* There needs to be a definition of "hierarchy". In particular, a "hierarchy" defn should state that the fundamental properties are that there must be a single root node with no parent, and that every other node in the hierarchy must have one and only one parent, and can have zero, one, or more children.

in order to submit a request one has to somehow identify all the hierarchies the given node belongs to, all the hierarchies the node's parent(s) and ancestors to, and include an Attribute element for each.

I suspect that at most one would need to collect all the normative representations of only the resource-id node (i.e. identify all the hierarchies it belongs to), then for each hierarchy, one would evaluate the policies that apply to that hierarchy.