There are no limitations to how many different checking conditions are applied because you can use a function to apply the condition(s) and do anything you want. Attributes are in the AttributeContext. https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631868/ProfileHandling#Post-Authentication-Intercept-Contract -- Scott