{HEAD ~ A process token} can optionally have {TAIL ~ multiple additional types} of SIDs based on other criteria  
optionally have
{ HEAD ~ A process token } can optionally have { TAIL ~ multiple additional types } of SIDs based on other criteria
HEAD HEAD HEAD HEAD HEAD HEAD HEAD OTH REL REL TAIL TAIL TAIL TAIL TAIL TAIL TAIL OTH OTH OTH OTH OTH OTH OTH