rt/ws/policy/src/test/resources/samples/test4.xml

<?xml version="1.0"?>
<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:sec="http://schemas.xmlsoap.org/ws/2002/12/secext">
    <wsp:ExactlyOne>
        <wsp:All>
            <sec:SecurityToken>
                <sec:TokenType>sec:X509v3</sec:TokenType>
            </sec:SecurityToken>
        </wsp:All>
        <wsp:All>
            <sec:SecurityToken>
                <sec:TokenType>sec:X509v3</sec:TokenType>
            </sec:SecurityToken>
            <sec:SecurityHeader MustPrepend="true"/>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>