Restrict attribute values based on SP entity?

[Brian Mathis]

My overall goal is to restrict what values a specific entity can
supply for an attribute.  For example, entity1 might provide an
attribute name/value like:
    mode=abc
and entity2 might provide:
    mode=xyz
I need to restrict entity1 to only send "abc", while entity2 can only
send "xyz", and be scalable up to entity3, 4, etc...

As a general question, what is the best way to approach that?

I've run across the NativeSPAttributeFilter page which points to using
<AttributeFilter>, but the documentation is light there.  I've
reviewed the referenced IdPAddAttributeFilter page, but I can't seem
to get a working config.  I want it to block the attribute unless it
matches the specific attribute value for that entityid (pretty sure
it's the AttributeIssuerString).

I've tried various combinations of AttributeFilterPolicies and
AttributeRules, but they all seem to either allow everything or block
everything.  I'm starting from the default attribute-policy.xml file.

Is this the right approach?  Can anyone provide an example of doing this?

Thanks,
~ Brian