3. Content Rule
( token-added-entitlement | token-association | token-attr | token-base64-decode | token-base64-encode | token-char | token-class-name | token-convert-time | token-dest-attr | token-dest-dn | token-dest-name | token-document | token-entitlement | token-escape-for-dest-dn | token-escape-for-src-dn | token-generate-password | token-global-variable | token-join | token-local-variable | token-lower-case | token-named-password | token-map | token-op-attr | token-op-property | token-operation | token-parse-dn | token-password | token-query | token-removed-attr | token-removed-entitlement | token-replace-all | token-replace-first | token-resolve | token-split | token-src-attr | token-src-dn | token-src-name | token-substring | token-text | token-time | token-unique-name | token-unmatched-src-dn | token-upper-case | token-xml-parse | token-xml-serialize | token-xpath ) *