPathStringValue": {
+      "$ref": "#/definitions/stringNonFieldValue"
+    },
+    "stringCastValue": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/stringValue"
+        },
+        {
+          "$ref": "#/definitions/claimPathValue"
+        }
+      ]
+    },
     "comparisonItems": {
       "$ref": "#/definitions/equalityComparisonItems"
     },
@@ -463,6 +488,59 @@
         }
       ]
     },
+    "claimPathEqualityItems": {
+      "oneOf": [
+        {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 2,
+          "items": [
+            {
+              "$ref": "#/definitions/claimPathValue"
+            },
+            {
+              "$ref": "#/definitions/claimPathStringValue"
+            }
+          ]
+        },
+        {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 2,
+          "items": [
+            {
+              "$ref": "#/definitions/claimPathStringValue"
+            },
+            {
+              "$ref": "#/definitions/claimPathValue"
+            }
+          ]
+        }
+      ]
+    },
+    "claimPathContainsItems": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "items": [
+        {
+          "$ref": "#/definitions/claimPathValue"
+        },
+        {
+          "$ref": "#/definitions/claimPathStringValue"
+        }
+      ]
+    },
+    "containsItems": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/stringItems"
+        },
+        {
+          "$ref": "#/definitions/claimPathContainsItems"
+        }
+      ]
+    },
     "numericalComparisonItems": {
       "oneOf": [
         {
@@ -682,6 +760,16 @@
         }
       ]
     },
+    "eqComparisonItems": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/equalityComparisonItems"
+        },
+        {
+          "$ref": "#/definitions/claimPathEqualityItems"
+        }
+      ]
+    },
     "matchExpression": {
       "type": "object",
       "properties": {
@@ -693,7 +781,7 @@
           }
         },
         "$eq": {
-          "$ref": "#/definitions/equalityComparisonItems"
+          "$ref": "#/definitions/eqComparisonItems"
         },
         "$ne": {
           "$ref": "#/definitions/equalityComparisonItems"
@@ -711,7 +799,7 @@
           "$ref": "#/definitions/orderedComparisonItems"
         },
         "$contains": {
-          "$ref": "#/definitions/stringItems"
+          "$ref": "#/definitions/containsItems"
         },
         "$starts-with": {
           "$ref": "#/definitions/stringItems"
@@ -810,7 +898,7 @@
           "$ref": "#/definitions/logicalExpression"
         },
         "$eq": {
-          "$ref": "#/definitions/equalityComparisonItems"
+          "$ref": "#/definitions/eqComparisonItems"
         },
         "$ne": {
           "$ref": "#/definitions/equalityComparisonItems"
@@ -828,7 +916,7 @@
           "$ref": "#/definitions/orderedComparisonItems"
         },
         "$contains": {
-          "$ref": "#/definitions/stringItems"
+          "$ref": "#/definitions/containsItems"
         },
         "$starts-with": {
           "$ref": "#/definitions/stringItems"
diff --git a/tools/validate_spec_artifacts.py b/tools/validate_spec_artifacts.py
index 831799b..3811826 100644
--- a/tools/validate_spec_artifacts.py
+++ b/tools/validate_spec_artifacts.py
@@ -161,6 +161,7 @@ def validate_json_artifacts(validation: Validation) -> dict[str, Any] | None:
     validate_json_refs(loaded_json, validation)
     validate_json_examples(loaded_json, validation)
     validate_object_group_smoke_tests(loaded_json, validation)
+    validate_claim_path_schema_parity(loaded_json, validation)
 
     common_schema = loaded_json.get(JSON_DIR / "aas-queries-and-access-rules-schema.json")
     if isinstance(common_schema, dict):
@@ -255,6 +256,42 @@ def validate_object_group_smoke_tests(loaded_json: dict[Path, Any], validation:
     print(f"OK: checked mixed object groups against {len(schema_paths)} schemas")
 
 
+def validate_claim_path_schema_parity(loaded_json: dict[Path, Any], validation: Validation) -> None:
+    """Keep RFC 6901 pointer validation aligned in both access-rule schemas."""
+    cases = [
+        ("/realm_access/roles", True),
+        ("/a~1b/m~0n", True),
+        ("/c%d/g|h", True),
+        ("/Größe/équipe", True),
+        ('/k"l/i\\j', True),
+        ("/a~01b", True),
+        ("", False),
+        ("realm_access/roles", False),
+        ("/bad~2escape", False),
+        ("/raw~escape", False),
+    ]
+    schema_paths = [
+        JSON_DIR / "aas-queries-and-access-rules-schema.json",
+        JSON_DIR / "access-rule-model.json",
+    ]
+
+    checked = 0
+    for path in schema_paths:
+        schema = loaded_json.get(path)
+        if not isinstance(schema, dict):
+            continue
+        validator = definition_validator(path, schema, "attributeItem")
+        for pointer, expected in cases:
+            checked += 1
+            actual = validator.is_valid({"CLAIMPATH": pointer})
+            if actual != expected:
+                validation.fail(
+                    path,
+                    f"CLAIMPATH parity case {pointer!r}: expected valid={expected}, got {actual}",
+                )
+    print(f"OK: ran {checked} CLAIMPATH schema parity tests")
+
+
 def validate_schema_smoke_tests(schema_path: Path, schema: dict[str, Any], validation: Validation) -> None:
     cases = [
         ("FieldIdentifier", "$sm#supplementalSemanticIds[]", True),
@@ -268,6 +305,17 @@ def validate_schema_smoke_tests(schema_path: Path, schema: dict[str, Any], valid
         ("ReferenceIdentifier", "$sme(\"SubmodelID\").machineState#value", True),
         ("ReferenceIdentifier", "$sm#id", False),
         ("ReferenceIdentifier", "$sm(\"SubmodelID\")#martinwarhier", False),
+        ("attributeItem", {"CLAIMPATH": "/realm_access/roles"}, True),
+        ("attributeItem", {"CLAIMPATH": "/a~1b/m~0n"}, True),
+        ("attributeItem", {"CLAIMPATH": "/roles/0"}, True),
+        ("attributeItem", {"CLAIMPATH": "/c%d/g|h"}, True),
+        ("attributeItem", {"CLAIMPATH": "/Größe/équipe"}, True),
+        ("attributeItem", {"CLAIMPATH": '/k"l/i\\j'}, True),
+        ("attributeItem", {"CLAIMPATH": "/a~01b"}, True),
+        ("attributeItem", {"CLAIMPATH": "realm_access/roles"}, False),
+        ("attributeItem", {"CLAIMPATH": ""}, False),
+        ("attributeItem", {"CLAIMPATH": "/bad~2escape"}, False),
+        ("attributeItem", {"CLAIMPATH": "/raw~escape"}, False),
         ("timeLiteralPattern", "09:00:00Z", True),
         ("timeLiteralPattern", "09:00:30Z", True),
         ("timeLiteralPattern", "09:00:30.123Z", True),
@@ -293,6 +341,71 @@ def validate_schema_smoke_tests(schema_path: Path, schema: dict[str, Any], valid
         ("logicalExpression", {"$eq": [{"$boolean": True}, {"$boolean": False}]}, True),
         ("logicalExpression", {"$gt": [{"$boolean": True}, {"$boolean": False}]}, False),
         ("logicalExpression", {"$boolCast": {"$strVal": "true"}}, True),
+        (
+            "logicalExpression",
+            {"$eq": [{"$attribute": {"CLAIMPATH": "/department/name"}}, {"$strVal": "engineering"}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$eq": [{"$strVal": "engineering"}, {"$attribute": {"CLAIMPATH": "/department/name"}}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$ne": [{"$attribute": {"CLAIMPATH": "/department/name"}}, {"$strVal": "engineering"}]},
+            False,
+        ),
+        (
+            "logicalExpression",
+            {"$eq": [{"$attribute": {"CLAIMPATH": "/department/name"}}, {"$field": "$sme#value"}]},
+            False,
+        ),
+        (
+            "logicalExpression",
+            {"$eq": [{"$attribute": {"CLAIMPATH": "/department/name"}}, {"$strCast": {"$field": "$sme#value"}}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$contains": [{"$attribute": {"CLAIMPATH": "/realm_access/roles"}}, {"$strVal": "admin"}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$contains": [{"$strVal": "admin"}, {"$attribute": {"CLAIMPATH": "/realm_access/roles"}}]},
+            False,
+        ),
+        (
+            "logicalExpression",
+            {"$contains": [{"$attribute": {"CLAIMPATH": "/realm_access/roles"}}, {"$strCast": {"$field": "$sme#value"}}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$regex": [{"$attribute": {"CLAIMPATH": "/department/name"}}, {"$strVal": "eng.*"}]},
+            False,
+        ),
+        (
+            "logicalExpression",
+            {"$regex": [{"$strCast": {"$attribute": {"CLAIMPATH": "/department/name"}}}, {"$strVal": "eng.*"}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$ge": [{"$numCast": {"$attribute": {"CLAIMPATH": "/assurance/level"}}}, {"$numVal": 3}]},
+            True,
+        ),
+        (
+            "logicalExpression",
+            {"$eq": [{"$attribute": {"CLAIMPATH": "/assurance/level"}}, {"$numVal": 3}]},
+            False,
+        ),
+        (
+            "logicalExpression",
+            {"$eq": [{"$dateTimeCast": {"$attribute": {"CLAIMPATH": "/validUntil"}}}, {"$dateTimeVal": "2026-06-30T09:00:00Z"}]},
+            True,
+        ),
         (
             "logicalExpression",
             {"$eq": [{"$dateTimeCast": {"$strVal": "2026-06-30T09:00:00Z"}}, {"$dateTimeVal": "2026-06-30T09:00:00Z"}]},
@@ -446,14 +559,15 @@ def validate_bnf_grammar_files(validation: Validation) -> None:
 
 def extract_function_calls(text: str, function_name: str) -> list[str]:
     calls: list[str] = []
-    needle = f"{function_name}("
+    call_pattern = re.compile(rf"\b{re.escape(function_name)}\s*\(")
     cursor = 0
     while True:
-        start = text.find(needle, cursor)
-        if start < 0:
+        match = call_pattern.search(text, cursor)
+        if match is None:
             return calls
 
-        index = start + len(needle)
+        argument_start = match.end()
+        index = argument_start
         depth = 1
         in_string = False
         while index < len(text):
@@ -465,7 +579,7 @@ def extract_function_calls(text: str, function_name: str) -> list[str]:
             elif not in_string and char == ")":
                 depth -= 1
                 if depth == 0:
-                    calls.append(text[start + len(needle) : index].strip())
+                    calls.append(text[argument_start:index].strip())
                     cursor = index + 1
                     break
             index += 1
@@ -497,6 +611,7 @@ def validate_bnf_examples(common_schema: dict[str, Any], validation: Validation)
             "ReferableIdentifier",
             "DescriptorIdentifier",
             "ReferenceIdentifier",
+            "claimPathAttributeItem",
         ]
     }
 
@@ -511,6 +626,7 @@ def validate_bnf_examples(common_schema: dict[str, Any], validation: Validation)
         text = path.read_text(encoding="utf-8")
         validate_balanced_delimiters(path, text, validation)
         validate_bnf_example_identifiers(path, text, validators, validation)
+        validate_bnf_example_claim_paths(path, text, validators["claimPathAttributeItem"], validation)
 
     print(f"OK: checked {len(example_bnf_files())} BNF examples")
 
@@ -552,6 +668,28 @@ def validate_bnf_example_identifiers(
         validate_string_with_definition(path, value, "FieldIdentifier", validators, validation)
 
 
+def validate_bnf_example_claim_paths(
+    path: Path,
+    text: str,
+    validator: Draft7Validator,
+    validation: Validation,
+) -> None:
+    for literal in extract_function_calls(text, "CLAIMPATH"):
+        try:
+            pointer = json.loads(literal)
+        except json.JSONDecodeError as exc:
+            validation.fail(path, f"CLAIMPATH argument is not a valid JSON string: {literal!r}: {exc.msg}")
+            continue
+
+        if not isinstance(pointer, str):
+            validation.fail(path, f"CLAIMPATH argument is not a JSON string: {literal!r}")
+            continue
+
+        errors = list(validator.iter_errors({"CLAIMPATH": pointer}))
+        if errors:
+            validation.fail(path, f"invalid CLAIMPATH {pointer!r}: {errors[0].message}")
+
+
 def main() -> int:
     validation = Validation()
     common_schema = validate_json_artifacts(validation)