...
The "specific" policy could be implented implemented by a script, but the example demonstrates a new Java class added to V3.4 that checks the values of a resolved IdPAttribute against a dynamically computed candidate value (or values) produced by functions, which can themselves be scripts or expressions.
...