<?xml version="1.0" encoding="utf-8"?>
<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
    <domain_access_rules>
        <domain_rule>
            <domains>
                <!-- All domains -->
                <id_range>
                    <min>0</min>
                    <max>230</max>
                </id_range>
            </domains>

            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
                 and topics that are configured as "unprotected" -->
            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>

            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
                  see the discovery data without checking access control  -->
            <enable_join_access_control>true</enable_join_access_control>

            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>

            <!--  Liveliness messages are also encrypted -->
            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>

            <!-- Whole RTPS message is not protected -->
            <rtps_protection_kind>NONE</rtps_protection_kind>

            <topic_access_rules>
                <topic_rule>
                    <!-- All (non-builtin) topics -->
                    <topic_expression>*</topic_expression>

                    <!-- Liveliness QoS data is protected -->
                    <enable_liveliness_protection>true</enable_liveliness_protection>

                    <!-- The discovery information on specific Topics should be sent
                         using the secure (protected) discovery writers -->
                    <enable_discovery_protection>true</enable_discovery_protection>

                    <!-- The read access to all topics should be open to all. -->
                    <enable_read_access_control>false</enable_read_access_control>

                    <!-- The write access to all topics should be open to all. -->
                    <enable_write_access_control>false</enable_write_access_control>

                    <!-- Whole RTPS sub-message is protected. This includes metadata information
                         like sequence numbers, heartbeats, key hashes, gaps,
                         acknowledgment messages, etc. It also includes th possible payload. -->
                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>

                    <!-- The payload data sent on the Topic (serialized application level data) should be
                         protected with Encrypt then MAC. -->
                    <data_protection_kind>ENCRYPT</data_protection_kind>
                </topic_rule>
            </topic_access_rules>
        </domain_rule>
    </domain_access_rules>
</dds>
