Reference

The policy documentation can be found here.

The demo policy is divided into sections (make sure that the naming are correct and that the structure is understandable):

WS Security section begins with:
<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy ... />
It defines rules:
<wsp:ExactlyOne>
Only one assertion should be fulfilled.
<wsp:All>

All the assertions should be fulfilled.